Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I give certain users authorization to start and stop certain services? I am asking specifically about Fedora 19 systems with SELinux installed.

The utility to call for services administration is in this case systemctl. What type of SELinux security policy do I have to write? Where? How? Any references?

share|improve this question

migrated from security.stackexchange.com Aug 20 '13 at 20:47

This question came from our site for information security professionals.

up vote 2 down vote accepted

RHEL doesn't yet have systemd, so the approach for Fedora 19 and RHEL will be dramatically different.

At any rate, what you are trying to do is not sanely possible. You'd have to create a separate login role for each user and grant it ability to execute systemd without transitioning into systemd domain -- at which point you'd have to pretty much clone the entire systemd policy into each user's domain and then write another policy for executing each service. Per user. Unless you already have a really awesome understanding of SELinux and are already really excellent at writing SELinux policies (and really love M4), I strongly suggest not going down this route.

Just add sudo rules per user to allow executing things like "/sbin/service foo restart" or "/bin/systemctl restart foo.service". If you want to add SELinux into the fray, make these users staff_u and the rest user_u.

share|improve this answer
exactly what I wanted to know! thanks a lot for your guidance, master mricon!! – user2433984 Aug 20 '13 at 19:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.