[cvsnt] security question

[bwhicks at aep.com]

Hello all,

I'd like to be able to prevent people from importing new modules into the
top level directory of the repository root, but only for non-admin users. I
noticed that if I check out a virtual module, you can do a cvs lsacl from
what would basically be that location in the repository, but any chacl
commands don't seem to "stick". So, with some experimenting, I created a
CVS folder in the top level folder and copied a fileattr.xml file there
that I edited by hand. This seems to have the desired results I was looking
for.

My question is, is there any downside to doing this? is there a better way?

Thanks!

Brian

p.s. I am running 2.5.02.2099 on Redhat ES3.6