Subversion Authz: Missing Parent‑Directory Inheritance Constraint
0 reputation · 05 Apr 2023, 15:40 UTC
Subversion’s path‑based authorization (authz) allows administrators to assign read or write rights to any repository path without automatically granting those rights to parent directories.
This design choice means a user can successfully check out a deep path such as /trunk/project/src while lacking any permission on /trunk or /trunk/project. Operations that enumerate those parent directories—like svn list or GUI directory views—then fail with authorization errors, creating an inconsistent user‑facing workflow.
The subsystem does not provide a built‑in option to enforce hierarchical consistency, leaving administrators to decide whether to add manual rules, rely on client‑side workarounds, or request a strict inheritance mode.
Should Subversion introduce an optional inheritance flag in the authz file? How would enabling inheritance affect existing configurations and performance? What impact would it have on backward compatibility and administrative overhead?