Security guide
Manage security settings in Unity Version Control.
読み終わるまでの所要時間 3 分最終更新 2日前
The Unity Version Control (UVCS) security system can help you secure your version control processes. Unity Version Control focuses on the following:
- Allows you to control access to repositories and restrict certain operations.
- You can assign different permissions to projects, and users to efficiently restrict access and prevent any compromise of sensitive data.
- Allows you to enforce policies and best practices for development and deployment.
- You can restrict access to the main development line so only integrators can make modifications to reduce the risk of any breaking changes.
注
This page focuses on permissions in the UVCS desktop application. To manage user security permissions through the Unity Dashboard, refer to Manage users.
Permissions
If your version control environment requires security restrictions, to prevent unwanted access or enforce certain development policies, there are two main ways you can customize your permissions:- Change permissions to the repositories in your UVCS server.
- If you change the permissions at the top-level, you ensure that all the contained objects are secure.
- You can also edit the permissions for specific repositories, branches, and even items.
- Change user and group permissions.
- You can give users specific access to repositories, branches, and even items, if required.
Permissions security
A secured path can prevent users from performing operations, such as read or write, on the path. To circumvent the security permissions, a user might edit the path name or the name of the parent directory. UVCS protects against this as it detects that the existing user permissions are different between the source and destination paths and doesn’t allow the user to rename. Instead, the user receives an error message.Users and groups
Each project has the following three user groups:Group | Description | Default permissions |
|---|---|---|
| Admin | Users that have the Owner or Manager role in your project or organization. | Full access to all repositories in the project. |
| Writers | Users that have access to the Unity project. | Read and write permissions for all repositories in the project. This excludes some permissions such as to change permissions, or delete repositories. |
注
There is also the group, which consists of the owners or managers of the Unity organization.
organization-adminRead-access restriction
You can restrict read access to certain paths so that some users can’t view parts of your repository. For example, you might restrict read access in centralized setups where sensitive areas of the repository need to be protected in such a way that some project members can't even view them. For the desktop application, you need to configure the path-based security to protect read access before using the repository for the first time. Otherwise, the read permissions don't apply until users run update operations (without local changes) to propagate the new read permission rules to their workspaces.Read-access functionality
- Users without read permissions can’t update and download secured paths.
- If a user has read permissions for an item or path, they can view all of the revisions from the History views.
- You can safely revoke read permission from the root item of a repository and any attempt to update or view the repository results in an empty items tree.
- An update-merge occurs when a user has checkouts on a branch and updates to the latest, and UVCS moves your checkouts to the latest version. If the user loses read access to the path, the update-merge fails and they receive an error message.
Incomplete changesets
If you restrict read access to certain paths, it can cause some incomplete changesets. The incomplete changesets are important if you work in distributed scenarios. In distributed version control scenarios you can reject operations when the path permissions of a revision can’t be checked because a changeset wasn’t replicated. To reject these operations, enable the following setting inside the server.conf file:<SecuredPaths>true</SecuredPaths>Edit permissions
UVCS permissions are defined by the user's Unity role. UVCS permissions can only deny permissions that are granted by the Unity role. To configure the permissions on your UVCS server, you need an existing repository. This means you can right-click the repository to open one of the following configuration windows:Configuration option | Description |
|---|---|
| Path permissions | Edit permissions for a specific path. You can also configure the branches the permissions apply to. |
| Permissions | Edit user permissions for the repository. |
| Repository server permissions | Edit user permissions for the UVCS server that contains the repository. |
注
To find the default permissions for each group, refer to users and groups.