How do I run a SVN post-commit script as root?

Question

I have a SVN repository server that runs under the repository user, and I want to run a script after every post-commit action.

I therefore wrote a shell script that runs from the hook after every commit, and it needs to be run under root. This is why I used sudo in the script, but it didn't work.

Is there any way to run the script as root?

sudo su
echo "password"
svn export --force file:///home/repository/trunk/ /home/memarexweb/public_html/devel/
chmod -R 777 /home/memarexweb/public_html/devel/

Answer 1

Edit your sudoers file to allow running certain commands without a password.

It's best to split your post-commit script into two parts, one of which will be run through sudo.

• /etc/sudoers:

  loqman    ALL=(root) NOPASSWD: /usr/local/bin/svn-postcommit-export
  

• Your post-commit hook:

  #!/bin/sh
  sudo /usr/local/bin/svn-postcommit-export
  

• /usr/local/bin/svn-postcommit-export:

  #!/bin/sh
  svn export --force file:///home/repository/trunk/ /home/memarexweb/public_html/devel/
  chmod -R 777 /home/memarexweb/public_html/devel/
  

  (You can choose any name and put the script anywhere; I just suggested svn-postcommit-export as an example, and /usr/local/bin as a common location.)

---

Now why the hell did it not work

You might be thinking that everything in a script is being run exactly as if entered by you with keyboard. This is not the case. The interpreter (sh) runs each command separately, waits for it to finish, then runs the next one.

There also are rules on how input and output is handled – programs read their input from 'stdin' – not from your script – and write output to 'stdout'⁰. When you run your script in a terminal window¹, its 'stdin' and 'stdout' will be attached to your keyboard and that terminal window, and this will be inherited by all commands: su² doesn't know what the rest of your script looks like; instead it expects commands to be entered from 'stdin' – in this case, your keyboard. Similarly, echo "password" will output the password to 'stdout' (your terminal window), not to sudo.

You can attach one process' output to another's input by using pipes; for example:

echo "svn export ..." | su

• This is a bad way of running commands by su; used here only as an example. For normal usage, su -c 'command' or sudo command are better.

• Before you try to echo password | sudo: don't waste your time. Most programs, including sudo and su, will explicitly read passwords from your terminal, not from stdin. In the case of sudo, you can turn off the password requirement by editing /etc/sudoers as above.

---

⁰ 'stderr' omitted for simplicity, as it works the same way as 'stdout' in most cases.

¹ When the script is ran by svn's post-commit, it will receive /dev/null as its stdin (and probably stdout).

² Simplified. In reality, su itself doesn't read commands, it starts a shell process (for example, sh or bash) which does the job.