5

I'm trying to allow users of a somegroup to manage someunit systemd service.

In polkit (>=0.106), this can be done by adding rules:

/etc/polkit-1/rules.d/20-someunit.rules
---
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" 
        && subject.isInGroup("somegroup")
        && (action.lookup("unit") == "someunit.service") )
    {
        var verb = action.lookup("verb");
        if (verb == "start" || verb == "stop" || verb == "restart") {
            return polkit.Result.YES;
        }
    }
});

However, I'm on Debian stretch/buster where we have been on polkit 0.105 since 2012. polkit(<0.106) doesn't support the rules.d/* files. Instead, we rely on /etc/polkit-1/localauthority/50-local.d/*.pkla.

Following some examples in pklocalauthority(8), I'm able to get most of this working in an equivalent pkla file:

/etc/polkit-1/localauthority/50-local.d/manage-units.pkla
----
[Allow users to manage services]
Identity=unix-group:somegroup
Action=org.freedesktop.systemd1.manage-units
ResultActive=yes

However, this grants access for ALL actions on ALL services. Is there an equivalent to permitting specific action.lookup() features?

I did try out systemctl enable and systemctl edit, of which both still failed (that's good). So action.lookup("verb") may not be required, but action.lookup("unit") is still quite important.

There are a lot of unanswered questions on this subject:

Improve this question

2 Answers 2

Reset to default
2

it's not possible. This feature was implemented for the .rules-variant only

https://github.com/systemd/systemd/pull/1159

Improve this answer
-1

works for a user though:

sudo cat /etc/polkit-1/localauthority/50-local.d/54-manage-units.pkla
[systemd]
Identity=unix-user:pi
Action=org.freedesktop.systemd1.manage-units
ResultAny=yes
ResultInactive=yes
ResultActive=yes

In fact, it was the only way to make it work on raspian, because it doesn't honor the polkit rules written in javascript from some strange reason.

Improve this answer
2
  • 1
    Hi, your answer doesn't seem to answer OP's question at all. I don't see anything limiting the policy to a particular service (someunit.service) or action (start/stop/restart). As far as I can see, your answer makes it possible to do anything to any service, which OP explicitly does not want. (I will remove my downvote once the answer gets improved.)
    – TooTea
    Jan 5, 2021 at 8:10
  • You are right that's it's too relaxed and may be a security risk and it's not answering the original question per-se, but it can be useful for people who want to achieve systemctl start foo w/o using sudo on raspian. I was looking how to do that and that's how I find this question. It took me like 2 hours to find out that raspian doesn't support the polkit rules and this is actually the only way around it. Do whatever you want w/ your downvotes :)
    – Jiri Kremser
    Jan 8, 2021 at 21:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .