Error: 'setgid failed: Operation not permitted' - CVS on Linux

[Gaurav Chhabra]

Hi,



We are using CVSNT 2.5.03 Build 2382 as our CVS server on Windows XP Pro
SP2. I am now exploring how to implement CVS server on Linux machine.

I read that in most Linux machines, CVS comes as a pre-installed
application. I verified the same on my Linux machine. I went to the location
‘/etc/xinetd.d‘ & modified the file cvs:

Content of file cvs:
-------------------
service cvspserver
{
disable = no
port = 2401
socket_type = stream
protocol = tcp
wait = no
user = cvs
passenv = PATH
server = /usr/bin/cvs
env = HOME=/var/cvs
server_args = -f --allow-root=/var/cvs/root pserver
# bind = 127.0.0.1
}
-------------------

I changed the ‘user’ field to ‘cvs’. It was root here earlier. Our UNIX
admin was not comfortable to allow it to run as ‘root’ user. He then
restarted the service. He created the passwd file in /var/cvs/root/CVSROOT
and added a user. The content of passwd file is:
----------------------------
testuser:sGENdEgXlOKIw:cvs
----------------------------

What I understood after going through the official doc is that we are
specifying to CVS that the user ‘testuser’ will actually run CVS commands as
user ‘cvs’. Please correct me if I’m wrong.

When I logged in as ‘testuser’ (on the same system on which CVS repository
was initialized), I was able to successfully checkout the CVSROOT directory,
which contains the administrative files.


=========
My concern:
=========

As you can see, CVS will run as user ‘cvs’. If I don’t add the entry ‘:cvs’
at the end of every row that gets created for every new user (in ‘passwd’
file), I am still able to login but I am not able to perform checkout.
---------------------------------------------
gaurav> export CVSROOT=:pserver:***@machine_name:/var/cvs/root
gaurav> cvs login
Logging in to :pserver:***@machine_name:2401/var/cvs/root
CVS password:
gaurav> cvs co CVSROOT
setgid failed: Operation not permitted
---------------------------------------------

Why is this happening? Do I have to add ‘:cvs’ at the end of every new user
entry in ‘passwd’ file? I googled and found a reply:
“A setgid() failure implies that the CVS server isn't running as root.”
Source:
http://groups.google.ca/group/gnu.cvs.help/browse_thread/thread/c88d311738b5de79
(Here the users were not able to access when they tried using SSH)

But I think this is not true; I think it’s all dependent on what’s your
entry in the file ‘cvs’ (present in /etc/xinetd.d). I have ‘user = cvs’ in
that file and I am able to checkout successfully if I append the same
username at the end of every user entry in ‘passwd’ file. Please correct me
if I’m wrong.



Thanks & Regards,
Gaurav Chhabra

[Larry Jones]

I changed the user field to cvs. It was root here earlier. Our UNIX
admin was not comfortable to allow it to run as root user.

You may want to explain to him that CVS runs as root only long enough to
authenticate the specific user. Once it has authenticated the user, it
switches user and runs as that user from then on. By not running as
root, you're forced to run all CVS operations as the same system user,
which means that you can't use normal system permissions to control
access to various parts of the repository.

Even better is to not use pserver at all, but use :ext: access with ssh
instead.

Why is this happening? Do I have to add ':cvs' at the end of every new user
entry in 'passwd' file?

Yes, if you insist on using pserver and not running it as root.

[Gaurav Chhabra]

Hi Larry,



Thanks a lot for your reply. So, this means that only during authentication,
it acts as root and later it switches back to the username provided.

.....which means that you can't use ‘normal system permissions’ to control
access to various parts of the repository.

Are you referring to ‘lsacl’ commands and the like?


Though pserver is not secure, I’m OK with using it for the time being. Once
I get comfortable with the normal CVS operations, I’ll look into the
security aspects.

If I change the user from ‘cvs’ to ‘root’ but keep the access method as
‘pserver’, will it work? In this case too, I guess I have to append ‘root’
in each entry of passwd file (I think this is what you've mentioned in your
reply).


Now since I am almost done with the setup part of 'cvs server' on Linux, I'm
looking forward to install a CVS client. We will have clients both on
Windows & Linux. Can you suggest me a Linux client and a Windows client? For
Windows, will WinCVS/Tortoise CVS be OK?



Thanks & Regards,
Gaurav Chhabra

[Larry Jones]

Post by Gaurav Chhabra
Thanks a lot for your reply. So, this means that only during authentication,
it acts as root and later it switches back to the username provided.

Correct.

Post by Gaurav Chhabra

.....which means that you can't use `normal system permissions' to control
access to various parts of the repository.

Are you referring to `lsacl' commands and the like?

Yes.

Post by Gaurav Chhabra
If I change the user from `cvs' to `root' but keep the access method as
`pserver', will it work?

Yes.

Post by Gaurav Chhabra
In this case too, I guess I have to append `root'
in each entry of passwd file (I think this is what you've mentioned in your
reply).

NO! Then you really will be running as root all the time! If there's a
third field in the passwd file, then CVS runs as that system user rather
than as the CVS user. Normally, you omit the third field which causes
CVS to run as the CVS user. (Note that this requires every CVS user to
also be a system user.)

Post by Gaurav Chhabra
Now since I am almost done with the setup part of 'cvs server' on Linux, I'm
looking forward to install a CVS client. We will have clients both on
Windows & Linux. Can you suggest me a Linux client and a Windows client? For
Windows, will WinCVS/Tortoise CVS be OK?

I usually just use the standard CVS command line client. Both WinCVS
and Tortoise are fine GUIs that work just fine.

[Arthur Barrett]

Gaurav Chhabra,

Post by Gaurav Chhabra
We are using CVSNT 2.5.03 Build 2382 as our CVS server on
Windows XP Pro SP2.

CVSNT is NOT CVS.

You CANNOT migrate from CVSNT to CVS - attempting to use a CVSNT
repository on CVS may result in irreperable loss of data.

CVSNT is available for Linux - I suggest you use CVSNT for linux
instead.

Please post questions about CVSNT to the CVSNT newsgroup not this CVS
newsgroup:
http://www.cvsnt.org/cgi-bin/mailman/listinfo/cvsnt
or
news://news.cvsnt.org/support.cvsnt

Post by Gaurav Chhabra

.....which means that you can't use 'normal system

permissions' to control

access to various parts of the repository.

Are you referring to 'lsacl' commands and the like?

Do you mean the AIX command 'lsacl' or the CVSNT command 'cvs lsacl'?

CVS does not have a 'cvs lsacl' command - that is CVSNT specific.

I believe Larry was talking about the 'lsacl' command (like in AIX) - an
operating system command not a CVS command.

Post by Gaurav Chhabra
Windows & Linux. Can you suggest me a Linux client and a
Windows client? For
Windows, will WinCVS/Tortoise CVS be OK?

WinCVS and TortoiseCVS are not windows clients - they are windows GUI's
that still require a windows client: either CVS or CVSNT. Note:
TortoiseCVS has many features that are CVSNT specific (eg: revision
graphs that show mergepoints only works if you use CVSNT server and
client).

Regards,


Arthur Barrett

[Gaurav Chhabra]

Hi Arthur,


Thanks for all the clarification.

Post by Gaurav Chhabra
We are using CVSNT 2.5.03 Build 2382 as our CVS server on Windows XP Pro

SP2.

Post by Gaurav Chhabra

Post by Arthur Barrett
CVSNT is NOT CVS.
You CANNOT migrate from CVSNT to CVS - attempting to use a CVSNT

repository on CVS may result in irreparable loss of data.

Post by Gaurav Chhabra

Post by Arthur Barrett
CVSNT is available for Linux - I suggest you use CVSNT for linux instead.

==>By the way, I am not going to migrate existing CVSNT code from Windows to
Linux machine. I am just trying my hands on installing CVS/CVSNT on Linux.
Anyways, thanks for the advice Arthur. I'll go for CVSNT now instead of CVS.

Post by Gaurav Chhabra
.....which means that you can't use 'normal system permissions' to control

access to various parts of the repository. Are you referring to 'lsacl'
commands and the like?

Post by Gaurav Chhabra

Post by Arthur Barrett
Do you mean the AIX command 'lsacl' or the CVSNT command 'cvs lsacl'?
CVS does not have a 'cvs lsacl' command - that is CVSNT specific.
I believe Larry was talking about the 'lsacl' command (like in AIX) - an

operating system command not a CVS command.
==>Yeah! I was actually referring to CVSNT 'lsacl' command. I have no idea
about AIX command 'lsacl'.

Post by Gaurav Chhabra
Windows & Linux. Can you suggest me a Linux client and a Windows client?

For Windows, will WinCVS/Tortoise CVS be OK?

Post by Gaurav Chhabra

Post by Arthur Barrett
WinCVS and TortoiseCVS are not windows clients - they are windows GUI's

that still require a windows client: either CVS or CVSNT. Note: TortoiseCVS
has many features that are CVSNT specific (eg: revision graphs that show
mergepoints only works if you use CVSNT server and
client).
==>Thanks again for clearing the confusion. Actually, I read somewhere
(might be on their website) that they are just GUI's and the commands are
passed to '*cvs.exe'* which in turn, connects to the server (if I'm not
wrong). I think I just forgot this point.


Regards,
Gaurav

[Arthur Barrett]

Gaurav,

Post by Gaurav Chhabra
I'll go for CVSNT now instead of CVS.

If you have any questions/problems please be sure to contact the CVSNT
mailing list not the CVS mailing list:
http://www.cvsnt.org/cgi-bin/mailman/listinfo/cvsnt
or
news://news.cvsnt.org/support.cvsnt

Regards,


Arthur Barrett

[Arthur Barrett]

Kashav,

You appear to have contacted the CVS newsgroup for a problem that is in
no way related to CVS. CVSNT is NOT CVS.

Version: CVSNT2.5.03 Build :2382

If you have any questions/problems please be sure to contact the CVSNT
mailing list not the CVS mailing list:
http://www.cvsnt.org/cgi-bin/mailman/listinfo/cvsnt
or
news://news.cvsnt.org/support.cvsnt

GUI: tortoise version: 1.10.10

.
.
.

Every time check-in files in CVSNT repository,the tag(-kbx)
for all XLS
files is assigned.This enables watch on XLS files.Project members are
facing problems in committing XLS files in repository. Let me know to
remove stick tag(-x) to all XLS files in repository. To make commit
process smothly.

If you have any questions/problems with TortoiseCVS please contact the
TortoiseCVS mailing list:
http://sourceforge.net/mail/?group_id=48103


Regards,


Arthur Barrett

[N S, Keshava]

Hi Arthur,

Version: CVSNT2.5.03 Build :2382
GUI: tortoise version: 1.10.10
Server OS: windows 2003 std. Edition + SP2

Problem:
Every time check-in files in CVSNT repository,the tag(-kbx) for all XLS
files is assigned.This enables watch on XLS files.Project members are
facing problems in committing XLS files in repository. Let me know to
remove stick tag(-x) to all XLS files in repository. To make commit
process smothly.

Thanks
Keshav