Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want our developers (including moi) to be able to run svn update as user www-data on our server, for file/directory permissions.

My solution was to grant access to run sudo -u www-data svn with NOPASSWD in visudo. I also added an alias for this command, and named it svn to make it transparent for our developers.

This works, but I am asked for svn credentials every time (it doesn't save, even if I tell it to). I am thinking about adding the -i parameter, though I thought I should check with you guys first :)

How do I make this as smooth as running the svn update command normally?

Clarification: It is working now. I just don't want to enter my svn credentials every time I run svn update :)

share|improve this question
    
If you show your line in the sudoers file, we might see what's wrong. Perhaps you should include a full path to the svn binary in the sudoers file. (The sudoers file is what you edit with the visudo command) –  Ger Apeldoorn Nov 25 '09 at 15:08
    
From sudoers file: %admins ALL=(www-data) NOPASSWD: /usr/bin/svn –  Znarkus Nov 25 '09 at 15:15
add comment

4 Answers

up vote 3 down vote accepted

I am not entirely sure, but passing -H as an argument to sudo might take care of the credentials issue (being asked each time).

This will set the HOME environment variable to /root by default, so I would guess that then the svn client my then know to look in /root/.subversion for the auth information. Specify a different home directory for wherever the credentials should be for your specific case. Also, make sure whatever use can write/read to that file.

share|improve this answer
1  
-H will set HOME to default homedir of the user specified; since he's using it with -u www-data that'll probably be /var/www (i think that's default on ubuntu; check /etc/passwd to be sure). otherwise this sounds reasonable. –  quack quixote Nov 25 '09 at 16:49
    
This sounds like the solution I was looking for. I think the problem is that it is trying to store the SVN password in my home, and fails because it hasn't write access. –  Znarkus Nov 25 '09 at 22:05
    
Worked like a charm! Thanks!! –  Znarkus Nov 25 '09 at 22:22
add comment

Isn't this what setuid was made for? Create a script or compiled binary (depending on your security requirements) that does the update (one system call should do it), and have it setuid and owned by www-data.

share|improve this answer
    
umm... setuid on the svn binary?? only if that's the only user you ever want to use svn on that system. –  quack quixote Nov 25 '09 at 16:51
    
No; write a short compiled program or script that does what you want (depending on security concerns) and run that setuid. –  David Thornley Nov 25 '09 at 17:40
    
ah. that makes sense; should edit your answer to include such details. –  quack quixote Nov 25 '09 at 18:27
add comment

Why not try running it with svn update --username wwwdata

share|improve this answer
add comment

This behaviour is implemented differently between different distros - which are you using?

For RHEL5:

    Cmnd_Alias      SVN = /usr/bin/svn
    herbert         ALL = NOPASSWD: SVN

Alternatively you can achieve the same thing with a single script (to restrict the user to a subset of the target program's functionality)

share|improve this answer
    
Ubuntu 9.x is my dist –  Znarkus Nov 25 '09 at 15:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.