Permissions issue when trying to execute command in post-commit hook in SVN

Question

I have a dull problem that I can't seem to solve.

What am I trying to do?

post-review --repository-url=http://xxx.xxx.xxx.xxx/svn/testRepo2 --revision-range=6:7 --server=http://reviews.example.test/ --username=reviewposter --password=mydullpass --submit-as=admin -p --target-groups=reviewers

All is alright when I try this from bash logged in as my user. Review is posted, published, etc. ==> All permissions and other miscellaneous settings are OK.

What happens when I try this from SVN's post-commit hook?

The resources are commited but the svn operation hangs - actually the post-commit hook does not finish.

What is the problem narrowed down to?

post-review is executed as the user that is executing the post-commit hook - in this case www-data Apache's user. I.e. when I run the command as www-data:

sudo -u www-data post-review --repository-url=http://xxx.xxx.xxx.xxx/svn/testRepo2 --revision-range=6:7 --server=http://reviews.example.test/ --username=reviewposter --password=mydullpass! --submit-as=admin -p --target-groups=reviewers -d

I get (notice the -d parameter in the post-review command - DEBUG):

RBTools 0.4.1
Home = /home/borislav
Password for 'www-data':

This is where it hangs waiting for a password to be entered. The commit operation cannot finish and it just stays there. I've already discussed this with the guys over at ReviewBoard's google group in this post.

On the other hand when I do the same command with debug output but as myuser I get:

RBTools 0.4.1
Home = /home/borislav
HTTP GETting api/
HTTP GETting http://reviews.example.test/api/info/
Using the new web API
TTP GETting http://reviews.example.test/api/repositories/
HTTP GETting http://reviews.example.test/api/repositories/1/
HTTP GETting http://reviews.example.test/api/repositories/1/info/
HTTP GETting http://reviews.example.test/api/repositories/2/
HTTP GETting http://reviews.example.test/api/repositories/2/info/
HTTP GETting http://reviews.example.test/api/repositories/3/
HTTP GETting http://reviews.example.test/api/repositories/3/info/
HTTP GETting http://reviews.example.test/api/repositories/4/
HTTP GETting http://reviews.example.test/api/repositories/4/info/
Attempting to create review request on http://xxx.xxx.xxx.xxx/svn/testRepo2 for None
Submitting the review request as admin
HTTP POSTing to http://reviews.example.test/api/review-requests/: {'submit_as': 'admin', 'repository': 'http://xxx.xxx.xxx.xxx/svn/testRepo2'}
Review request created
Attempting to set field 'target_groups' to 'reviewers' for review request '22'
HTTP PUTting to http://reviews.example.test/api/review-requests/22/draft/: {'target_groups': 'reviewers'}
Uploading diff, size: 2316
HTTP POSTing to http://reviews.example.test/api/review-requests/22/diffs/: {'basedir': '/'}
Publishing
HTTP PUTting to http://reviews.example.test/api/review-requests/22/draft/: {'public': 1}
Review request #22 posted.

http://reviews.example.test/r/22/

So actually everything with the posting/publishing etc. works.

One of the devs at ReveiwBoard stated that "We don't display the string "Password for ''". So that's coming from something else entirely."

I am sure that it is some kind of execution permission. It should run on Ubuntu Server, so think Debian.

I was wondering if it had any connection to the "no root login" paradigm in Ubuntu.

I have not tried on another Linux distribution, which is not really an option since the SVN server is hosted on Ubuntu Server.

You can check this discussion I had with the guys over at ReviewBoard's goggle group. The post-review binary is located at: /usr/local/bin/post-review

I tried adding permissions for www-data to be able to execute post-review in the sudoers file, but with no luck.

What solution can you think of?

Thanks in advance, Borislav.

Answer 1

The password prompt is actually coming from svn, not from post-review. post-review calls the svn binary to retrieve the changes from the repo.

You don't see the password prompt as your user because you've already authenticated and svn has stored your auth info. You haven't done this as the www-data user yet, so svn asks for the password.

Easiest way to fix this would be to su as the www-data user and authenticate to the repo, so the credentials get cached.