6

I'm trying to allow users of a somegroup to manage someunit systemd service.

In polkit (>=0.106), this can be done by adding rules:

/etc/polkit-1/rules.d/20-someunit.rules
---
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" 
        && subject.isInGroup("somegroup")
        && (action.lookup("unit") == "someunit.service") )
    {
        var verb = action.lookup("verb");
        if (verb == "start" || verb == "stop" || verb == "restart") {
            return polkit.Result.YES;
        }
    }
});

However, I'm on Debian stretch/buster where we have been on polkit 0.105 since 2012. polkit(<0.106) doesn't support the rules.d/* files. Instead, we rely on /etc/polkit-1/localauthority/50-local.d/*.pkla.

Following some examples in pklocalauthority(8), I'm able to get most of this working in an equivalent pkla file:

/etc/polkit-1/localauthority/50-local.d/manage-units.pkla
----
[Allow users to manage services]
Identity=unix-group:somegroup
Action=org.freedesktop.systemd1.manage-units
ResultActive=yes

However, this grants access for ALL actions on ALL services. Is there an equivalent to permitting specific action.lookup() features?

I did try out systemctl enable and systemctl edit, of which both still failed (that's good). So action.lookup("verb") may not be required, but action.lookup("unit") is still quite important.

There are a lot of unanswered questions on this subject:

2 Answers 2

2

it's not possible. This feature was implemented for the .rules-variant only

https://github.com/systemd/systemd/pull/1159

-1

works for a user though:

sudo cat /etc/polkit-1/localauthority/50-local.d/54-manage-units.pkla
[systemd]
Identity=unix-user:pi
Action=org.freedesktop.systemd1.manage-units
ResultAny=yes
ResultInactive=yes
ResultActive=yes

In fact, it was the only way to make it work on raspian, because it doesn't honor the polkit rules written in javascript from some strange reason.

2
  • 1
    Hi, your answer doesn't seem to answer OP's question at all. I don't see anything limiting the policy to a particular service (someunit.service) or action (start/stop/restart). As far as I can see, your answer makes it possible to do anything to any service, which OP explicitly does not want. (I will remove my downvote once the answer gets improved.)
    – TooTea
    Commented Jan 5, 2021 at 8:10
  • You are right that's it's too relaxed and may be a security risk and it's not answering the original question per-se, but it can be useful for people who want to achieve systemctl start foo w/o using sudo on raspian. I was looking how to do that and that's how I find this question. It took me like 2 hours to find out that raspian doesn't support the polkit rules and this is actually the only way around it. Do whatever you want w/ your downvotes :) Commented Jan 8, 2021 at 21:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .