2

I have a nodejs process that runs as a non-root user (and needs to for a reason) but it has one dependency that requires root access for the raspberry pi gpio interrupts. So the solution is I have have a group gpio on the rpi with a sudoers entry for running node. Then I fire this script up with a service unit file and it works fine

[Unit]
Description=switches16-mcp230xx-dSxJM-interrupt Device Starter Service
After=network-online.target

[Service]
Environment=UCI_ENV=pro
ExecStart=/usr/bin/sudo /usr/bin/node -r esm /opt/light/switches16-mcp230xx-dSxJM-interrupt/index.js
Restart=on-failure
WorkingDirectory=/opt/light/switches16-mcp230xx-dSxJM-interrupt

[Install]
WantedBy=default.target

The problem comes on restart (or failure restart). The process needs to be killed but it was started as sudo so not surprisingly it must be killed by using sudo as well.

Mar 12 19:43:12 switches systemd[1289]: switches16-mcp230xx-dSxJM-interrupt.service: Failed to kill main process 11222 (sudo), ignoring: Operation not permitted
Mar 12 19:43:12 switches systemd[1289]: switches16-mcp230xx-dSxJM-interrupt.service: Killing process 11223 (node) with signal SIGKILL.
Mar 12 19:43:12 switches systemd[1289]: switches16-mcp230xx-dSxJM-interrupt.service: Failed to kill control group /user.slice/user-1000.slice/user@1000.service/switches16-mcp230xx-dSxJM-

So since the unit file is launched as a non-root user it kills as a user so I assumed I must deliberately kill the process using sudo as I started it. so I added this.

ExecReload=/usr/bin/sudo /bin/kill -HUP $MAINPID

but got the same error. Even though my sudoers.d file has

%gpio ALL=NOPASSWD: /usr/bin/node
%gpio ALL=NOPASSWD: /bin/kill

I must be missing something here but I can't put my finger on it.

here are the processes that unit file spawns that must be killed before restart

root     11093  0.0  0.3   8468  2920 ?        Ss   18:01   0:00  \_ /usr/bin/sudo /usr/bin/node -r esm /opt/light/switches16-mcp230xx-dSxJM-interrupt/index.js
root     11094  6.7  4.8 142820 45788 ?        SLl  18:01   6:52      \_ /usr/bin/node -r esm /opt/light/switches16-mcp230xx-dSxJM-interrupt/index.js

Any suggestions?

Let me reiterate that I can't run this service as root so no point in suggesting that as it would obviously be the easy answer. I am deploying this code and starting via ssh without a root access key so running as a user with passwordless sudo is my only option. If not for this particular hardware (root) dependency in my code I wouldn't be faced with this issue at all.

  • from a fresh terminal if I try /usr/bin/sudo /bin/kill -15 xxxxx I am not prompted for sudo password confirming that the sudoers.d file entry for /bin/kill seems in effect – DKebler Mar 13 at 3:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.