Differences between revisions 19 and 25 (spanning 6 versions)
Revision 19 as of 2010-10-21 22:50:28
Size: 3327
Editor: mpm
Comment:
Revision 25 as of 2015-05-04 18:19:06
Size: 3823
Editor: DisplayName
Comment:
Deletions are marked like this. Additions are marked like this.
Line 3: Line 3:
Restrict changes via access control lists.
Line 4: Line 5:
Restrict changes via access control lists. /!\ '''NOTE: This extension does not enable a workflow similar to that granted by DAV SVN even if they look very similar. Mercurial can't do partial commits, nor can it limit the change list sent (which in effect means all changes across a repository must be sent in its entirety). Such limited functionality can be supplied by [[Subrepository|subrepositories]].'''
Line 9: Line 10:
Line 15: Line 15:

The ACL extension lets you have fine grained access control to parts of a repository using deny and allow lists. These lists associate glob patterns to users.
Furthermore, it can restrict changes depending on its source (http, ssh, pull, push, bundle).
The ACL extension lets you have fine grained access control to parts of a repository using deny and allow lists. These lists associate glob patterns to users. Furthermore, it can restrict changes depending on its source (http, ssh, pull, push, bundle).
Line 22: Line 20:
Line 30: Line 27:
  
Line 45: Line 42:
  @designers = user1, user2   designers = user1, user2
Line 47: Line 44:
  [acl.deny.branches]    
  # Everyone is denied to the frozen branch: 
  frozen-branch = *    
  # A bad user is denied on all branches: 
  * = bad-user    
  [acl.allow.branches]    
  # A few users are allowed on branch-a: 
  branch-a = user-1, user-2, user-3    
  # Only one user is allowed on branch-b: 
  branch-b = user-1    
  # The super user is allowed on any branch: 
  * = super-user    
  # Everyone is allowed on branch-for-tests: 
  branch-for-tests = * 
  [acl.deny.branches]

  # Everyone is denied to the frozen branch:
  frozen-branch = *

  # A bad user is denied on all branches:
  * = bad-user

  # Only reviewers are allowed to write to the stable branch (by denying
  # those not in the reviewers group using the negation operator !)
  stable = !@reviewers

  [acl.allow.branches]

  # A few users are allowed on branch-a:
  branch-a = user-1, user-2, user-3

  # Only one user is allowed on branch-b:
  branch-b = user-1

  # The super user is allowed on any branch:
  * = super-user

  # Everyone is allowed on branch-for-tests:
  branch-for-tests = *
Line 106: Line 107:

ACL Extension

Restrict changes via access control lists.

/!\ NOTE: This extension does not enable a workflow similar to that granted by DAV SVN even if they look very similar. Mercurial can't do partial commits, nor can it limit the change list sent (which in effect means all changes across a repository must be sent in its entirety). Such limited functionality can be supplied by subrepositories.

1. Status

This extension is currently being distributed along with Mercurial.

Author: Vadim Gelfer

2. Overview

The ACL extension lets you have fine grained access control to parts of a repository using deny and allow lists. These lists associate glob patterns to users. Furthermore, it can restrict changes depending on its source (http, ssh, pull, push, bundle).

It's recommended that this extension is used with hg-ssh (a restricted shell for Mercurial ssh access) to tighten security.

3. Configuration

Below is an example configuration file (hgrc). The acl lists use the pattern = user syntax, where pattern is a glob by default. :

  [hooks]

  # Use this if you want to check access restrictions at commit time
  pretxncommit.acl = python:hgext.acl.hook

  # Use this if you want to check access restrictions for pull, push,
  # bundle and serve.
  pretxnchangegroup.acl = python:hgext.acl.hook

  [acl]
  # Check whether the source of incoming changes is in this list where
  # "serve" == ssh or http, and "push", "pull" and "bundle" are the
  # corresponding hg commands.
  sources = serve

  [acl.groups]
  # If a group name is not defined here, and Mercurial is running under
  # a Unix-like system, the list of users will be taken from the OS.
  # Otherwise, an exception will be raised.
  designers = user1, user2

  [acl.deny.branches]

  # Everyone is denied to the frozen branch:
  frozen-branch = *

  # A bad user is denied on all branches:
  * = bad-user

  # Only reviewers are allowed to write to the stable branch (by denying
  # those not in the reviewers group using the negation operator !)
  stable = !@reviewers

  [acl.allow.branches]

  # A few users are allowed on branch-a:
  branch-a = user-1, user-2, user-3

  # Only one user is allowed on branch-b:
  branch-b = user-1

  # The super user is allowed on any branch:
  * = super-user

  # Everyone is allowed on branch-for-tests:
  branch-for-tests = *

  [acl.deny]
  # This list is checked first. If a match is found, acl.allow is not
  # checked. All users are granted access if acl.deny is not present.
  # Format for both lists: glob pattern = user, ..., @group, ...

  # To match everyone, use an asterisk for the user:
  # my/glob/pattern = *

  # user6 will not have write access to any file:
  ** = user6

  # Group "hg-denied" will not have write access to any file:
  ** = @hg-denied

  # Nobody will be able to change "DONT-TOUCH-THIS.txt", despite
  # everyone being able to change all other files. See below.
  src/main/resources/DONT-TOUCH-THIS.txt = *

  [acl.allow]
  # if acl.allow not present, all users allowed by default
  # empty acl.allow = no users allowed

  # User "doc_writer" has write access to any file under the "docs"
  # folder:
  docs/** = doc_writer

  # User "jack" and group "designers" have write access to any file
  # under the "images" folder:
  images/** = jack, @designers

  # Everyone (except for "user6" - see acl.deny above) will have write
  # access to any file under the "resources" folder (except for 1
  # file. See acl.deny):
  src/main/resources/** = *

  .hgtags = release_engineer


CategoryBundledExtension

AclExtension (last edited 2015-05-04 18:19:06 by DisplayName)