cvsacl-users — General Discussion List for CVSACL

Re: [cvsacl-users] requirement of patched cvs-1.12.13

[kml p. <km...@gm...>]

please ignore my earlier mail
I found the patched version on sourceforge
sorry for the inconvenience
regards
kamal


On Tue, Feb 7, 2012 at 1:40 PM, Kamal Paryani <km...@gm...> wrote:

> hi arlindo da silva
>
> thanks for your patch for stock 1.12.13
>
>
> can you upload a patched 1.12.13 version
> instead of providing the diff files
>
> i tried using your diff files
>
> as you have mentioned that this is patch for stock 1.12.13
>
> i could not file the file ACL-DOC.txt in the stock source
> and also acl.c in the stock source
>
> so it would be very helpful for newbies like me if you provide the
> patched version
>
> thanks and regards
> kamal
>
>

[cvsacl-users] requirement of patched cvs-1.12.13

[Kamal P. <km...@gm...>]

hi arlindo da silva

thanks for your patch for stock 1.12.13


can you upload a patched 1.12.13 version
instead of providing the diff files

i tried using your diff files

as you have mentioned that this is patch for stock 1.12.13

i could not file the file ACL-DOC.txt in the stock source
and also acl.c in the stock source

so it would be very helpful for newbies like me if you provide the
patched version

thanks and regards
kamal

[cvsacl-users] New Patch for stock CVS-ACL 1.12.13

[Arlindo da S. <arl...@na...>]

diff -ruN cvs-1.12.13/ACL-DOC.txt cvs-1.12.13-cvsacl-2-patched/ACL-DOC.txt
--- cvs-1.12.13/ACL-DOC.txt	1969-12-31 19:00:00.000000000 -0500
+++ cvs-1.12.13-cvsacl-2-patched/ACL-DOC.txt	2006-06-03 15:12:28.000000000 -0400
@@ -0,0 +1,266 @@
+
+CVS Access Control List Extension
+
+Execution of all CVS commands can be controlled with eight
+different permissions.
+
+Permission Types:
+
+- no access
+  Command line character: 'n'
+  If a user is given 'n' permission, it is not allowed for any
+  action on repository. 
+- read
+  Command line character: 'r'
+  'r' permission gives only read access on repository.
+  With r permission users are allowed to run cvs commands:
+  annotate, checkout, diff, export, log, rannotate, rdiff, rlog, status.
+- write
+  Command line character: 'w'
+  'w permission allows only cvs commit/checkin action.
+  With w permission, users are not allowed to add/remove any file
+  to/from repository, other permissions should be defines for that. 
+- tag
+  Command line character: 't'
+  't' permission allows cvs tag and rtag commands to run.
+  't' permission includes 'r' permission, since without
+  reading you can not tag/untag a file. However 't' permission
+  does not include write permission, users can not commit
+  a file with only 't' permission. 
+- create
+  Command line character: 'c'
+  'c' permission allows cvs add and import commands to run.
+  To add or import a file/directory to repository, users must have
+  'c' permission. Again, 'c' permission does not include write permission,
+  thus users may only add or import files, but can not modify any
+  existing file. After issuing add command, file must be committed
+  to complete adding. This commit command is allowed because the user
+  is adding file and not modifying existing one.
+- delete
+  Command line character: 'd'
+  'd' permission allows cvs remove command to run. To remove a file/directory
+  from repository, 'd' permission have to be set. 'd' permission does not
+  include write permission, so users can not modify contents of an existing
+  file on repository. 
+- full access except admin rights
+  Command line character: 'a'
+  'a' permission gives all access (above permissions) to repository, but it
+  can not modify permissions. Only acl admins may modify the acl definitions. 
+- acl admin
+  Command line character: 'p'
+  'p' permission means that user is an acl admin, so it is allowed to
+  make anything on repository including permission change.
+
+
+ACL Config Keywords:
+The administrative file aclconfig contains miscellaneous settings which
+affect the behaviour of ACL extension. Currently defined keywords are:
+
+UseCVSACL=value 
+Access Control is enabled if set to yes. acl/racl commands only run when
+keyword is set to yes, and access control is enabled.
+Default value: no.
+
+UseCVSACLDefaultPermissions=value 
+Value can be any combination of valid permission types (w,r,t,c,d,t,a,p).
+if there is no defined ACL and default permissions in access file, or no
+access file at all, this permissions are used.
+Default value: p (admin rights).
+
+UseCVSGroups=value 
+CVS does not have a CVSROOT/passwd file. However it can be created manually
+(format should be same as /etc/group). If value set to yes, CVS checks for
+groups in file $CVSROOT/CVSROOT/group.
+Default value: no.
+
+UseSystemGroups=value 
+Group memberships for users are checked in file /etc/group, if value is set
+to yes.
+Default value: no.
+
+CVSACLFileLocation=value 
+Originally access file is put under CVSROOT/CVSROOT, To use a different
+location, set value to a valid path.
+Default value: $CVSROOT/CVSROOT/access.
+
+CVSGroupsFileLocation=value 
+To use a different location for group file set value to a valid path to group
+file. UseCVSGroups must be also enabled.
+Default value: NULL.
+
+UseSeparateACLFileForEachDir=value 
+If value is set to yes, a separate ACL file (access) is created for each
+directory in repository. If  the repository is really big and has tousands of
+files and directories, performance may drop due to a big access file.
+Setting the value to yes, may increase performance. Normally, it is not needed.
+Default value: no.
+
+DontPrintFileCantOpenWarnings=value
+If UseSeparateACLFileForEachDir keyword is set to yes, cvs acl looks for access
+file in each directory, and if there are many directories it will print a warning
+message for each directory which does not have an access file. To disable this warning
+messages set DontPrintFileCantOpenWarnings keyword to yes.
+Default value: no.
+
+StopAtFirstPermissionDenied=value
+If StopAtFirstPermissionDenied is set to yes operation will stop at first
+permission denied message. e.g. when you send commit command for a directory,
+if you dont have write permission for just one file under the directory, 
+by default you will have a warning and commit will continue on the other files.
+If this keyword is set to 'yes', then commit operation will be stopped
+when inaccassable file found.
+Default value: no.
+
+CVSServerRunAsUser=value 
+Set CVSServerRunAsUser keyword to a valid system user.
+When a user make a remote connection to CVS, after successfull authentication
+cvs process switch to run as that user, or defined system user in
+$CVSROOT/CVSROOT/passwd. Also unix file permissions  should be set accordingly.
+A better solution:
+Add a user and group such as both cvsadm.
+Set CVSServerRunAsUser keyword to cvsadm.
+Change unix file system permissions for the repository,
+make cvsadm user and group owner, and read, write, execute permissions and setgid.
+(chown cvsadm -R /path/to/your/repository)
+(chgrp cvsadm -R /path/to/your/repository)
+(chmod 2770 -R /path/to/your/repository)
+Add yourself to cvsadm group (since you are ACL administrator).
+Therefore, only users making remote connections will have access to repository
+if they have sufficient permissions defined through acl/racl commands.
+Local users can not access to repository via a cvs client or directly.
+
+Command Line Usage Information:
+acl command is used on checked out files or directories. racl command is
+used on repository without a working copy. Usage information can be obtained
+with standard cvs --help command.
+Output of cvs --help acl and cvs --help racl: 
+
+Usage: cvs racl [user||group:permissions] [-Rl] [-r tag]
+        -R      Process directories recursively.
+        -r rev  Existing revision/tag.
+        -l      List defined ACLs.
+
+Usage: cvs acl [user||group:permissions] [-Rl] [-r tag]
+        -R      Process directories recursively.
+        -r rev  Existing revision/tag.
+        -l      List defined ACLs.
+
+You may directly set permissions for a user or group or add/remove
+permissions with + and - signs to/from existing permissions.
+If you do not give the branch/tag information, default value of HEAD
+(main branch) will be used. You have to give branch/tag name with -r option.
+You may type ALL for branch/tag field.
+
+While checking for permissions, it goes thorough the list below. So the highest
+significant permission is the first item in list.
+
+- permissions assigned to username for specific directory or file. 
+- permissions assigned to group name for specific directory or file. 
+- permissions as defaults for specific directory or file. 
+- permissions assigned to parent folders (inherits from the first parent
+  which permissions are assigned).
+- permissions as repository defaults. 
+- default permissions in aclconfig file. 
+
+Using ALL keyword
+ALL keyword can be given as directory/file name or tag name or user/group name. As
+usually it represents all directory/file, or tag, or user/group. e.g. Using ALL
+for directory/file name means ALL directories and files in repository. Using ALL
+for tag name means all tags including main branch.
+
+Examples
+     /cvs/
+      |
+      |
+      +--projectA/
+      |	       |
+      |        +---CVSROOT/
+      |        |
+      |        +---lib/
+      |        |     |
+      |        |     +---gnulib/
+      |        |     |
+      |        |     +---zlib/
+      |        |
+      |        +---src/
+      |        |     |
+      |        |     +---main.c
+      |        |     |
+      |        |     +---server.c
+      |        |     |
+      |        |     +---client.c
+      |        |
+      |        +---gui/
+      |
+      +--projectB/
+We have above directory structure for a cvs repository, and no defined permissions.
+
+Setting main default permissions:
+
+$ cvs -d /cvs/projectA racl cvsadmin:p -r ALL ALL
+$ cvs -d /cvs/projectA racl ALL:r -r ALL ALL
+User cvsadmin will be an acl admin, and all other users will have only read
+rights on all branches/tags in projectA repository. This is the default acl
+definition and it overwrites default permissions in $CVSROOT/CVSROOT/aclconfig file.
+
+$ cvs -d /cvs/projectA racl ALL:r -r ALL ALL
+$ cvs -d /cvs/projectA racl ALL:n -r ALL gui
+After executing these two commands, all users will have read access on all
+directories and files except gui directory. Everyone will be denied to access to gui
+directory because no access(n) permission is set.
+
+Setting permissions directly on a file or directory:
+
+$ cvs -d /cvs/projectA racl userX:wcd lib
+$ cvs -d /cvs/projectA racl group1:w lib
+First command will set write, create, and delete permissions for userX on directory
+lib with branch HEAD (since no branch/tag information given, branch defaults to HEAD).
+
+Second command will set only write permission for group1 on directory lib with branch HEAD.
+Members of group1 will have only commit rights on lib directory, branch HEAD, they can
+not add or remove any file, just modify existing files.
+If userX is also a member of group1, userX will have write, create, and delete permissions
+because it is specifically given these permissions.
+
+$ cvs -d /cvs/projectA racl userY:wcd -r develStream lib
+$ cvs -d /cvs/projectA racl userY:r -r integStream lib
+These commands will give 'wcd' permissions to userY on lib directory with tag develStream,
+and 'r' permissions on lib directory with tag integStream.
+
+$ cvs -d /cvs/projectA racl userZ:wcd src
+$ cvs -d /cvs/projectA racl userZ:r src/main.c
+First command will give 'wcd' permissions to userZ on src directory, but only read
+permission on file main.c in src directory.
+
+Using + and - signs to set permissions on a file or directory:
+
+$ cvs -d /cvs/projectA racl userZ:+t src
+$ cvs -d /cvs/projectA racl userZ:-cd src
+$ cvs -d /cvs/projectA racl userZ:-wt src
+Before the first command, userZ has 'wcd' permissions on src directory, after issuing
+command it will have 'wcdt' permissions. Tag permission will be added. UserZ has 'wcdt'
+permissions, and we execute the second command to remove create and delete permissions.
+So userZ has 'wt' permissions. In the last command we also remove 'wt' permissions, finally
+userZ has no defined permissions left, and it will use the default permissions if set.
+
+Listing permissions on a file or directory:
+
+$ cvs -d /cvs/projectA racl -l src
+$ cvs -d /cvs/projectA racl -l src
+$ cvs -d /cvs/projectA racl -l src/main.c
+
+First command will list the permissions for src directory.
+Example output:
+d src HEAD | userX:wcd group1:r | defaults:r
+userX and group1 has assigned permissions, all other users will have default
+permissions, which is only read.
+
+Second command will list the permissions for files in src directory.
+Example output:
+f src/main.c HEAD | userX:wcd group1:r | defaults:r
+f src/server.c HEAD | userX:wcd group1:r | defaults:r
+f src/client.c HEAD | userX:wcd group1:r | defaults:r
+
+Third command will list the permissions for main.c file in src directory.
+Example output:
+f src/main.c HEAD | userX:wcd group1:r | defaults:r
diff -ruN cvs-1.12.13/src/acl.c cvs-1.12.13-cvsacl-2-patched/src/acl.c
--- cvs-1.12.13/src/acl.c	1969-12-31 19:00:00.000000000 -0500
+++ cvs-1.12.13-cvsacl-2-patched/src/acl.c	2010-02-03 13:00:54.000000000 -0500
@@ -0,0 +1,2133 @@
+/*
+ * Copyright (C) 2006 The Free Software Foundation, Inc.
+ *
+ * Portions Copyright (C) 2006, Baris Sahin <sbaris at users.sourceforge.net>
+ *                                          <http://cvsacl.sourceforge.net>
+ *
+ * 
+ * You may distribute under the terms of the GNU General Public License as
+ * specified in the README file that comes with the CVS source distribution.
+ * 
+ * 
+ *
+ * CVS ACCESS CONTROL LIST EXTENSION
+ *
+ * It provides advanced access control definitions per modules,
+ * directories, and files on branch/tag for remote cvs repository
+ * connections.Execution of all CVS subcommands can be controlled
+ * with eight different permissions.
+ *
+ * Permission Types:
+ * - no permission      (n) (1)
+ * - all permissions    (a) (2)
+ * - write permission   (w) (3)
+ * - tag permission     (t) (4)
+ * - read permission    (r) (5)
+ * - add permission     (c) (6)
+ * - remove permission  (d) (7)
+ * - permission	change  (p) (8)
+ * 
+ */
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+/* CVS headers.  */
+#include "fileattr.h"
+#include "cvs.h"
+#include "hardlink.h"
+
+/* GNULIB headers.  */
+#include "getline.h"
+#include <grp.h>
+#include <assert.h>
+
+static int acl_fileproc (void *callerdat, struct file_info *finfo);
+static Dtype acl_dirproc (void *callerdat, const char *dir, const char *repos,
+                                 const char *update_dir, List *entries);
+
+static int acllist_fileproc (void *callerdat, struct file_info *finfo);
+static Dtype acllist_dirproc (void *callerdat, const char *dir, const char *repos,
+                                     const char *update_dir, List *entries);
+
+static void acllist_print (char *line, const char *obj);
+
+static int racl_proc (int argc, char **argv, char *xwhere,
+                            char *mwhere, char *mfile, int shorten,
+                            int local_specified, char *mname, char *msg);
+
+FILE *open_accessfile (char *xmode, const char *repos, char **fname);
+FILE *open_groupfile (char *xmode);
+
+char *get_perms (char *xperms);
+char *make_perms (char *xperms, char *xfounduserpart, char **xerrmsg);
+
+char *findusername(const char *string1, const char *string2);
+char *findgroupname(const char *string1, const char *string2);
+
+static char *cache_repository = NULL;
+static int cache_retval;
+static int founddeniedfile;
+static int cache_perm;
+
+static int is_racl;
+
+char *tag = NULL;
+
+char *muser;
+char *mperms;
+static int defaultperms;
+
+static char *default_perms_object = NULL;
+char *default_part_perms_accessfile = NULL;
+int aclconfig_default_used;
+
+int acldir = 0;
+int aclfile = 0;
+int listacl = 0;
+
+int userfound = 0;
+int groupfound = 0;
+
+/* directory depth ... */
+char *dirs[255];
+
+static const char *const acl_usage[] =
+        {
+                "Usage: %s %s [user||group:permissions] [-Rl] [-r tag] [directories...] [files...]\n",
+                "\t-R\tProcess directories recursively.\n",
+                "\t-r rev\tExisting revision/tag.\n",
+                "\t-l\tList defined ACLs.\n",
+                "(Specify the --help global option for a list of other help options)\n",
+                NULL
+        };
+
+static const char *const racl_usage[] =
+        {
+                "Usage: %s %s [user||group:permissions] [-Rl] [-r tag] [directories...] [files...]\n",
+                "\t-R\tProcess directories recursively.\n",
+                "\t-r rev\tExisting revision/tag.\n",
+                "\t-l\tList defined ACLs.\n",
+                "(Specify the --help global option for a list of other help options)\n",
+                NULL
+        };
+
+
+int
+access_allowed (const char *file, const char *repos, char *tag,
+				int perm, char **mline, int *mpos, int usecache)
+{
+	int retval = 0;
+	int foundline = 0;
+	FILE *accessfp;
+
+	bool flag = true;
+
+	char *iline = NULL;
+	char *tempv = NULL;
+	char *tempc = NULL;
+	size_t tempsize;
+	
+	int intcount;
+	int accessfilecount;
+	int signlevel = -1;
+	int dadmin = 0;
+
+	const char *repository;
+	char *filefullname = NULL;
+
+	TRACE (TRACE_FUNCTION, "access_allowed (%s, %s, %s, %d, %s, %d, %d)", file, repos, tag, perm, mline, mpos, usecache);
+
+        retval = 0;
+
+	if (defaultperms)
+	{
+		repository = xstrdup ("ALL");
+	}
+	else {
+		if (strlen(repository = Short_Repository (repos)) == 0)
+		{
+			repository = xstrdup (".");
+		}
+	}
+
+	/* cache */
+	if (usecache
+	                && cache_repository != NULL
+	                && strcmp (cache_repository, repository) == 0
+	                && !founddeniedfile
+	                && perm == cache_perm)
+		return (cache_retval);
+	else
+	{
+	  if (cache_repository) free (cache_repository); // ams
+		cache_repository = xstrdup (repository);
+		cache_perm = perm;
+	}
+
+	iline = xstrdup(repository);
+
+	tempv = strtok(iline, "/\t");
+	tempc = xstrdup(tempv);
+	tempsize = strlen(tempc);
+
+	intcount = 0;
+	/* store paths from object to cvsroot */
+	dirs[intcount] = xstrdup(tempc);
+	//- printf("%%%%%% [%d] dir token = <%s>\n",intcount,dirs[intcount]);
+	while ((tempv = strtok(NULL, "/\t")) != NULL)
+	{
+		intcount++;
+
+		xrealloc_and_strcat(&tempc, &tempsize, "/");
+		xrealloc_and_strcat(&tempc, &tempsize, tempv);
+
+		dirs[intcount] = xstrdup(tempc);
+
+	}
+
+	/* free not needed variables here */
+	// free (tempv);
+	// if (tempc) free (tempc); // ams: do not deallocate output of strtok()
+	// if (iline) free (iline); // ams: do not deallocate output of strtok()
+
+	/* accessfilecount will used
+	 * if UseSeparateACLFile keyword is set to yes*/
+	accessfilecount = intcount;
+
+	/* if file is not null add it to dirs array */
+	if (file != NULL)
+	{
+		filefullname = xmalloc (strlen (repository)
+								+ strlen (file) + 2);
+
+		strcpy (filefullname, repository);
+		strcat (filefullname, "/");
+		strcat (filefullname, file);
+		
+		intcount++;
+		dirs[intcount] = xstrdup(filefullname);
+
+	}
+
+	for (accessfilecount; accessfilecount >= 0 && flag; accessfilecount--)
+	{
+		if (!config->aclconfig->UseSeparateACLFileForEachDir) {
+			flag = false;
+			accessfp = open_accessfile ("r", repository, NULL);
+		}
+		else
+		{
+			flag = true;
+			accessfp = open_accessfile ("r", dirs[accessfilecount], NULL);
+		}
+
+		if (accessfp != NULL)
+		{
+			char *line = NULL;
+			size_t line_allocated = 0;
+
+			char *xline;
+			char *part_type = NULL;
+			char *part_object = NULL;
+			char *part_tag = NULL;
+			char *part_perms = NULL;
+
+			int x;
+
+			while (getline (&line, &line_allocated, accessfp) >= 0)
+			{
+
+				if (line[0] == '#' || line[0] == '\0' || line[0] == '\n')
+					continue;
+
+				xline = xstrdup (line);
+				part_type = strtok (line, ":\t");
+				part_object = strtok (NULL, ":\t");
+				part_tag = strtok (NULL, ":\t");
+				part_perms = strtok (NULL, ":\t");
+
+				if (part_type == NULL || part_object == NULL ||
+								part_tag == NULL || part_perms == NULL)
+				{
+				  if (line) free (line); // ams
+					error(1, 0, "access file is corrupted or has invalid format");
+				}
+
+				for (x = intcount; x >= signlevel && x != -1; x--)
+				{
+					if (strcmp (dirs[x], part_object) == 0)
+					{
+						if (valid_tag (part_tag, tag))
+						{
+							foundline  = 1;
+
+							if (listacl || ((acldir || aclfile) && x == intcount) && strcmp(part_tag, tag) == 0)
+							{
+								*mline = xstrdup (xline);
+								*mpos = ftell (accessfp);
+							}
+
+							if (valid_perm (part_perms, perm))
+							{
+								if (signlevel == x)
+								{
+									if (strcmp(part_tag, "ALL") != 0 && !aclconfig_default_used)
+										retval = 1;
+								}
+								else if (!aclconfig_default_used)
+								{
+									signlevel = x;
+									retval = 1;
+								}
+								else {
+									/* nothing... */
+								}
+							}
+							else
+							{
+								if (signlevel == x)
+								{
+									if (strcmp(part_tag, "ALL") != 0 && !aclconfig_default_used)
+										retval = 0;
+								}
+								else if (!aclconfig_default_used)
+								{
+									signlevel = x;
+									retval = 0;
+
+									if (strncmp (part_type, "f", 1) == 0)
+										founddeniedfile = 1;
+								}
+								else {
+								}
+							}
+						}
+					}
+				}
+		
+				if (strncmp (xline, "d:ALL:", 6) == 0 && ((!groupfound && !userfound) || listacl))
+				{
+					/* a default found */
+					if (valid_tag (part_tag, tag) > 0)
+					{
+						foundline = 1;
+
+						default_part_perms_accessfile = xstrdup (part_perms);
+						if (valid_perm (part_perms, perm))
+						{
+
+						        retval = 1; // ams: only if user is in this group
+
+							if (perm == 8 || groupfound)
+								dadmin = 1;
+                                                        //break; // ams: without jumping out of this loop admin permissions
+                                                               // ams: are not honored.
+						}
+						else
+							retval = 0;
+
+					}
+
+				}
+				
+			}
+			
+			if (fclose (accessfp) == EOF)
+				error (1, errno, "cannot close 'access' file");
+		}
+	}
+
+	if (!foundline)
+	{
+		/* DEFAULT */
+		if (valid_perm (NULL, perm))
+			retval = 1;
+		else
+			retval = 0;
+	}
+
+	/* acl admin rigths 'p' */
+	if (dadmin)
+	{
+		retval = dadmin;
+	}
+
+	cache_retval = retval;
+
+	if (filefullname) free (filefullname); // ams
+
+	/* free directories array */
+	while (intcount >= 0)
+	{
+	  if (dirs[intcount]) free (dirs[intcount]); // ams
+		intcount--;
+	}
+
+	return retval;
+}
+
+/* Returns 1 if tag is valid, 0 if not */
+int
+valid_tag (char *part_tag, char *tag)
+{
+	int retval;
+        char *tag_;
+
+	if (tag == NULL)
+		tag_ = xstrdup ("HEAD");
+	else
+ 	        tag_ = xstrdup(tag);
+
+	if (strcmp (tag_, part_tag) == 0 || strcmp (part_tag, "ALL") == 0)
+		retval = 1;
+	else
+		retval = 0;
+
+        free(tag_);
+	return retval;
+}
+
+/* Returns 1 if successful, 0 if not. */
+int
+valid_perm (char *part_perms, int perm)
+{
+	char *perms=NULL;
+	int retval = 0;
+
+	perms = get_perms (part_perms);
+
+	/* Allow, if nothing found. */
+	if (perms[0] == '\0')
+		return (1);
+
+	/* no access allowed, exit */
+	if (strstr (perms, "n"))
+		retval = 0;
+	
+	if (strstr (perms, "p"))
+		/* admin rights */
+		retval = 1;
+	else if (strstr (perms, "a") && perm != 8)
+		/* all access allowed, exit */
+		retval = 1;
+	else
+		switch (perm)
+		{
+		case 3:/* write permission */
+			if (strstr (perms, "w"))
+				retval = 1;
+			break;
+		case 4:/* tag permission */
+			if (strstr (perms, "t"))
+				retval = 1;
+			break;
+		case 5:/* read permission */
+			if (strstr (perms, "w") || strstr (perms, "t") || strstr (perms, "c") ||
+			                strstr (perms, "d") || strstr (perms, "r"))
+				retval = 1;
+			break;
+		case 6:/* create permission */
+			if (strstr (perms, "c"))
+				retval = 1;
+			break;
+		case 7:/* delete permission */
+			if (strstr (perms, "d"))
+				retval = 1;
+			break;
+		case 8:/* permission change */
+			if (strstr (perms, "p"))
+				retval = 1;
+			break;
+		default:/* never reached */
+			retval = 0;
+			break;
+		}
+
+	if (perms) free (perms); // ams
+
+	return (retval);
+}
+
+/* returns permissions found */
+char *
+get_perms (char *part_perms)
+{
+	char *username=NULL;
+	char *xperms=NULL;
+	// size_t xperms_len = 1;
+	size_t xperms_len = 2; // must leave space for null termination
+
+	FILE *groupfp;
+
+	char *founduser = NULL;
+	char *foundall = NULL;
+	int default_checked = 0;
+
+	aclconfig_default_used = 0;
+
+	xperms = xmalloc (xperms_len);
+	xperms[0] = '\0';
+
+	/* use CVS_Username if set */
+	if (CVS_Username == NULL)
+		username = getcaller ();
+	else
+		username = CVS_Username;
+
+	/* no defined acl, no default acl in access file,
+	 * or no access file at all */
+	if (part_perms == NULL) {
+		if (config->aclconfig->CVSACLDefaultPermissions)
+		{
+			aclconfig_default_used = 1;
+			//- return (config->aclconfig->CVSACLDefaultPermissions);
+			if (xperms) free(xperms);
+                        xperms = xstrdup(config->aclconfig->CVSACLDefaultPermissions);
+			return xperms;
+		}
+		else
+			return xperms;
+	}
+
+check_default:
+		founduser = findusername (part_perms, username);
+		foundall = strstr (part_perms, "ALL!");
+
+	if (founduser)
+	{
+		char *usr;
+		char *per;
+
+		usr = strtok (founduser, "!\t");
+		per = strtok (NULL, ",\t");
+
+		if (xperms) free(xperms);
+		xperms = xstrdup (per);
+		xperms_len = strlen (xperms);
+
+		userfound = 1;
+	}
+	else
+	{
+		if (config->aclconfig->UseSystemGroups) {
+			struct group *griter;
+			setgrent ();
+			while (griter = getgrent ()) {
+				char **users=griter->gr_mem;
+				int index = 0;
+				char *userchk = users [index++];
+				while(userchk != NULL) {
+					if(strcmp (userchk, username) == 0)
+						break;
+					userchk = users[index++];
+				}
+				if (userchk != NULL) {
+					char *grp;
+					if ((grp = findusername (part_perms, griter->gr_name))) {
+						char *gperm = strtok (grp, "!\t");
+						gperm = strtok (NULL, ",\t");
+						xrealloc_and_strcat (&xperms, &xperms_len, gperm);
+
+						groupfound = 1;
+					}
+				}
+			}
+			endgrent ();
+		}
+		else if (config->aclconfig->UseCVSGroups) {
+			groupfp = open_groupfile ("r");
+			if (groupfp != NULL)
+			{
+				char *line = NULL;
+				char *grp;
+				char *gperm;
+				int read;
+				
+				size_t line_allocated = 0;
+
+				while ((read = getline (&line, &line_allocated, groupfp)) >= 0)
+				{
+					if (line[0] == '#' || line[0] == '\0' || line[0] == '\n')
+						continue;
+					
+					if (line[read - 1] == '\n')
+						line[--read] = '\0';
+
+					if (grp = findusername (part_perms, findgroupname (line, username)))
+					{
+						gperm = strtok (grp, "!\t");
+						gperm = strtok (NULL, ",\t");
+						xrealloc_and_strcat (&xperms, &xperms_len, gperm);
+						groupfound = 1;
+					}
+				}
+				
+				if (line) free (line); // ams
+								
+				if (fclose (groupfp) == EOF)
+					error (1, errno, "cannot close 'group' file");
+			}
+		}
+	}
+
+	if (foundall)
+	{
+		char *usr;
+		char *per;
+		
+		usr = strtok (strstr (part_perms, "ALL!"), "!\t");
+		per = strtok (NULL, ",\t");
+
+		if (!default_checked)
+			default_perms_object = xstrdup (per);
+
+		if (xperms[0] == '\0')
+		{
+			if (xperms) free(xperms);
+			xperms = xstrdup (per);
+			xperms_len = strlen (xperms);
+		}
+		
+                // ams: these come from strtok()/strstr() --- do not deallocate
+		// free(foundall);
+		// free(usr);
+		// free(per);
+	}
+	
+	if (xperms[0] == '\0' && !default_checked && default_part_perms_accessfile)
+	{
+		part_perms = xstrdup (default_part_perms_accessfile);
+		default_checked = 1;
+
+		goto check_default;
+	}
+
+	if (xperms[0] != '\0' && strcmp (xperms, "x") == 0)
+	{
+                if (default_perms_object) {
+			if (xperms) free(xperms);
+			xperms = xstrdup (default_perms_object);
+                }
+		else if (default_part_perms_accessfile)
+		{
+			part_perms = default_part_perms_accessfile;
+			default_checked = 1;
+			goto check_default;
+		}
+		else if (config->aclconfig->CVSACLDefaultPermissions)
+		{
+			aclconfig_default_used = 1;
+			if (xperms) free(xperms);
+			xperms = xstrdup (config->aclconfig->CVSACLDefaultPermissions);
+		}
+	}
+
+	if (xperms[0] == '\0' && config->aclconfig->CVSACLDefaultPermissions)
+	{
+		aclconfig_default_used = 1;
+		if (xperms) free(xperms);
+		xperms = xstrdup (config->aclconfig->CVSACLDefaultPermissions);
+	}
+
+	return xperms;
+}
+
+
+int
+cvsacl (int argc, char **argv)
+{
+	char *chdirrepository;
+	int c;
+	int err = 0;
+	int usetag = 0;
+	int recursive = 0;
+
+	int which;
+	char *where;
+
+	is_racl = (strcmp (cvs_cmd_name, "racl") == 0);
+
+	if (argc == -1)
+		usage (is_racl ? racl_usage : acl_usage);
+
+	/* parse the args */
+	optind = 0;
+
+	while ((c = getopt (argc, argv, "Rr:l")) != -1)
+	{
+		switch (c)
+		{
+		case 'R':
+			recursive = 1;
+			break;
+		case 'r': // baris
+			tag = xstrdup (optarg);
+			break;
+		case 'l':
+			listacl = 1;
+			break;
+		case '?':
+		default:
+			usage (is_racl ? racl_usage : acl_usage);
+			break;
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	if (listacl) 
+	  if ( argv[0] ) // ams: to prevent segfaults 
+            { if (strstr (argv[0], ":"))
+	      usage (is_racl ? racl_usage : acl_usage); }
+	if (!listacl) 
+	  if ( argv[0] ) // ams: to prevent segfaults 
+            { if (!strstr (argv[0], ":"))
+	      usage (is_racl ? racl_usage : acl_usage); }
+
+	if (argc < (is_racl ? 1 : 1))
+		usage (is_racl ? racl_usage : acl_usage);
+
+#ifdef CLIENT_SUPPORT
+
+	if (current_parsed_root->isremote)
+	{
+		start_server ();
+		ign_setup ();
+
+		if(recursive)
+			send_arg ("-R");
+
+		if (listacl)
+			send_arg ("-l");
+
+		if(tag)
+		{
+			option_with_arg ("-r", tag);
+		}
+
+		send_arg ("--");
+
+		if (!listacl)
+		{
+			send_arg (argv[0]);
+
+			argc--;
+			argv++;
+		}
+
+		if (is_racl)
+		{
+			int i;
+			for (i = 0; i < argc; ++i)
+				send_arg (argv[i]);
+
+			send_to_server ("racl\012",0);
+		}
+		else
+		{
+			send_files (argc, argv, recursive, 0, SEND_NO_CONTENTS);
+			send_file_names (argc, argv, SEND_EXPAND_WILD);
+			send_to_server ("acl\012", 0);
+		}
+		
+		return get_responses_and_close ();
+	}
+#endif
+
+#ifdef SERVER_SUPPORT
+
+	if (!listacl)
+	{
+		muser = strtok (argv[0], ":\t");
+		mperms = strtok (NULL, ":\t");
+
+		/* if set to 'default' */
+		if ((strlen (mperms) == 7) && (strncmp (mperms, "default", 7) == 0))
+			mperms = xstrdup ("x");
+
+		/* Check that the given permissions are valid. */
+		if (!given_perms_valid (mperms))
+			error (1,0,"Invalid permissions: `%s'", mperms);
+
+		argc--;
+		argv++;
+	}
+
+
+	if (!tag)
+		tag = xstrdup ("HEAD");
+
+	if (!strcasecmp (argv[0], "ALL"))
+	{
+		argv[0] = xstrdup (".");
+		defaultperms = 1;
+		if (!config->aclconfig->UseSeparateACLFileForEachDir)
+		{
+			recursive = 0;
+		}
+
+	}
+
+	if (is_racl)
+	{
+		DBM *db;
+		int i;
+		db = open_module ();
+		for (i = 0; i < argc; i++)
+		{
+			err += do_module (db, argv[i], MISC, "ACL ing: ",
+			                  racl_proc, NULL, 0, !recursive, 0,
+			                  0, NULL);
+		}
+		close_module (db);
+	}
+	else
+	{
+		err = racl_proc (argc + 1, argv - 1, NULL, NULL, NULL, 0, !recursive, NULL,
+		                 NULL);
+	}
+
+	return err;
+
+#endif
+}
+
+static int
+racl_proc (int argc, char **argv, char *xwhere, char *mwhere,
+		   char *mfile, int shorten, int local, char *mname, char *msg)
+{
+	char *myargv[2];
+	int err = 0;
+	int which;
+	char *repository = NULL;
+	char *where;
+	char *obj;
+	size_t objlen = 0;
+
+	if (!config->aclconfig->UseCVSACL)//baris
+	{
+		error(1, 0, "CVSACL extension is not enabled, set `UseCVSACL=yes' in aclconfig file");
+	}
+
+	if (is_racl)
+	{
+		repository = xmalloc (strlen (current_parsed_root->directory) + strlen (argv[0])
+		                      + (mfile == NULL ? 0 : strlen (mfile) + 1) + 2);
+
+		(void) sprintf (repository, "%s/%s", current_parsed_root->directory, argv[0]);
+		where = xmalloc (strlen (argv[0]) + (mfile == NULL ? 0 : strlen (mfile) + 1)
+		                 + 1);
+		(void) strcpy (where, argv[0]);
+
+		/* if mfile isn't null, we need to set up to do only part of the module */
+		if (mfile != NULL)
+		{
+			char *cp;
+			char *path;
+
+			/* if the portion of the module is a path, put the dir part on repos */
+			if ((cp = strrchr (mfile, '/')) != NULL)
+			{
+				*cp = '\0';
+				(void) strcat (repository, "/");
+				(void) strcat (repository, mfile);
+				(void) strcat (where, "/");
+				(void) strcat (where, mfile);
+				mfile = cp + 1;
+			}
+
+			/* take care of the rest */
+			path = xmalloc (strlen (repository) + strlen (mfile) + 5);
+			(void) sprintf (path, "%s/%s", repository, mfile);
+			if (isdir (path))
+			{
+				/* directory means repository gets the dir tacked on */
+				(void) strcpy (repository, path);
+				(void) strcat (where, "/");
+				(void) strcat (where, mfile);
+			}
+			else
+			{
+				myargv[0] = argv[0];
+				myargv[1] = mfile;
+				argc = 2;
+				argv = myargv;
+			}
+			if (path) free (path); // ams
+		}
+
+		/* cd to the starting repository */
+		if ( CVS_CHDIR (repository) < 0)
+		{
+			error (0, errno, "cannot chdir to %s", repository);
+			if (repository) free (repository); // ams
+			if (where)      free (where);      // ams
+			return 1;
+		}
+
+		/* End section which is identical to patch_proc.  */
+
+		which = W_REPOS | W_ATTIC;
+
+		if (argc > 1)
+		{
+/*			xrealloc_and_strcat (&obj, &objlen, repository);
+			xrealloc_and_strcat (&obj, &objlen, "/");
+			xrealloc_and_strcat (&obj, &objlen, argv[1]);
+			xrealloc_and_strcat (&obj, &objlen, ",v");
+*/
+			obj = xmalloc (strlen (repository) + 1 + strlen (argv[1]));
+			(void) sprintf (obj, "%s/%s", repository, argv[1]);
+		}
+		else
+		{
+/*			xrealloc_and_strcat (&obj, &objlen, repository);
+			xrealloc_and_strcat (&obj, &objlen, ",v");
+			obj = xmalloc (strlen (repository) + 2);
+			(void) sprintf (obj, "%s,v", repository);
+*/
+			obj = xstrdup(repository);
+		}
+	}
+	else
+	{
+		where = NULL;
+		which = W_LOCAL | W_REPOS | W_ATTIC;
+
+		obj = xstrdup (argv[1]);
+	}
+
+	if (isdir (obj))
+		acldir = 1;
+	else if (isfile (obj))
+		aclfile = 1;
+	else
+		error(1, 0, "no such file or directory");
+	
+	if (obj) free (obj); // ams
+
+	if (listacl)
+		err = start_recursion (acllist_fileproc, NULL, acllist_dirproc, NULL, NULL,
+		                       argc - 1, argv + 1, local, which, 0, 0, (char *) where, 1,
+								repository);
+	else
+		err = start_recursion (acl_fileproc, NULL, acl_dirproc, NULL, NULL,
+		                       argc - 1, argv + 1, local, which, 0, 0, (char *) where, 1,
+								repository);
+
+	if (repository != NULL)
+	  free (repository);
+	
+	return err;
+}
+
+
+static int
+acl_fileproc (void *callerdat, struct file_info *finfo)
+{
+	char *filefullname;
+	char *founduserpart = NULL;
+	char *otheruserparts = NULL;
+	size_t otherslen = 0;
+
+	const char *frepository;
+	int foundline = 0;
+
+	char *line = NULL;
+	size_t line_allocated = 0;
+	int linelen;
+
+	char *wperms;
+	char *errmsg;
+
+	int pos;
+	
+	if (!aclfile)
+		return 0;
+
+	frepository = Short_Repository (finfo->repository);
+
+	filefullname = xmalloc (strlen (frepository)
+	                        + strlen (finfo->file)
+	                        + 2);
+	strcpy (filefullname, frepository);
+	strcat (filefullname, "/");
+	strcat (filefullname, finfo->file);
+
+	
+	if (!access_allowed (finfo->file, finfo->repository, tag, 8, &line, &pos, 0))
+		error (1,0,"You do not have acl admin rights on '%s'", frepository);
+
+	if (line != NULL)
+	{
+		char *part_type = NULL;
+		char *part_object = NULL;
+		char *part_tag = NULL;
+		char *part_perms = NULL;
+		char *userpart;
+			
+		part_type = strtok (line, ":\t");
+		part_object = strtok (NULL, ":\t");
+		part_tag = strtok (NULL, ":\t");
+		part_perms = strtok (NULL, ":\t");
+
+		foundline = 1;
+		userpart = strtok (part_perms, ",\t");
+
+		do
+		{
+			if (strncmp (userpart, muser, strlen (muser)) == 0)
+				founduserpart = xstrdup (userpart);
+			else
+			{
+				if (otheruserparts != NULL)
+				{
+					xrealloc_and_strcat (&otheruserparts, &otherslen, ",");
+					xrealloc_and_strcat (&otheruserparts, &otherslen, userpart);
+				}
+				else
+				{
+					otheruserparts = xstrdup (userpart);
+					otherslen = strlen (otheruserparts);
+				}
+			}
+		} while ((userpart = strtok (NULL, ",\t")) != NULL);
+		
+		// free (userpart); // ams: do not deallocated output of strtok()
+	}
+
+	wperms = make_perms (mperms, founduserpart, &errmsg);
+	if (wperms == NULL)
+	{
+		if (errmsg)
+			error (0, 0, "`%s' %s", filefullname, errmsg);
+	}
+	else
+	{
+		cvs_output ("X ", 0);
+		cvs_output (filefullname, 0);
+		cvs_output ("\n", 0);
+
+		write_perms (muser, wperms, founduserpart, foundline,
+		             otheruserparts, "f", filefullname, tag, pos, Short_Repository(finfo->repository));
+	}
+
+	if (line)           free (line);              // ams
+	if (founduserpart)  free (founduserpart);     // ams
+	if (otheruserparts) free (otheruserparts);    // ams
+	if (wperms)         free (wperms);            // ams
+	if (filefullname)   free (filefullname);      // ams
+	
+	return 0;
+}
+
+static Dtype
+acl_dirproc (void *callerdat, const char *dir, const char *repos,
+			 const char *update_dir, List *entries)
+{
+	const char *drepository;
+	char *founduserpart = NULL;
+	char *otheruserparts = NULL;
+	size_t otherslen = 0;
+	int foundline = 0;
+
+	char *line = NULL;
+	size_t line_allocated = 0;
+	int linelen;
+
+	int pos;
+
+	char *wperms;
+	char *errmsg;
+
+	if (!acldir)
+		return 0;
+
+	if (repos[0] == '\0')
+		repos = Name_Repository (dir, NULL);
+
+	if (!access_allowed (NULL, repos, tag, 8, &line, &pos, 0))
+		error (1,0,"You do not have admin rights on '%s'", Short_Repository (repos));
+
+	drepository = Short_Repository (repos);
+
+	if (line != NULL)
+	{
+		char *part_type = NULL;
+		char *part_object = NULL;
+		char *part_tag = NULL;
+		char *part_perms = NULL;
+		char *userpart;
+				
+		part_type = strtok (line, ":\t");
+		part_object = strtok (NULL, ":\t");
+		part_tag = strtok (NULL, ":\t");
+		part_perms = strtok (NULL, ":\t");
+					
+		foundline = 1;
+		userpart = strtok (part_perms, ",\t");
+
+		do
+		{
+			if (strncmp (userpart, muser, strlen (muser)) == 0)
+				founduserpart = xstrdup (userpart);
+			else
+			{
+				if (otheruserparts != NULL)
+				{
+					xrealloc_and_strcat (&otheruserparts, &otherslen, ",");
+					xrealloc_and_strcat (&otheruserparts, &otherslen, userpart);
+				}
+				else
+				{
+					otheruserparts = xstrdup (userpart);
+					otherslen = strlen (otheruserparts);
+				}
+			}
+		} while ((userpart = strtok (NULL, ",\t")) != NULL);
+	}
+
+	wperms = make_perms (mperms, founduserpart, &errmsg);
+	if (wperms == NULL)
+	{
+		if (errmsg)
+			error (0, 0, "`%s' %s", drepository, errmsg);
+	}
+	else
+	{
+		if (defaultperms)
+		{
+			cvs_output ("X ", 0);
+			cvs_output ("ALL", 0);
+			cvs_output ("\n", 0);
+			write_perms (muser, wperms, founduserpart, foundline,
+			             otheruserparts, "d", "ALL", tag, pos, drepository);
+
+		}
+		else
+		{
+			cvs_output ("X ", 0);
+			cvs_output (drepository, 0);
+			cvs_output ("\n", 0);
+			write_perms (muser, wperms, founduserpart, foundline,
+			             otheruserparts, "d", drepository, tag, pos, drepository);
+		}
+	}
+	
+	 if (line)           free (line);              // ams
+	 if (founduserpart)  free (founduserpart);     // ams
+	 if (otheruserparts) free (otheruserparts);    // ams
+	 if (wperms)         free (wperms);            // ams
+	
+	return 0;
+}
+
+/* Open CVSROOT/access or defined CVSACLFileLocation file 
+ * Open access file In each directory if UseSeparateACLFileForEachDir=yes
+ * returns file pointer to access file or NULL if access file not found */
+FILE *
+open_accessfile (char *fmode, const char *adir, char **fname)
+{
+	char *accessfile = NULL;
+	FILE *accessfp;
+
+	if (!config->aclconfig->UseSeparateACLFileForEachDir)
+	{
+		if (config->aclconfig->CVSACLFileLocation == NULL)
+		{
+			accessfile = xmalloc (strlen (current_parsed_root->directory)
+			                      + sizeof (CVSROOTADM)
+			                      + sizeof (CVSROOTADM_ACCESS)
+			                      + 3);
+
+			strcpy (accessfile, current_parsed_root->directory);
+			strcat (accessfile, "/");
+			strcat (accessfile, CVSROOTADM);
+			strcat (accessfile, "/");
+			strcat (accessfile, CVSROOTADM_ACCESS);
+		}
+		else
+		{
+			accessfile = xstrdup(config->aclconfig->CVSACLFileLocation);
+		}
+	}
+	else
+	{
+		size_t accessfilelen = 0;
+		xrealloc_and_strcat (&accessfile, &accessfilelen, current_parsed_root->directory);
+		xrealloc_and_strcat (&accessfile, &accessfilelen, "/");
+		xrealloc_and_strcat (&accessfile, &accessfilelen, adir);
+		xrealloc_and_strcat (&accessfile, &accessfilelen, "/access");
+	}
+
+	accessfp = CVS_FOPEN (accessfile, fmode);
+
+	if (accessfp == NULL && !config->aclconfig->DontPrintFileCantOpenWarnings)
+		error (0, 0, "cannot open file: %s", accessfile);
+
+	if (fname != NULL)
+		*fname = xstrdup (accessfile);
+
+	if (accessfile) free (accessfile); // ams
+
+	return accessfp;
+}
+
+/* Open /etc/group file if UseSystemGroups=yes in config file
+ * Open CVSROOT/group file if UseCVSGroups=yes in config file
+ * Open group file if specified in CVSGroupsFileLocation 
+ * returns group file pointer if UseSystemGroups=yes
+ * returns NULL if UseSystemGroups=no or group file not found */
+FILE *
+open_groupfile (char *fmode)
+{
+	char *groupfile = NULL;
+	FILE *groupfp;
+
+	if (config->aclconfig->UseCVSGroups)
+	{
+		if (config->aclconfig->CVSGroupsFileLocation != NULL)
+		{
+			groupfile = xmalloc (strlen (config->aclconfig->CVSGroupsFileLocation));
+			strcpy (groupfile, config->aclconfig->CVSGroupsFileLocation);
+		}
+		else
+		{
+			groupfile = xmalloc (strlen (current_parsed_root->directory)
+			                     + sizeof (CVSROOTADM)
+			                     + sizeof (CVSROOTADM_GROUP)
+			                     + 3);
+
+			strcpy (groupfile, current_parsed_root->directory);
+			strcat (groupfile, "/");
+			strcat (groupfile, CVSROOTADM);
+			strcat (groupfile, "/");
+			strcat (groupfile, CVSROOTADM_GROUP);
+		}
+	}
+	else
+	{
+		return NULL;
+	}
+
+	groupfp = CVS_FOPEN (groupfile, "r");
+
+	if (groupfp == NULL)
+		error (0, 0, "cannot open file: %s", groupfile);
+
+	if (groupfile) free (groupfile); // ams
+
+	return groupfp;
+}
+
+
+/* Check whether given permissions are valid or not
+ * Returns 1 if permissions are valid
+ * Returns 0 if permissions are NOT valid */
+int
+given_perms_valid (const char *cperms)
+{
+	int cperms_len;
+	int retval;
+	int index, i;
+
+	if (cperms[0] == '+' || cperms[0] == '-')
+		index = 1;
+	else
+		index = 0;
+
+	cperms_len = strlen (cperms);
+
+	switch (cperms[index])
+	{
+		case 'x':
+			if ((cperms_len - index) == 1 && cperms_len == 1)
+				retval = 1;
+			else
+				retval = 0;
+			break;
+		case 'n':
+			if ((cperms_len - index) == 1 && cperms_len == 1)
+				retval = 1;
+			else
+				retval = 0;
+			break;
+		case 'p':
+			if ((cperms_len - index) == 1)
+				retval = 1;
+			else
+				retval = 0;
+			break;
+		case 'a':
+			if ((cperms_len - index) == 1)
+				retval = 1;
+			else
+				retval = 0;
+			break;
+		case 'r':
+			if ((cperms_len - index) == 1)
+				retval = 1;
+			else
+				retval = 0;
+			break;
+		case 'w':
+			if ((cperms_len - index) == 1)
+				retval = 1;
+			else
+				for (i = index + 1; i < cperms_len; i++)
+					if (cperms[i] == 't' || cperms[i] == 'c' || cperms[i] == 'd')
+						retval = 1;
+					else
+						retval = 0;
+			break;
+		case 't':
+			if ((cperms_len - index) == 1)
+				retval = 1;
+			else
+				for (i = index + 1; i < cperms_len; i++)
+					if (cperms[i] == 'w' || cperms[i] == 'c' || cperms[i] == 'd')
+						retval = 1;
+					else
+						retval = 0;
+			break;
+		case 'c':
+			if ((cperms_len - index) == 1)
+				retval = 1;
+			else
+				for (i = index + 1; i < cperms_len; i++)
+					if (cperms[i] == 't' || cperms[i] == 'w' || cperms[i] == 'd')
+						retval = 1;
+					else
+						retval = 0;
+			break;
+		case 'd':
+			if ((cperms_len - index) == 1)
+				retval = 1;
+			else
+				for (i = index + 1; i < cperms_len; i++)
+					if (cperms[i] == 't' || cperms[i] == 'c' || cperms[i] == 'w')
+						retval = 1;
+					else
+						retval = 0;
+			break;
+		default:
+			retval = 0;
+			break;
+	}
+	
+	return retval;
+}
+
+/* prepare permsissions string to be written to access file
+ * returns permissions or NULL if */
+char *
+make_perms (char *perms, char *founduserpart, char **xerrmsg)
+{
+	char *fperms = NULL;
+	size_t perms_len;
+	size_t fperms_len;
+	
+	int i, j;
+	int err = 0;
+	char *errmsg = NULL;
+	
+	char *retperms = NULL;
+	size_t retperms_len = 1;
+
+	retperms = xmalloc (retperms_len);
+	retperms[0] = '\0';
+
+	perms_len = strlen (perms);
+
+	if (perms[0] == '+' || perms[0] == '-')
+	{
+		if (founduserpart)
+		{
+			char *tempfperms;
+			size_t tempfperms_len;
+			
+			char *temp;
+			int per = 0;
+			temp = strtok (founduserpart, "!\t");
+			fperms = strtok (NULL, "!\t");
+			fperms_len = strlen (fperms);
+
+			if (strncmp (fperms, "x", 1) == 0)
+			{
+				err = 1;
+				if (perms[0] == '+')
+					*xerrmsg = xstrdup ("cannot add default permission 'x'");
+				else
+					*xerrmsg = xstrdup ("cannot remove default permission 'x'");
+			}
+
+			/* go through perms */
+			for (i = 1; i < perms_len && !err; i++)
+			{
+				switch (perms[i])
+				{
+					case 'n':
+						err = 1;
+						break;
+					case 'p':
+						if (perms[0] == '+')
+							fperms = xstrdup ("p");
+						else if (perms[0] == '-')
+						{
+							fperms_len = 1;
+							fperms = xmalloc (fperms_len);
+							fperms[0] = '\0';
+						}
+						break;
+					case 'a':
+						for (j = 0; j < fperms_len; j++)
+						{
+							if (fperms[j] == 'p')
+							{
+								err = 1;
+								*xerrmsg = xstrdup ("user have admin rights, cannot use +/- permissions");
+							}
+							else if (fperms[j] == 'a' && perms[0] == '+')
+							{
+								err = 1;
+								*xerrmsg = xstrdup ("user already has all ('a') permission");
+							}
+							else if (fperms[j] != 'a' && perms[0] == '-')
+							{
+								err = 1;
+								*xerrmsg = xstrdup ("user does not have all ('a') permission");
+							}
+						}
+						if (perms[0] == '+')
+						{
+							fperms = xstrdup ("a");
+							fperms_len = strlen (fperms);
+						}
+						else if (perms[0] == '-')
+						{
+							fperms_len = 1;
+							fperms = xmalloc (fperms_len);
+							fperms[0] = '\0';
+						}
+	
+						break;
+					case 'r':
+						for (i = 0; i < fperms_len; i++)
+						{
+							if (fperms[i] == 'n' && perms[0] == '+')
+							{
+								fperms = xstrdup ("r");
+								fperms_len = strlen (fperms);
+							}
+							else if (fperms[i] == 'r' && perms[0] == '-')
+							{
+								fperms_len = 1;
+								fperms = xmalloc (fperms_len);
+								fperms[0] = '\0';
+							}
+							else if (perms[0] == '-')
+							{
+								err = 1;
+								*xerrmsg = xstrdup ("user has other permissions, cannot remove read ('r') permission");
+							}
+							else
+							{
+								err = 1;
+								*xerrmsg = xstrdup ("user has other permissions, cannot remove read ('r') permission");
+							}
+						}
+						break;
+					case 'w':
+						{
+							tempfperms_len = 1;
+	
+							tempfperms = xmalloc (tempfperms_len);
+							tempfperms[0] = '\0';
+	
+							for (j = 0; j < fperms_len; j++)
+							{
+								if (fperms[j] == 't' || fperms[j] == 'c' || fperms[j] == 'd')
+								{
+									char *temp;
+									temp = xmalloc (2);
+									temp[0] = fperms[j];
+									temp[1] = '\0';
+	
+									xrealloc_and_strcat (&tempfperms, &tempfperms_len, temp);
+									if (temp) free (temp); // ams
+								}
+								else if (fperms[j] == 'a' || fperms[j] == 'p')
+								{
+									err = 1;
+									*xerrmsg = xstrdup ("user has higher permissions, cannot use +/- write permissions");
+								}
+								else if (fperms[j] == 'n' || fperms[j] == 'r')
+								{
+									if (perms[0] == '-')
+									{
+										err = 1;
+										*xerrmsg = xstrdup ("user does not have write ('w') permission");
+									}
+								}
+								else if (fperms[j] == 'w')
+								{
+									per = 1;
+									if (perms[0] == '+') {
+										err = 1;
+										*xerrmsg = xstrdup ("user already have write ('w') permission");
+									}
+								}
+							}
+	
+							fperms = xstrdup (tempfperms);
+							fperms_len = strlen (fperms);
+							if (tempfperms) free (tempfperms); // ams
+	
+							if (!per && !err && (perms[0] == '-')) {
+								err = 1;
+								*xerrmsg = xstrdup ("user does not have write ('w') permission");
+							}
+	
+							if (perms[0] == '+')
+							{
+								xrealloc_and_strcat (&fperms, &fperms_len, "w");
+							}
+						}
+						break;
+					case 't':
+						{
+							tempfperms_len = 1;
+	
+							tempfperms = xmalloc (tempfperms_len);
+							tempfperms[0] = '\0';
+	
+							for (j = 0; j < fperms_len; j++)
+							{
+								if (fperms[j] == 'w' || fperms[j] == 'c' || fperms[j] == 'd')
+								{
+									char *temp;
+									temp = xmalloc (2);
+									temp[0] = fperms[j];
+									temp[1] = '\0';
+	
+									xrealloc_and_strcat (&tempfperms, &tempfperms_len, temp);
+									if (temp) free (temp); // ams
+								}
+								else if (fperms[j] == 'a' || fperms[j] == 'p')
+								{
+									err = 1;
+									*xerrmsg = xstrdup ("user has higher permissions, cannot use +/- tag permissions");
+								}
+								else if (fperms[j] == 'n' || fperms[i] == 'r')
+								{
+									if (perms[0] == '-')
+										*xerrmsg = xstrdup ("user does not have tag ('t') permission");
+								}
+								else if (fperms[j] == 't')
+								{
+									per = 1;
+									if (perms[0] == '+') {
+										err = 1;
+										*xerrmsg = xstrdup ("user already have tag ('t') permission");
+									}
+								}
+							}
+	
+							fperms = xstrdup (tempfperms);
+							fperms_len = strlen (fperms);
+							if (tempfperms) free (tempfperms); // ams
+	
+							if (!per && !err && (perms[0] == '-')) {
+								err = 1;
+								*xerrmsg = xstrdup ("user does not have tag ('t') permission");
+							}
+	
+							if (perms[0] == '+')
+							{
+								xrealloc_and_strcat (&fperms, &fperms_len, "t");
+							}
+						}
+						break;
+					case 'c':
+						{
+							tempfperms_len = 1;
+	
+							tempfperms = xmalloc (tempfperms_len);
+							tempfperms[0] = '\0';
+	
+							for (j = 0; j < fperms_len; j++)
+							{
+								if (fperms[j] == 'w' || fperms[j] == 't' || fperms[j] == 'd')
+								{
+									char *temp;
+									temp = xmalloc (2);
+									temp[0] = fperms[j];
+									temp[1] = '\0';
+	
+									xrealloc_and_strcat (&tempfperms, &tempfperms_len, temp);
+									if (temp) free (temp); // ams
+								}
+								else if (fperms[j] == 'a' || fperms[j] == 'p')
+								{
+									err = 1;
+									*xerrmsg = xstrdup ("user has higher permissions, cannot use +/- create permissions");
+								}
+								else if (fperms[j] == 'n' || fperms[i] == 'r')
+								{
+									if (perms[0] == '-')
+										err = 1;
+									*xerrmsg = xstrdup ("user does not have create ('c') permission");
+								}
+								else if (fperms[j] == 'c')
+								{
+									per = 1;
+									if (perms[0] == '+') {
+										err = 1;
+										*xerrmsg = xstrdup ("user already have create ('c') permission");
+									}
+								}
+							}
+	
+							fperms = xstrdup (tempfperms);
+							fperms_len = strlen (fperms);
+							if (tempfperms) free (tempfperms); // ams
+	
+							if (!per && !err && (perms[0] == '-')) {
+								err = 1;
+								*xerrmsg = xstrdup ("user does not have create ('c') permission");
+							}
+	
+							if (perms[0] == '+')
+							{
+								xrealloc_and_strcat (&fperms, &fperms_len, "c");
+							}
+						}
+						break;
+					case 'd':
+						{
+							tempfperms_len = 1;
+	
+							tempfperms = xmalloc (tempfperms_len);
+							tempfperms[0] = '\0';
+	
+							for (j = 0; j < fperms_len; j++)
+							{
+								if (fperms[j] == 'w' || fperms[j] == 'c' || fperms[j] == 't')
+								{
+									char *temp;
+									temp = xmalloc (2);
+									temp[0] = fperms[j];
+									temp[1] = '\0';
+	
+									xrealloc_and_strcat (&tempfperms, &tempfperms_len, temp);
+									if (temp) free (temp); // ams
+								}
+								else if (fperms[j] == 'a' || fperms[j] == 'p')
+								{
+									err = 1;
+									*xerrmsg = xstrdup ("user has higher permissions, cannot use +/- delete permissions");
+								}
+								else if (fperms[j] == 'n' || fperms[i] == 'r')
+								{
+									if (perms[0] == '-')
+										err = 1;
+									*xerrmsg = xstrdup ("user does not have delete ('d') permission");
+								}
+								else if (fperms[j] == 'd')
+								{
+									per = 1;
+									if (perms[0] == '+') {
+										err = 1;
+										*xerrmsg = xstrdup ("user already have delete ('d') permission");
+									}
+								}
+							}
+	
+							fperms = xstrdup (tempfperms);
+							fperms_len = strlen (fperms);
+							if (tempfperms) free (tempfperms); // ams
+							
+							if (!per && !err && (perms[0] == '-')) {
+								err = 1;
+								*xerrmsg = xstrdup ("user does not have delete ('d') permission");
+							}
+	
+							if (perms[0] == '+')
+							{
+								xrealloc_and_strcat (&fperms, &fperms_len, "d");
+							}
+						}
+						break;
+					default:
+						err  = 1;
+						*xerrmsg = xstrdup ("error in 'access' file format");
+						break;
+				}
+				
+				if (fperms[0] == '\0')
+					retperms = xstrdup ("none");
+				else
+					retperms = xstrdup (fperms);
+			}
+		}
+		else
+		{
+			err = 1;
+			*xerrmsg = xstrdup("user is not given any permissions to remove/add");
+		}
+	}
+	else
+	{
+		retperms = xstrdup (perms);
+	}
+	
+	return (err ? NULL : retperms);
+}
+
+/* prepare and write resulting permissions to access file */
+int
+write_perms (char *user, char *perms, char *founduserpart, char *foundline,
+			 char *otheruserparts, char *part_type, char *part_object, char *part_tag,
+			 int pos, char *arepos)
+{
+	char *accessfile = NULL;
+	char *tmpaccessout = NULL;
+	FILE *accessfpin;
+	FILE *accessfpout;
+
+	char *newline = NULL;
+	size_t newlinelen = 1;
+
+	char *line = NULL;
+	size_t line_allocated = 0;
+
+	newline = xmalloc (newlinelen);
+	newline[0] = '\0';
+
+	if (!strcasecmp (part_tag, "ALL"))
+		part_tag = xstrdup ("ALL");
+
+	/* strip any trailing slash if found */
+	if (part_object[strlen (part_object) - 1] == '/')
+		part_object[strlen (part_object) - 1] = '\0';
+
+	/* first parts, part type, object, and tag */
+	xrealloc_and_strcat (&newline, &newlinelen, part_type);
+	xrealloc_and_strcat (&newline, &newlinelen, ":");
+	xrealloc_and_strcat (&newline, &newlinelen, part_object);
+	xrealloc_and_strcat (&newline, &newlinelen, ":");
+	xrealloc_and_strcat (&newline, &newlinelen, part_tag);
+	xrealloc_and_strcat (&newline, &newlinelen, ":");
+
+	if (strncmp (perms, "none", 4) != 0)
+	{
+		xrealloc_and_strcat (&newline, &newlinelen, user);
+		xrealloc_and_strcat (&newline, &newlinelen, "!");
+		xrealloc_and_strcat (&newline, &newlinelen, perms);
+		if (otheruserparts != NULL)
+			xrealloc_and_strcat (&newline, &newlinelen, ",");
+	}
+
+	if (otheruserparts != NULL)
+	{
+		if (otheruserparts[strlen (otheruserparts) - 1] == '\n')
+			otheruserparts[strlen (otheruserparts) - 1] = '\0';
+
+		xrealloc_and_strcat (&newline, &newlinelen, otheruserparts);
+	}
+
+	xrealloc_and_strcat (&newline, &newlinelen, ":");
+
+	if (foundline)
+	{
+		accessfpout = cvs_temp_file (&tmpaccessout);
+		accessfpin = open_accessfile ("r", arepos, &accessfile);
+
+		while (getline (&line, &line_allocated, accessfpin) >= 0)
+		{
+			if (pos != ftell (accessfpin))
+			{
+				if (fprintf (accessfpout, line) < 0)
+					error (1, errno, "writing temporary file: %s", tmpaccessout);
+			}
+			else
+			{
+				if (fprintf (accessfpout, "%s\n", newline) < 0)
+					error (1, errno, "writing temporary file: %s", tmpaccessout);
+			}
+
+		}
+		if (fclose (accessfpin) == EOF)
+			error (1, errno, "cannot close access file: %s", accessfile);
+
+		if (fclose (accessfpout) == EOF)
+			error (1, errno, "cannot close temporary file: %s", tmpaccessout);
+
+		if (CVS_UNLINK (accessfile) < 0)
+			error (0, errno, "cannot remove %s", accessfile);
+
+		copy_file (tmpaccessout, accessfile);
+
+		if (CVS_UNLINK (tmpaccessout) < 0)
+			error (0, errno, "cannot remove temporary file: %s", tmpaccessout);
+	}
+	else
+	{
+		accessfpout = open_accessfile ("r+", arepos, &accessfile);
+
+		if (accessfpout == NULL)
+		{
+			if (existence_error (errno))
+			{
+				accessfpout = open_accessfile ("w+", arepos, &accessfile);
+			}
+		}
+		else {
+			if (fseek (accessfpout, 0, 2) != 0)
+				error (1, errno, "cannot fseek access file: %s", accessfile);
+		}
+
+		if (fprintf (accessfpout, "%s\n", newline) < 0)
+			error (1, errno, "writing access file: %s", accessfile);
+
+		if (fclose (accessfpout) == EOF)
+			error (1, errno, "cannot close access file: %s", accessfile);
+	}
+
+	if (line)    free (line);    // ams
+	if (newline) free (newline); // ams
+
+	chmod (accessfile, 0644);
+
+	return 0;
+}
+
+static int
+acllist_fileproc (void *callerdat, struct file_info *finfo)
+{
+
+	char *filefullname = NULL;
+	const char *frepository;
+	char *line = NULL;
+	int pos;
+
+	if (!aclfile)
+		return 0;
+
+	frepository = Short_Repository (finfo->repository);
+
+	filefullname = xmalloc (strlen (frepository)
+	                        + strlen (finfo->file)
+	                        + 2);
+	strcpy (filefullname, frepository);
+	strcat (filefullname, "/");
+	strcat (filefullname, finfo->file);
+
+	/* check that user, which run acl/racl command, has admin permisson,
+	 * and also return the line with permissions from access file.  */
+	if (!access_allowed (finfo->file, finfo->repository, tag, 5, &line, &pos, 0))
+		error (1,0,"You do not have admin rights on '%s'", frepository);
+
+	acllist_print (line, filefullname);
+
+	if (filefullname) free (filefullname); // ams
+
+	return 0;
+}
+
+static Dtype
+acllist_dirproc (void *callerdat, const char *dir, const char *repos,
+				 const char *update_dir, List *entries)
+{
+	char *line = NULL;
+	const char *drepository;
+	int pos;
+
+	if (repos[0] == '\0')
+		repos = Name_Repository (dir, NULL);
+
+	if (!acldir)
+		return 0;
+
+	drepository = Short_Repository (repos);
+	
+	/* check that user, which run acl/racl command, has admin permisson,
+	 * and also return the line with permissions from access file.  */
+	if (!access_allowed (NULL, repos, tag, 5, &line, &pos, 0))
+		error (1, 0, "You do not have admin rights on '%s'", drepository);
+
+	acllist_print (line, drepository);
+
+	return 0;
+}
+
+/* Prints permissions to screen with -l option */
+void
+acllist_print (char *line, const char *obj)
+{
+	char *temp = NULL;
+	int c = 0;
+	int def = 0;
+
+	char *printedusers[255];
+	printedusers[0] = NULL;
+
+		if (line != NULL)
+		{
+			temp = strtok (line, ":\t");
+
+			if (acldir)
+				cvs_output ("d ", 0);
+			else if (aclfile)
+				cvs_output ("f ", 0);
+
+			temp = strtok (NULL, ":\t");
+
+			cvs_output(obj, 0);
+			cvs_output (" | ", 0);
+
+			temp = strtok (NULL, ":\t");
+			cvs_output (temp, 0);
+			cvs_output (" | ", 0);
+
+			while ((temp = strtok (NULL, "!\t")) != NULL)
+			{
+				if (strncmp (temp, ":", 1) == 0)
+					break;
+
+				if (strcmp (temp, "ALL") == 0)
+				{
+					temp = strtok (NULL, ",\t");
+					continue;
+				}
+
+				cvs_output ...
 
[truncated message content]

Re: [cvsacl-users] Implementations

[Mario R. A. <mal...@is...>]

Hi, Fridman,

I actually download, installed and configure 
cvs-1.11.22-cvsacl-1.2.5-patched.tar.gz from that site

but as soon as I do

cvs co PROJECT_NAME

I get the below error.

*** glibc detected *** cvs: free(): invalid pointer: 0x000000001a4da8ca ***
======= Backtrace: =========
/lib64/libc.so.6[0x3645e722ef]
/lib64/libc.so.6(cfree+0x4b)[0x3645e7273b]
cvs[0x405c36]
cvs[0x405f70]
cvs[0x40645d]
cvs[0x45369d]
cvs[0x441dd5]
cvs[0x4218db]
cvs[0x441323]
cvs[0x4420bf]
cvs[0x4218db]
cvs[0x441196]
cvs[0x44191f]
cvs[0x451bd5]
cvs[0x40e3d1]
cvs[0x430250]
cvs[0x4310cd]
cvs[0x40cf69]
cvs[0x4492c7]
cvs[0x44c642]
cvs[0x42e807]
/lib64/libc.so.6(__libc_start_main+0xf4)[0x3645e1d994]
cvs[0x403639]
======= Memory map: ========
00400000-0049e000 r-xp 00000000 fd:00 24870915 /usr/bin/cvs
0069d000-006a1000 rw-p 0009d000 fd:00 24870915 /usr/bin/cvs
006a1000-006a2000 rw-p 006a1000 00:00 0
1a4c2000-1a502000 rw-p 1a4c2000 00:00 0 [heap]
3645a00000-3645a1c000 r-xp 00000000 fd:00 4784444 /lib64/ld-2.5.so
3645c1b000-3645c1c000 r--p 0001b000 fd:00 4784444 /lib64/ld-2.5.so
3645c1c000-3645c1d000 rw-p 0001c000 fd:00 4784444 /lib64/ld-2.5.so
3645e00000-3645f4d000 r-xp 00000000 fd:00 4784445 /lib64/libc-2.5.so
3645f4d000-364614d000 ---p 0014d000 fd:00 4784445 /lib64/libc-2.5.so
364614d000-3646151000 r--p 0014d000 fd:00 4784445 /lib64/libc-2.5.so
3646151000-3646152000 rw-p 00151000 fd:00 4784445 /lib64/libc-2.5.so
3646152000-3646157000 rw-p 3646152000 00:00 0
364e800000-364e80d000 r-xp 00000000 fd:00 4784323 
/lib64/libgcc_s-4.1.2-20080825.so.1
364e80d000-364ea0d000 ---p 0000d000 fd:00 4784323 
/lib64/libgcc_s-4.1.2-20080825.so.1
364ea0d000-364ea0e000 rw-p 0000d000 fd:00 4784323 
/lib64/libgcc_s-4.1.2-20080825.so.1
364f000000-364f015000 r-xp 00000000 fd:00 4784472 /lib64/libnsl-2.5.so
364f015000-364f214000 ---p 00015000 fd:00 4784472 /lib64/libnsl-2.5.so
364f214000-364f215000 r--p 00014000 fd:00 4784472 /lib64/libnsl-2.5.so
364f215000-364f216000 rw-p 00015000 fd:00 4784472 /lib64/libnsl-2.5.so
364f216000-364f218000 rw-p 364f216000 00:00 0
364f400000-364f409000 r-xp 00000000 fd:00 4784476 /lib64/libcrypt-2.5.so
364f409000-364f608000 ---p 00009000 fd:00 4784476 /lib64/libcrypt-2.5.so
364f608000-364f609000 r--p 00008000 fd:00 4784476 /lib64/libcrypt-2.5.so
364f609000-364f60a000 rw-p 00009000 fd:00 4784476 /lib64/libcrypt-2.5.so
364f60a000-364f638000 rw-p 364f60a000 00:00 0
2b6e2224e000-2b6e22250000 rw-p 2b6e2224e000 00:00 0
2b6e22250000-2b6e22251000 rw-p 00000000 fd:00 23266956 
/cvsroot/isa/CVSROOT/checkoutlist,v
2b6e22251000-2b6e22252000 rw-p 2b6e22251000 00:00 0
2b6e2225e000-2b6e22262000 rw-p 2b6e2225e000 00:00 0
2b6e22270000-2b6e2227a000 r-xp 00000000 fd:00 4784162 
/lib64/libnss_files-2.5.so
2b6e2227a000-2b6e22479000 ---p 0000a000 fd:00 4784162 
/lib64/libnss_files-2.5.so
2b6e22479000-2b6e2247a000 r--p 00009000 fd:00 4784162 
/lib64/libnss_files-2.5.so
2b6e2247a000-2b6e2247b000 rw-p 0000a000 fd:00 4784162 
/lib64/libnss_files-2.5.so
7fff1da80000-7fff1da95000 rw-p 7ffffffea000 00:00 0 [stack]
ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0 [vdso]
cvs [checkout aborted]: received abort signal


OS CentOS 5.4

------------------------------------------------------------------------
/With Best Regards,/
/Mario Remy Almeida (Remy)/
/Network & System Administrator/
Informations System Assiocates (ISA)
Cargo Freight Center, Sharjah Airport Road | P.O.Box 132 | Sharjah, UAE
+971 06 5088817
+971 50 8643912
www.isaaviations.com <http://www.isaaviations.com>
mar...@gm... <mailto:mar...@gm...>

*"Your Airline Online"*


Fridman, Blake wrote:
> Good morning Mario,
>
> It's been three years or so since I setup cvsacl but the approach I took was to read http://cvsacl.sourceforge.net/ and then play around with it and a test source control repository until I was able to achieve the permissions I wanted.
>
> If you are able to list what you are attempting to do, what you have tried and how it has failed then members on this list may be able to better help you.
>
> -Blake
>
> -----Original Message-----
> From: Mario Remy Almeida [mailto:mal...@is...]
> Sent: Wednesday, April 28, 2010 1:02 AM
> To: cvs...@li...
> Subject: [cvsacl-users] Implementations
>
> Hi All,
>
> I am new to this mailing list.
>
> Could some of you help me in implementing the cvsacl for my current cvs
> system?
>
> Please let me know what other information is required from my side
>
> Thanks in advance
>
> Mario
>
> ------------------------------------------------------------------------------
> Disclaimer and Confidentiality
>
>
> This material has been checked for  computer viruses and although none has
> been found, we cannot guarantee  that it is completely free from such problems
> and do not accept any  liability for loss or damage which may be caused.
> Please therefore  check any attachments for viruses before using them on your
> own  equipment. If you do find a computer virus please inform us immediately
> so that we may take appropriate action. This communication is intended  solely
> for the addressee and is confidential. If you are not the intended recipient,
> any disclosure, copying, distribution or any action  taken or omitted to be
> taken in reliance on it, is prohibited and may be  unlawful. The views
> expressed in this message are those of the  individual sender, and may not
> necessarily be that of ISA.
>
> ------------------------------------------------------------------------------
> _______________________________________________
> cvsacl-users mailing list
> cvs...@li...
> https://lists.sourceforge.net/lists/listinfo/cvsacl-users
>   


------------------------------------------------------------------------------
Disclaimer and Confidentiality


This material has been checked for  computer viruses and although none has
been found, we cannot guarantee  that it is completely free from such problems
and do not accept any  liability for loss or damage which may be caused.
Please therefore  check any attachments for viruses before using them on your
own  equipment. If you do find a computer virus please inform us immediately
so that we may take appropriate action. This communication is intended  solely
for the addressee and is confidential. If you are not the intended recipient,
any disclosure, copying, distribution or any action  taken or omitted to be
taken in reliance on it, is prohibited and may be  unlawful. The views
expressed in this message are those of the  individual sender, and may not
necessarily be that of ISA.

Re: [cvsacl-users] Implementations

[Fridman, B. <Bla...@Pa...>]

Good morning Mario,

It's been three years or so since I setup cvsacl but the approach I took was to read http://cvsacl.sourceforge.net/ and then play around with it and a test source control repository until I was able to achieve the permissions I wanted.

If you are able to list what you are attempting to do, what you have tried and how it has failed then members on this list may be able to better help you.

-Blake

-----Original Message-----
From: Mario Remy Almeida [mailto:mal...@is...]
Sent: Wednesday, April 28, 2010 1:02 AM
To: cvs...@li...
Subject: [cvsacl-users] Implementations

Hi All,

I am new to this mailing list.

Could some of you help me in implementing the cvsacl for my current cvs
system?

Please let me know what other information is required from my side

Thanks in advance

Mario

------------------------------------------------------------------------------
Disclaimer and Confidentiality


This material has been checked for  computer viruses and although none has
been found, we cannot guarantee  that it is completely free from such problems
and do not accept any  liability for loss or damage which may be caused.
Please therefore  check any attachments for viruses before using them on your
own  equipment. If you do find a computer virus please inform us immediately
so that we may take appropriate action. This communication is intended  solely
for the addressee and is confidential. If you are not the intended recipient,
any disclosure, copying, distribution or any action  taken or omitted to be
taken in reliance on it, is prohibited and may be  unlawful. The views
expressed in this message are those of the  individual sender, and may not
necessarily be that of ISA.

------------------------------------------------------------------------------
_______________________________________________
cvsacl-users mailing list
cvs...@li...
https://lists.sourceforge.net/lists/listinfo/cvsacl-users

[cvsacl-users] Implementations

[Mario R. A. <mal...@is...>]

Hi All,

I am new to this mailing list.

Could some of you help me in implementing the cvsacl for my current cvs 
system?

Please let me know what other information is required from my side

Thanks in advance

Mario

------------------------------------------------------------------------------
Disclaimer and Confidentiality


This material has been checked for  computer viruses and although none has
been found, we cannot guarantee  that it is completely free from such problems
and do not accept any  liability for loss or damage which may be caused.
Please therefore  check any attachments for viruses before using them on your
own  equipment. If you do find a computer virus please inform us immediately
so that we may take appropriate action. This communication is intended  solely
for the addressee and is confidential. If you are not the intended recipient,
any disclosure, copying, distribution or any action  taken or omitted to be
taken in reliance on it, is prohibited and may be  unlawful. The views
expressed in this message are those of the  individual sender, and may not
necessarily be that of ISA.

[cvsacl-users] Tag info is not written to history and val-tags files when cvsacl environment is used.

[Pradeep S. <Pra...@ze...>]

 

Hi,

 

Tag info is not written to history and val-tags files under $CVSROOT/CVSROOT

when tag is created in cvsacl environment, while tag is created successfully
on the file

which can be verifed using cvs status sub-command.

 

Please advise what to do ?

 

 

Thanx and regards,

 

Pradeep Sharma

ZenMedia Solutions Pvt. Ltd.

RCP, Navi Mumbai - 400701.

Phone : 91-022-447(75065)

 

 

[cvsacl-users] can't make install the src

[Sean <nau...@gm...>]

Dear all,

After I run the command ./configure
I found that I couldn't "make" which there are some errors
so I try to look at it and it state that there's some redefinitions of
parameter aclconfig_contents.
After I commented the 2 redefinitions, it's fine and dandy.

Thanks~
Sean

[cvsacl-users] Fw: Documentation wrong?

[Stephen M. <you...@ya...>]

The documentation (here) shows the way to use racl as:
cvs racl [user||group:permissions] [-Rl] [-r tag] [directories...] [files...]

However, this doesn't seem to work on
 cvs-1.12.13-cvsacl-2-patched 
code that I downloaded from sourceforge and compiled on AIX 5.3.

Instead, it seems to expect:

cvs racl [-Rl] [-r tag] [user||group:permissions] [directories...] [files...]

Not sure why it is different, but
 figured I'd post this in case it helps someone
keep the hair I just pulled out. =)

Sincerely,

Stephen M







      Looking for last minute shopping deals?  
Find them fast with Yahoo! Search.







      ____________________________________________________________________________________
Looking for last minute shopping deals?  
Find them fast with Yahoo! Search.  http://tools.search.yahoo.com/newsearch/category.php?category=shopping

[cvsacl-users] Malloc/free problems?

[Rob C. <sa...@ya...>]

Hi,=0A=0AAfter patching in 1.2.5 into cvs 1.11.22 I get a number of malloc =
debug warnings when I run cvs. A sample is:=0A=0Acvs(11963) malloc: ***  De=
allocation of a pointer not malloced: 0x401dc0; This could be a double free=
(), or free() called with the middle of an allocated block; Try setting env=
ironment variable MallocHelp to see tools to help debug=0A=0A=0ALooking at =
acl.c, it looks like a number of the free() calls are probably incorrect:=
=0A=0Aget_perms():=0A=0A        free(foundall);=0A        free(usr);=0A    =
    free(per); =0A=0A=0Afoundall, usr and per are pointers returned by strs=
tr or strtok, neither of which mallocs the memory they return, so the free(=
) is almost certainly operating on the wrong pointer.=0A=0ASimilarly, the c=
alls to free(tmp2) in findusername() and findgroupname() look a bit dangero=
us.=0A=0AAlso, when findusername() and findgroupname() return a match there=
 is possibly a memory leak, as I'm not sure how the memory these functions =
allocate using xstrdup is ever freed when a match is found...=0A=0ARegards,=
=0A Rob.=0A=0A=0A=0A=0A      Sick of deleting your inbox? Yahoo!7 Mail has =
free unlimited storage.=0Ahttp://au.docs.yahoo.com/mail/unlimitedstorage.ht=
ml=0A

[cvsacl-users] CVS ACL Announcement

[Elaine M. <Ela...@WA...>]

Just a quick FYI that WANdisco has now made a free version of the CVS ACL
Security Module.

Free download is at http://beta.wandisco.com

All comments are welcome!
-- 
-- 
Regards,

Elaine Murphy

Office : +1 866 846 0404
Fax : +1 866-247-7584

WANdisco, Inc.
4847 Hopyard Road #4-208
Pleasanton, CA 94588

This email and any attachments may contain private, confidential and
privileged material for the sole use of the intended recipient. If you are
not the intended recipient, please immediately delete this email and any
attachments.

Re: [cvsacl-users] Non-acl clients with ACL server

[Moises Z. <MZa...@lg...>]

They should work without any problem for all the cvs commands except if
you want to run  "cvs acl" or "cvs racl" with those clients.=20
Moises.


-----Original Message-----
From: cvs...@li...
[mailto:cvs...@li...] On Behalf Of Rob Cas
Sent: Wednesday, August 15, 2007 9:01 PM
To: cvs...@li...
Subject: [cvsacl-users] Non-acl clients with ACL server

Hi,

Just wondering whether/how non-ACL CVS clients work with a CVS-acl
server?

ie. Can non-ACL enabled cvs clients access data to which the ACLs permit
them or do we have to ensure our entire user-base upgrades their CVS
clients after we do the server upgrade?

Thanks,
 Rob.




=20
________________________________________________________________________
____________
Feel safe with award winning spam protection on Yahoo!7 Mail.
http://mail.yahoo.com.au


------------------------------------------------------------------------
-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
cvsacl-users mailing list
cvs...@li...
https://lists.sourceforge.net/lists/listinfo/cvsacl-users

----------------------------------------------------------------------
This e-mail, including any attached files, may contain confidential and pri=
vileged information for the sole use of the intended recipient.  Any review=
, use, distribution, or disclosure by others is strictly prohibited.  If yo=
u are not the intended recipient (or authorized to receive information for =
the intended recipient), please contact the sender by reply e-mail and dele=
te all copies of this message.

[cvsacl-users] Non-acl clients with ACL server

[Rob C. <sa...@ya...>]

Hi,=0A=0AJust wondering whether/how non-ACL CVS clients work with a CVS-acl=
 server?=0A=0Aie. Can non-ACL enabled cvs clients access data to which the =
ACLs permit them or do we have to ensure our entire user-base upgrades thei=
r CVS clients after we do the server upgrade?=0A=0AThanks,=0A Rob.=0A=0A=0A=
=0A=0A      _______________________________________________________________=
_____________________=0AFeel safe with award winning spam protection on Yah=
oo!7 Mail.=0Ahttp://mail.yahoo.com.au=0A

Re: [cvsacl-users] Simple question

[Galen J. <Gal...@sa...>]

Well, considering I can't even tell the difference between racl and acl =
commands how can I tell it's working (I can now since I apparently =
overlooked that on the site)?  For that matter, how can you tell from my =
statement that it definitely isn't working?=20
=20
Also, I noticed that I can only add at most 2 admin users/groups when I =
run the 'cvs racl someuser:p -r ALL -d ALL' command.  The info in the =
access file is FIFO for any users (groups) beyond 2.  Is this expected =
behavior?  Or is there a way to have it keep all users you add?
=20
For example:
cvs racl someuser:p -r ALL -d ALL' command
cvs racl anotheruser:p -r ALL -d ALL' command
cvs racl anotheruser:p -r ALL -d ALL' command
=20
When you look at the access file under CVSROOT you see:
d:ALL:ALL:yetanotheruser!p,anotheruser!p:
=20
And the list command returns:
d CVSROOT | HEAD | | defaults yetanotheruser:p anotheruser:p
=20
I'm trying to get my head around the ACL model and where to use racl =
versus acl, so please bear with me.  Several of the examples look to me =
like they should be shown using acl instead of racl since they are more =
specific to directories and files within the repository and not =
repository wide (provided I'm understanding the difference =
properly...all the examples use racl with no acl examples given).

=3DG=3D

________________________________

From: Slava Maslenitsyn [mailto:sla...@gm...]=20
Sent: Tuesday, December 19, 2006 2:57 PM
To: Galen Johnson
Subject: Re: [cvsacl-users] Simple question


Hello Galen,
>>I'm not even entirely certain that the cvsacl patch is working. - NO. =
it isn't... at all. I'm sorry i think from that point it doesn't make =
sense to answer all your rest questions.

regards,
Slava


On 12/19/06, Galen Johnson <Gal...@sa...> wrote:=20

	Ok,
=09
	This is probably a stupid question but the docs for cvsacl are a bit =
lacking.  What is the difference between racl and acl commands?  How can =
I lock down CVSROOT to all my users, yet still allow them to update the =
history and modules files?  This is with CVS 1.11.23 and cvsacl 1.2.4.
=09
	I'm not even entirely certain that the cvsacl patch is working.
=09
	=3DG=3D
=09
	=
-------------------------------------------------------------------------=

	Take Surveys. Earn Cash. Influence the Future of IT=20
	Join SourceForge.net's Techsay panel and you'll get the chance to share =
your
	opinions on IT & business topics through brief surveys - and earn cash
	=
http://www.techsay.com/default.php?page=3Djoin.php&p=3Dsourceforge&CID=3D=
DEVDEV
	_______________________________________________
	cvsacl-users mailing list
	cvs...@li...
	https://lists.sourceforge.net/lists/listinfo/cvsacl-users
=09

[cvsacl-users] Simple question

[Galen J. <Gal...@sa...>]

Ok,

This is probably a stupid question but the docs for cvsacl are a bit =
lacking.  What is the difference between racl and acl commands?  How can =
I lock down CVSROOT to all my users, yet still allow them to update the =
history and modules files?  This is with CVS 1.11.23 and cvsacl 1.2.4.

I'm not even entirely certain that the cvsacl patch is working.

=3DG=3D

Re: [cvsacl-users] Problem checking out from acl enabled cvs

[Moises Z. <MZa...@lg...>]

Did you build the binary? What OS are you working on?
What kind of CVS access are you running? pserver, ext, ssh...etc

Moises.

-----Original Message-----
From: cvs...@li...
[mailto:cvs...@li...] On Behalf Of Thomas
Tinglum
Sent: Thursday, December 07, 2006 3:53 AM
To: cvs...@li...
Subject: [cvsacl-users] Problem checking out from acl enabled cvs

Hi all,

When I try to co a project from the cvs server i get the following
errors:

$ cvs co tutorial
cvs checkout: Updating tutorial
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs in free(): error: modified (chunk-) pointer
cvs in malloc(): error: recursive call
cvs in malloc(): error: recursive call
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs in malloc(): error: recursive call
cvs in malloc(): error: recursive call
cvs in malloc(): error: recursive call
cvs in malloc(): error: recursive call
cvs in malloc(): error: recursive call
cvs in malloc(): error: recursive call
and so on ..

$ cvs -v
Concurrent Versions System (CVS) 1.11.22 (client/server)
with CVSACL Patch 1.2.5 (cvsacl.sourceforge.net)

Does anyone have a clue on how to fix it or debug ?

Thanks,
Thomas

------------------------------------------------------------------------
-
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share
your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=3Djoin.php&p=3Dsourceforge&CID=3DDE=
VDE
V
_______________________________________________
cvsacl-users mailing list
cvs...@li...
https://lists.sourceforge.net/lists/listinfo/cvsacl-users
----------------------------------------------------------------------
This e-mail, including any attached files, may contain confidential and pri=
vileged information for the sole use of the intended recipient.  Any review=
, use, distribution, or disclosure by others is strictly prohibited.  If yo=
u are not the intended recipient (or authorized to receive information for =
the intended recipient), please contact the sender by reply e-mail and dele=
te all copies of this message.

[cvsacl-users] Problem checking out from acl enabled cvs

[Thomas T. <ti...@gm...>]

Hi all,

When I try to co a project from the cvs server i get the following errors:

$ cvs co tutorial
cvs checkout: Updating tutorial
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs in free(): error: modified (chunk-) pointer
cvs in malloc(): error: recursive call
cvs in malloc(): error: recursive call
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs [checkout aborted]: received abort signal
cvs in malloc(): error: recursive call
cvs in malloc(): error: recursive call
cvs in malloc(): error: recursive call
cvs in malloc(): error: recursive call
cvs in malloc(): error: recursive call
cvs in malloc(): error: recursive call
and so on ..

$ cvs -v
Concurrent Versions System (CVS) 1.11.22 (client/server)
with CVSACL Patch 1.2.5 (cvsacl.sourceforge.net)

Does anyone have a clue on how to fix it or debug ?

Thanks,
Thomas

[cvsacl-users] segmentation fault

[Dmitry V. <dm...@rs...>]

Hi!

In some cases, when there was not enough parameters given to cvs
acl/racl, segmentation fault occurs:

[dmitry@srv libs]$ cvs acl
Segmentation fault

[dmitry@srv libs]$ cvs acl -l
Segmentation fault

I personally prefer more explained message about wrong params, without
need to run debugger to identify the problem.

By the way, according to documentation, both commands should work,
since there are no mandatory parameters to cvs acl/racl:
[dmitry@srv libs]$ cvs racl ?
Usage: cvs racl [user||group:permissions] [-Rl] [-r tag] [directories...] [files...]
        -R      Process directories recursively.
        -r rev  Existing revision/tag.
        -l      List defined ACLs.
(Specify the --help global option for a list of other help options)

-- 
Best regards,
 Dmitry                          mailto:dm...@rs...

[cvsacl-users] CVSACL-1.2.5 for CVS-1.11.22

[sbaris <sb...@us...>]

CVSACL-1.2.5 for CVS-1.11.22

 

fixed some bugs; It is higly recommended to upgrade. 
 
NOTICE: There is no "-d" and "-f" options for directory and file, acl/racl
subcommands runs just like other cvs subcommands. 

 

Regards,

sb...@us...

 

[cvsacl-users] cvsacl for feature cvs-1.12.xx

[sbaris <sb...@us...>]

Hi,

 

I modified patch for cvs-1.12.xx feature release, an uploaded to
sourceforge.

 

I also prepare sanity tests, it was very helpfull fo find errors. Sanity
script diff is also in tgz archive.

 

A big difference is that: you do not have to use option -d for directory and
-f for file, acl/racl subcommands now runs like other subcommands.

 

Regards,

sb...@us...

http://sourceforge.net/projects/cvsacl

 

[cvsacl-users] Error with ACL

[Aldo A. <al...@gm...>]

Hi,

I have the next problem with the CVS Access Control List Extension Patch,
when I try to use this patch I obtain the next error:

cvs [racl aborted]: received abort signal
*** glibc detected *** free(): invalid pointer: 0x00625820 ***

I have checked it and if I change the Keyword *UseCVSACL=3D yes *to no, the
problem is not present, can you tell me what I shoud do

Thank you

--=20
ISC. Aldo Adrian P. F.

[cvsacl-users] CVSACL-1.2.4

[sbaris <sb...@us...>]

CVSACL-1.2.4 patch uploaded.

- fixed one bug.
- help needed on development and testing.

Regards,

sb...@us...
http://cvsacl.sourceforge.net

[cvsacl-users] CVSACL-1.2.3 for CVS-1.11.21

[sbaris <sb...@us...>]

New CVSACL patch uploaded.

Try to fix open bugs, but need help on testing.


Regards,

sb...@us...
http://cvsacl.sourceforge.net

[cvsacl-users] Branch Permission Problem

[Cheok Y. C. <yc...@ya...>]

Previously, I try to have user ccyew to have branch
only permission at HEAED and all permission in rest of
the branches (except HEAD) with the following
CVSROOT/access file:

-- Good access file --
# CVS ACL definitions file. DO NOT EDIT MANUALLY
d:ALL:ALL:yccheok!p:
d:MarkLead:ALL:shyeoh!a:
d:helloworld:HEAD:shyeoh!t:
d:helloworld:ALL:shyeoh!a:
d:VsTape:ALL:shyeoh!a:
d:VsMark:ALL:kwpang!a:
d:VsTape:HEAD:ccyew!t:
d:VsTape:ALL:ccyew!a:
d:helloworld:HEAD:ccyew!t:
d:helloworld:ALL:ccyew!a:
d:VTHAL:ALL:wenyee!a:
d:ScanProxy:ALL:wenyee!a:
d:ScanProxyEx:ALL:wenyee!a:
d:SpicaProjectDocument:ALL:wenyee!a:
d:ScanProxy:ALL:ykchoor!a:
d:ScanProxyEx:ALL:ykchoor!a:
d:VTHAL:ALL:ykchoor!a:
d:SpicaProjectDocument:ALL:ykchoor!a:
d:SpicaEx:ALL:ykchoor!a:
d:VTHAL:ALL:layngor!a:
d:SpicaProjectDocument:ALL:layngor!a:
d:ScanProxy:ALL:layngor!a:
d:ScanProxyEx:ALL:layngor!a:
d:SpicaProjectDocument:ALL:vincent!a:
d:SpicaProjectDocument:ALL:hooiling!a:
d:ALL:ALL:yccheok!a:
d:ALL:ALL:ALL!n:

However, when the following access file is used, user
ccyew still having write permission on HEAD brach. 

(Previous line

d:helloworld:HEAD:ccyew!t:
d:helloworld:ALL:ccyew!a:

had been move up to the third row)

-- Bad access file --
# CVS ACL definitions file. DO NOT EDIT MANUALLY
d:ALL:ALL:yccheok!p:
d:MarkLead:ALL:shyeoh!a:
d:helloworld:HEAD:ccyew!t:
d:helloworld:ALL:ccyew!a:
d:helloworld:HEAD:shyeoh!t:
d:helloworld:ALL:shyeoh!a:
d:VsTape:ALL:shyeoh!a:
d:VsMark:ALL:kwpang!a:
d:VsTape:HEAD:ccyew!t:
d:VsTape:ALL:ccyew!a:
d:VTHAL:ALL:wenyee!a:
d:ScanProxy:ALL:wenyee!a:
d:ScanProxyEx:ALL:wenyee!a:
d:SpicaProjectDocument:ALL:wenyee!a:
d:ScanProxy:ALL:ykchoor!a:
d:ScanProxyEx:ALL:ykchoor!a:
d:VTHAL:ALL:ykchoor!a:
d:SpicaProjectDocument:ALL:ykchoor!a:
d:SpicaEx:ALL:ykchoor!a:
d:VTHAL:ALL:layngor!a:
d:SpicaProjectDocument:ALL:layngor!a:
d:ScanProxy:ALL:layngor!a:
d:ScanProxyEx:ALL:layngor!a:
d:SpicaProjectDocument:ALL:vincent!a:
d:SpicaProjectDocument:ALL:hooiling!a:
d:ALL:ALL:yccheok!a:
d:ALL:ALL:ALL!n:

Anyone knows why this happen?

Thank you.

cheok

p/s

Here is the version of CVS which I am using:

yccheok@cvsserver:~/public_html $ cvs --version

Concurrent Versions System (CVS) 1.11.18
(client/server)
with CVSACL Patch 1.2.2 (cvsacl.sourceforge.net)

Copyright (c) 1989-2004 Brian Berliner, david d `zoo'
zuhn,
                        Jeff Polk, and other authors

CVS may be copied only under the terms of the GNU
General Public License,
a copy of which can be found with the CVS distribution
kit.

Specify the --help option for further information
about CVS
yccheok@cvsserver:~/public_html $

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

[cvsacl-users] Does CVS ACL work with Bugzilla 1.11.20?

[<ro...@zy...>]

Hi All,
      Can anyone pls tell me if this ACL patch will work with versions
greater than 1.11.18 like 1.11.20?

Thanks and Regards,
Roshan Poruporuthan
Software Engineer
Spend Data Management
ZYCUS INC.
Ph : ++ 91 22 5640 7676 Extn. : 7803
~~~~~~~~~~~Disclaimer~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This e-mail contains confidential information and may be legally
privileged. It is intended solely for the addressee. Access to this email
by anyone else is unauthorized. If you are not the intended addressee,
please inform the sender immediately, delete the e-mail and do not copy,
disseminate, distribute, store, print or deliver this e-mail or information
therein to anybody. The sender and the Company are not liable for any
errors or omissions in this e-mail or for any claims, losses, damages
arising out of this e-mail and information contained therein.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~