File permissions
----------------

   All `,v' files are created read-only, and you should not change the
permission of those files.  The directories inside the repository
should be writable by the persons that have permission to modify the
files in each directory.  This normally means that you must create a
UNIX group (see group(5)) consisting of the persons that are to edit
the files in a project, and set up the repository so that it is that
group that owns the directory.

   This means that you can only control access to files on a
per-directory basis.

   Note that users must also have write access to check out files,
because CVS needs to create lock files (see Concurrency.).

   Also note that users must have write access to the
`CVSROOT/val-tags' file.  CVS uses it to keep track of what tags are
valid tag names (it is sometimes updated when tags are used, as well as
when they are created, though).

   CVS tries to set up reasonable file permissions for new directories
that are added inside the tree, but you must fix the permissions
manually when a new directory should have different permissions than its
parent directory.  If you set the `CVSUMASK' environment variable that
will control the file permissions which CVS uses in creating directories
and/or files in the repository.  `CVSUMASK' does not affect the file
permissions in the working directory; such files have the permissions
which are typical for newly created files, except that sometimes CVS
creates them read-only (see the sections on watches, *Note Setting a
watch::; -r, See Global options; or CVSREAD, *Note Environment
variables::).

   Note that using the client/server CVS (*note Remote
repositories::.), there is no good way to set `CVSUMASK'; the setting
on the client machine has no effect.  If you are connecting with `rsh',
you can set `CVSUMASK' in `.bashrc' or `.cshrc', as described in the
documentation for your operating system.  This behavior might change in
future versions of CVS; do not rely on the setting of `CVSUMASK' on the
client having no effect.

   Since CVS was not written to be run setuid, it is unsafe to try to
run it setuid.  You cannot use the setuid features of RCS together with
CVS.