53

With sysvinit, a sudoers entry like this would suffice:

%webteam cms051=/sbin/service httpd *

This would allow for commands such as:

  • sudo service httpd status
  • sudo service httpd restart

Now, with systemd, the service name is the final argument. I.e., the service restart would be done with:

systemctl restart httpd.service

Naturally, I thought defining the command as systemctl * httpd.service would work but that would allow something like systemctl restart puppet.service httpd.service which is not the desired effect.

With that being considered, what would be the best way allow non-root users to control a system.d service then? This doesn't need to be sudoers; perhaps a file permission change may be sufficient?

  • I haven't touched a sudo configuration in a while, but couldn't you just do something like cms051=systemctl * httpd.service ? – John WH Smith Mar 26 '15 at 17:29
  • 1
    This would allow you to restart any service then. I should have included that tidbit in the question. Sorry. – Belmin Fernandez Mar 26 '15 at 17:30
39

Just add all needed commands to sudoers separately:

%webteam cms051=/usr/bin/systemctl restart httpd.service
%webteam cms051=/usr/bin/systemctl stop httpd.service
%webteam cms051=/usr/bin/systemctl start httpd.service 
%webteam cms051=/usr/bin/systemctl status httpd.service
  • I was hoping to capture all unit commands but if I have to itemize them, then I guess that's what I will have to do. – Belmin Fernandez Mar 26 '15 at 18:07
  • 9
    status isn't useful, as any user can do that – Dereckson Jan 30 '17 at 0:51
  • 4
    What is cms051? – kevin Nov 13 '17 at 8:54
  • @kevin cms501 is a host name or an host name list alias. See linux.die.net/man/5/sudoers – jofel Nov 13 '17 at 10:24
  • So what will happen if I invoke systemctl restart http.service mariadb.service ;-) ? Probably mariadb will be restarted also – Marek Wajdzik May 17 '18 at 7:16
28

@jofel's answer was exactly what I needed to get a working setup. POsting this for anyone else stumbling on this question. I needed a way to have capistrano restart my Ruby application after deploying from my local machine. That means I needed passwordless access to restarting systemd services. THIS is what I have and it works wonderfully!

Note: my user and group is called deployer
Put code in a custom file here: /etc/sudoers.d/deployer
Code:

%deployer ALL= NOPASSWD: /bin/systemctl start my_app
%deployer ALL= NOPASSWD: /bin/systemctl stop my_app
%deployer ALL= NOPASSWD: /bin/systemctl restart my_app
  • I need to add that after logging in as the user deployer in the case, you should run the systemctl command with sudo. – Muyiwa Olu Mar 24 at 10:04
7

Create a command alias with the commands you want them to have access to. Then assign the group to that command alias:

Cmnd_Alias APACHE-SVC = /usr/bin/systemctl stop httpd, /usr/bin/systemctl start httpd, /usr/bin/systemctl restart httpd

%webteam ALL=APACHE-SVC

It is also good practice to place any edits in your /etc/sudoers.d/filename rather than directly editing the sudoers file. Make sure to point to your .d/filename in the sudoers, which most new distros do anyway. Placing these 2 lines in your sudoers should do the trick:

## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d

Note: That # in front of the includedir is not a comment. It must remain.

  • How add chance to execute stop/start/restart whithout enter password? – Nikolay Baranenko Oct 18 '18 at 10:58
  • Best answer IMO. Everyone should add a command alias and work with this. – DASKAjA Feb 22 at 14:25
5

It's safest to itemize them as jofel suggests.

If I wanted to allow someone to use a limited subset of a command's abilities, I would not trust wildcards in a sudoers line to do it. Even if the language was more expressive than shell globs, there are just too many corner cases to keep track of.

The "service httpd *" line is relatively safe because (verify this:) service only has one useful flag (--status-all) which doesn't do anything particularly sensitive, and (verify this too:) /etc/init.d/httpd will only accept the command lines you want to allow.

If there are so many combinations that listing them out becomes awkward, you should probably question what you are doing. But you could give them access to a carefully written helper script that runs the command for them (much like /etc/init.d/http). Even in this case you should be as precise and explicit as possible to list out exactly what commands and options are allowed, and don't pass any user input directly to the target command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.