up vote 0 down vote favorite
share [g+] share [fb]

I want our developers (including moi) to be able to run svn update as user www-data on our server, for file/directory permissions.

My solution was to grant access to run sudo -u www-data svn with NOPASSWD in visudo. I also added an alias for this command, and named it svn to make it transparent for our developers.

This works, but I am asked for svn credentials every time (it doesn't save, even if I tell it to). I am thinking about adding the -i parameter, though I thought I should check with you guys first :)

How do I make this as smooth as running the svn update command normally?

Clarification: It is working now. I just don't want to enter my svn credentials every time I run svn update :)

link|improve this question
91% accept rate
If you show your line in the sudoers file, we might see what's wrong. Perhaps you should include a full path to the svn binary in the sudoers file. (The sudoers file is what you edit with the visudo command) – user27093 Nov 25 '09 at 15:08
From sudoers file: %admins ALL=(www-data) NOPASSWD: /usr/bin/svn – Znarkus Nov 25 '09 at 15:15
feedback

4 Answers

up vote 3 down vote accepted

I am not entirely sure, but passing -H as an argument to sudo might take care of the credentials issue (being asked each time).

This will set the HOME environment variable to /root by default, so I would guess that then the svn client my then know to look in /root/.subversion for the auth information. Specify a different home directory for wherever the credentials should be for your specific case. Also, make sure whatever use can write/read to that file.

link|improve this answer
1  
-H will set HOME to default homedir of the user specified; since he's using it with -u www-data that'll probably be /var/www (i think that's default on ubuntu; check /etc/passwd to be sure). otherwise this sounds reasonable. – quack quixote Nov 25 '09 at 16:49
This sounds like the solution I was looking for. I think the problem is that it is trying to store the SVN password in my home, and fails because it hasn't write access. – Znarkus Nov 25 '09 at 22:05
Worked like a charm! Thanks!! – Znarkus Nov 25 '09 at 22:22
feedback
up vote 1 down vote

Isn't this what setuid was made for? Create a script or compiled binary (depending on your security requirements) that does the update (one system call should do it), and have it setuid and owned by www-data.

link|improve this answer
umm... setuid on the svn binary?? only if that's the only user you ever want to use svn on that system. – quack quixote Nov 25 '09 at 16:51
No; write a short compiled program or script that does what you want (depending on security concerns) and run that setuid. – David Thornley Nov 25 '09 at 17:40
ah. that makes sense; should edit your answer to include such details. – quack quixote Nov 25 '09 at 18:27
feedback
up vote 1 down vote

Why not try running it with svn update --username wwwdata

link|improve this answer
feedback
up vote 0 down vote

This behaviour is implemented differently between different distros - which are you using?

For RHEL5:

    Cmnd_Alias      SVN = /usr/bin/svn
    herbert         ALL = NOPASSWD: SVN

Alternatively you can achieve the same thing with a single script (to restrict the user to a subset of the target program's functionality)

link|improve this answer
Ubuntu 9.x is my dist – Znarkus Nov 25 '09 at 15:29
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.