[cvsnt] Where are CVS ACL settings stored?

[Arthur Barrett]

Eric,

> I'm starting to experiment with CVS ACL settings and with the 
> new VMFree application, it makes it quite easy.  

It just simply runs the "cvs chacl" command:
http://www.cvsnt.org/manual/html/chacl.html


> However, I was wondering exactly where 
> the ACL settings are stored.  

In the repository.

> Are they stored within files in 
> the CVSROOT 
> directory (at the repo level),
> or in a per-module basis?

Per directory - but the implementation is irrelevant (see below).

> What prevents a regular user from changing access settings on 
> a module?  Are 


CVS(NT) is a client / server system - you are expected to run the server
on one machine and the client on another.   Additionally - regular users
should not be allowed to "log in" on the server machine.  The repository
is your complete history of changes - this is highlighted by the "chacl"
problem - but really what's the point in recording history if any user
can come along and delete revisions?

If you really must have the users logging in to the cvs(nt) server then
use file permissions and the "run as user" option (in the cvsnt control
panel) to prevent users gaining access to the repository directly.

Regards,


Arthur Barrett