I have a nodejs process that runs as a non-root user (and needs to for a reason) but it has one dependency that requires root access for the raspberry pi gpio interrupts. So the solution is I have have a group
gpio on the rpi with a sudoers entry for running node. Then I fire this script up with a service unit file and it works fine
[Unit] Description=switches16-mcp230xx-dSxJM-interrupt Device Starter Service After=network-online.target [Service] Environment=UCI_ENV=pro ExecStart=/usr/bin/sudo /usr/bin/node -r esm /opt/light/switches16-mcp230xx-dSxJM-interrupt/index.js Restart=on-failure WorkingDirectory=/opt/light/switches16-mcp230xx-dSxJM-interrupt [Install] WantedBy=default.target
The problem comes on restart (or failure restart). The process needs to be killed but it was started as sudo so not surprisingly it must be killed by using sudo as well.
Mar 12 19:43:12 switches systemd: switches16-mcp230xx-dSxJM-interrupt.service: Failed to kill main process 11222 (sudo), ignoring: Operation not permitted Mar 12 19:43:12 switches systemd: switches16-mcp230xx-dSxJM-interrupt.service: Killing process 11223 (node) with signal SIGKILL. Mar 12 19:43:12 switches systemd: switches16-mcp230xx-dSxJM-interrupt.service: Failed to kill control group /email@example.com/switches16-mcp230xx-dSxJM-
So since the unit file is launched as a non-root user it kills as a user so I assumed I must deliberately kill the process using sudo as I started it. so I added this.
ExecReload=/usr/bin/sudo /bin/kill -HUP $MAINPID
but got the same error. Even though my sudoers.d file has
%gpio ALL=NOPASSWD: /usr/bin/node %gpio ALL=NOPASSWD: /bin/kill
I must be missing something here but I can't put my finger on it.
here are the processes that unit file spawns that must be killed before restart
root 11093 0.0 0.3 8468 2920 ? Ss 18:01 0:00 \_ /usr/bin/sudo /usr/bin/node -r esm /opt/light/switches16-mcp230xx-dSxJM-interrupt/index.js root 11094 6.7 4.8 142820 45788 ? SLl 18:01 6:52 \_ /usr/bin/node -r esm /opt/light/switches16-mcp230xx-dSxJM-interrupt/index.js
Let me reiterate that I can't run this service as root so no point in suggesting that as it would obviously be the easy answer. I am deploying this code and starting via ssh without a root access key so running as a user with passwordless sudo is my only option. If not for this particular hardware (root) dependency in my code I wouldn't be faced with this issue at all.