[cvsnt] Where are CVS ACL settings stored?

[Eric B.]

Hi,

I'm starting to experiment with CVS ACL settings and with the new VMFree 
application, it makes it quite easy.  However, I was wondering exactly where 
the ACL settings are stored.  Are they stored within files in the CVSROOT 
directory (at the repo level),
or in a per-module basis?

What prevents a regular user from changing access settings on a module?  Are 
there file-level permissions that I need to set somewhere to ensure that 
only admins have access to it?  What would the read / write settings need to 
be and on which files?

Thanks!

Eric