Running a systemd service as a user other than root!

Question

I created the following service, amos.service, and it needs to run as amos (member of the amos group)

[Unit]
Description=AMOS Service
After=network.target

[Service]
User=amos
Group=amos
Type=simple
WorkingDirectory=/usr/share/amos
ExecStart=/usr/share/amos/amos_service.sh start
ExecStop=/usr/share/amos/amos_service.sh stop
Restart=on-failure

[Install]
WantedBy=multi-user.target

all the permissions have been set on /usr/share/amos to amos:amos

the amos_service.sh is as follows:

#!/bin/bash

CUDIR=$(dirname "$0")
cd /usr/share/amos

start() {
  exec /usr/share/amos/run_amos.sh >> /var/log/amos.log 2>&1  
}

stop() {
  exec pkill java 
}

case $1 in
  start|stop) "$1" ;;
esac

cd "$CURDIR"

When I run the service initially without any modifications to the directories, meaning, belonging to root, and amos.service not having the User not Group parameter, everything runs great!

Once I change the directories permissions to amos:amos and add the amos.service User & Group, the serive won't work and I get the following : See attached image

Answer 1

Use systemd:

To show the problem use journalctl -xe after you started the service.

You don't need a bash script, put this in your service file:

ExecStart=/usr/share/amos/run_amos.sh

There is no need for ExecStop, systemd will stop all child processes. You can view the output with journalctl -u amos.service.

Answer 2

I think you want forking instead of simple. Simple assumes your process doesn't exit, so when it does, it calls the process dead.

You probably want to remove the amos_service.sh script and put it's functionality into the amos.service.

Answer 3

First find your config you want to change using the following command:

systemctl list-unit-files

Then change the specific config using the following command:

sudo systemctl edit --full tomcat9.service

This will open the file in the default text editor set in the EDITOR environment variable.

Now add the specific user and group user service section.

Answer 4

Maybe authorize amos user to launch services thanks to the enable-linger option?

loginctl enable-linger amos

(cf. man loginctl, it seems to be mandatory)