Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a build script which executes apt-get and therefore requires root privileges. What is the best way to run this script in Hudson?

Currently the only solution I have found that works is to add an entry to the sudoers file for the user hudson like so:

hudson  ALL=(ALL) NOPASSWD:ALL

However, although my build script now runs without error in Hudson, I am not entirely comfortable with this solution. Is there a better way?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

i go one further, with locking down apt-get i lock down what parameters you can use, because we don't want someone installing or removing something.

%admins         ALL =  NOPASSWD:                   \
                    /usr/bin/apt-get update,        \
                    /usr/bin/apt-get dist-upgrade,  \
                    /usr/bin/apt-get upgrade

which gives the group admins permissions to run apt-get update/dist-upgrade/upgrade without providing a password.

share|improve this answer
1  
+1 - I didn't realize you could do that ! –  gareth_bowles May 13 '10 at 19:01

You could lock down the commands that the hudson user is allowed to execute as root; change the line in your sudoers file to:

hudson   ALL=/usr/bin/apt-get  NOPASSWD:ALL

(Check the path to your apt-get binary - I'm running on Fedora so don't have that command)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.