How to give “apache” rights to run “svn update”

Question

I want to fire "svn update" command from a php script , the user for which is "apache". How can I assign permissions to apache user to execute "svn update" ?

Answer 1

I would create a command in the sudoers file, and then use sudo -u user-who-owns-svn-repo svn update in your PHP script.

The changes to /etc/sudores would be similar to:

Cmnd_Alias      SVN = /usr/local/bin/svn
apache          ALL=(ALL,!root,!#0) NOPASSWD: SVN

See the Sudoers manual for more info.

If you want tighter controls, make shell scripts that have the specific SVN commands and only allow Apache access to those. For example:

File /path/to/my/project/update.sh:

#!/bin/bash
svn update /path/to/my/project/svn-files

File /etc/sudores:

Cmnd_Alias      SVN = /path/to/my/project/update.sh
apache          ALL=(ALL,!root,!#0) NOPASSWD: SVN

(and don't forget to chmod +x path/to/my/project/update.sh)