15

I'm running svnserve on a Fedora 17 machine with the following systemd service file:

[Unit]
Description=Subversion Server
After=syslog.target network.target

[Service]
User=svn
Type=forking
Environment=HOME=/repos/svn
ExecStart=/usr/bin/svnserve --daemon --pid-file=/run/svnserve/svnserve.pid -r /repos/svn
PIDFile=/run/svnserve/svnserve.pid

[Install]
WantedBy=multi-user.target

This works fine as long as /var/run/svnserve is owned by svn:svn, but breaks on reboot when that ownership is reset to root:root. What I want is to add a pre-launch step that chowns the directory.

Unfortunately I can't find any real documentation on systemd unit files, but I saw that some were using 'ExecStartPre', so I tried this:

ExecStartPre=/bin/chown svn:svn /run/svnserve

Sadly this fails with an 'operation not permitted' error, so it looks like ExecStartPre also runs as the user specified in the unit file.

I also tried having the unit file run as root, then starting svnserve as the svn user via su, but that produced a vague error about the command-line being invalid.

How can systemd units perform actions as root prior to executing as a specific user?

14
  • You report this as a bug. The permissions should already be correct on the /run directory and the pid file, but lots of these broke with the switch to systemd and the /usr move. Feb 25, 2013 at 21:14
  • @MichaelHampton I don't believe this is how it came out of the box. IIRC (this was set up a while back) svnserve doesn't come with a service wrapper, so this was something that we wrote ourselves.
    – DNS
    Feb 25, 2013 at 21:24
  • 1
    Subversion on Fedora certainly does come with this. It looks fairly similar to yours, though I would recommend you use the original. yum reinstall subversion Feb 25, 2013 at 21:28
  • 1
    PermissionsStartOnly=false will cause all ExecStartPre and ExecStartPost commands to ignore User and run as root. Apr 4, 2017 at 15:04
  • 3
    I would disagree with the reason this question was closed. Although it's a about a specific systemd service, running a command as root before starting a systemd service is a common task (and I've found myself doing this more than once, @MichaelHampton. Aug 3, 2019 at 13:05

2 Answers 2

9

The subversion package in Fedora is using systemd's tmpfiles mechanism to create /run/svnserve at boot with root ownership (since the packaged .service file apparently runs the daemon as root). You could copy /usr/lib/tmpfiles.d/svnserve.conf to /etc/tmpfiles.d/svnserve.conf and change the owner. See man tmpfiles.d for details.

1
  • 1
    Aha; I had no idea that tmpfiles mechanism existed. Thank you!
    – DNS
    Feb 26, 2013 at 12:33
0

You could make ExecStartPre a sudo call to a script and configure the user svn for this script.

11
  • 1
    Can't use sudo; there is no TTY when running systemd units.
    – DNS
    Feb 26, 2013 at 12:32
  • 6
    Moreover, setting PermissionsStartOnly=false will in and of itself tell systemd to run ExecStartPre and ExecStartPost processes as root. Apr 4, 2017 at 15:03
  • 13
    @Davos, in that case, just use a preceding + for the ExecStartPre; ExecStartPre=+/path/to/thing-to-run-as-root; that way you're applying a change only to that one specific command, not making global modifications at all. Dec 18, 2017 at 16:08
  • 3
    nod -- the disadvantage of doing it that way is that any other Pre/Post commands added by dropins, generators, etc. are also impacted by the PermissionStartOnly; whereas a +-prefix is guaranteed localized. Dec 19, 2017 at 0:12
  • 3
    @CharlesDuffy your comment is really an answer. Thanks for sharing!
    – Greg0ry
    Apr 18, 2020 at 19:01

Not the answer you're looking for? Browse other questions tagged .