I have a Linux server that I am attempting to run
svnsync against a list of repositories to mirror / back up.
I created a folder
/srv/backups and set it to have the group gsid of
chmod g+s so that any item or folder created in this directory preserves the adm group ownership.
- create a repository
svnadmin create blahunder
- copy the
pre-revprop-changehook script into
- ensure the hook is executable
chmod +ax blah/hooks/pre-revprop-change
- try running
svnsync initagainst blah and the remote repository. It fails whether running as myself or root with a 255 error message from the pre-revprop-change script.
svnsync: E165001: Revprop change blocked by pre-revprop-change hook (exit code 255) with no output.
If I repeat the same steps above, copying the same
pre-revprop-change hook to the target mirror, however:
- running as myself against a folder under my home directory,
- or running as root against
root:admhas ownership but the gsid is not set,
Then it executes properly, allowing me to initialize and later sync.
So, I'm pretty sure it's an issue with the gsid and then svnsync does not have permissions to run the hook.
My understanding is setting the gsid tells programs acting against this directory to run with those credentials; so adding a folder is done as myself:adm, and I would expect that running the svnsync would run as myself:adm or root:adm, and should have sufficient privileges.
Here are the main folders under
backups fails and
drwxrwsr-x 11 root adm 4096 Sep 16 17:09 backups
drwxrwxr-x 2 root adm 4096 Sep 16 17:24 svnmirrors
And here are the hooks in both locations:
the hook that fails to execute; tried as both root and myuser:
-rwxr-xr-x 1 myuser adm 2794 Sep 16 16:54 backups/blah/hooks/pre-revprop-change
- OR -
-rwxr-xr-x 1 root adm 2794 Sep 16 16:54 backups/blah/hooks/pre-revprop-change
the succeeding one
-rwxr-xr-x 1 myuser myuser 2794 Sep 16 16:45 svnmirrors/blah/hooks/pre-revprop-change
- Is it that svnsync is not running under the group adm?
- If so, is it possible to add svnsync to adm?
- Or do I need to set a different group on the folder and ensure I'm in that group?
- By setting the gsid, am I exposing vulnerabilities on the server? Referencing this chapter on security.