ACL Extension

Restrict changes via access control lists.

1. Status

This extension is currently being distributed along with Mercurial.

Author: Vadim Gelfer

2. Overview

The ACL extension lets you have fine grained access control to parts of a repository using deny and allow lists. These lists associate glob patterns to users. Furthermore, it can restrict changes depending on its source (http, ssh, pull, push, bundle).

It's recommended that this extension is used with hg-ssh (a restricted shell for Mercurial ssh access) to tighten security.

3. Configuration

Below is an example configuration file (hgrc). The acl lists use the pattern = user syntax, where pattern is a glob by default. :

  [hooks]

  # Use this if you want to check access restrictions at commit time
  pretxncommit.acl = python:hgext.acl.hook
  
  # Use this if you want to check access restrictions for pull, push,
  # bundle and serve.
  pretxnchangegroup.acl = python:hgext.acl.hook

  [acl]
  # Check whether the source of incoming changes is in this list where
  # "serve" == ssh or http, and "push", "pull" and "bundle" are the
  # corresponding hg commands.
  sources = serve

  [acl.groups]
  # If a group name is not defined here, and Mercurial is running under
  # a Unix-like system, the list of users will be taken from the OS.
  # Otherwise, an exception will be raised.
  @designers = user1, user2

  [acl.deny.branches] 
  
  # Everyone is denied to the frozen branch: 
  frozen-branch = * 
  
  # A bad user is denied on all branches: 
  * = bad-user 
  
  [acl.allow.branches] 
  
  # A few users are allowed on branch-a: 
  branch-a = user-1, user-2, user-3 
  
  # Only one user is allowed on branch-b: 
  branch-b = user-1 
  
  # The super user is allowed on any branch: 
  * = super-user 
  
  # Everyone is allowed on branch-for-tests: 
  branch-for-tests = * 

  [acl.deny]
  # This list is checked first. If a match is found, acl.allow is not
  # checked. All users are granted access if acl.deny is not present.
  # Format for both lists: glob pattern = user, ..., @group, ...

  # To match everyone, use an asterisk for the user:
  # my/glob/pattern = *

  # user6 will not have write access to any file:
  ** = user6

  # Group "hg-denied" will not have write access to any file:
  ** = @hg-denied

  # Nobody will be able to change "DONT-TOUCH-THIS.txt", despite
  # everyone being able to change all other files. See below.
  src/main/resources/DONT-TOUCH-THIS.txt = *

  [acl.allow]
  # if acl.allow not present, all users allowed by default
  # empty acl.allow = no users allowed

  # User "doc_writer" has write access to any file under the "docs"
  # folder:
  docs/** = doc_writer

  # User "jack" and group "designers" have write access to any file
  # under the "images" folder:
  images/** = jack, @designers

  # Everyone (except for "user6" - see acl.deny above) will have write
  # access to any file under the "resources" folder (except for 1
  # file. See acl.deny):
  src/main/resources/** = *

  .hgtags = release_engineer

CategoryBundledExtension