2

I have several services that need to be user-controlled and I can't use them as user services (their requirement is system service with root access), plus there is weird GROUP/216 bug that I haven't been able to fix no matter what I try.

I have created template service with name my-daemon@.service, so it has to be launched as systemctl start my-daemon@<parameter>.service. The parameter is alphanumeric string, no spaces, tabs, special characters, etc.

I have read Restarting systemd service only as a specific user? and tried the "sudo approach", but as I am using template service, it creates conciderable security problems.

Example sudo line that allows user username to stop one service:

username ALL= NOPASSWD: /bin/systemctl stop my-daemon@*.service

However, I am perfectly aware that this line is security nightmare, as it lets me do this command too:

sudo systemctl stop my-daemon@xyz firewalld.service

And here are two example polkit files, one with static service name and second is template. Both are in /etc/polkit-1/rules.d/ :

polkit.addRule(function(action, subject) { if (action.id == "org.freedesktop.systemd1.manage-units" && action.lookup("unit") == "my-daemon2.service" && subject.user == "username") { return polkit.Result.YES; } });

polkit.addRule(function(action, subject) { if (action.id == "org.freedesktop.systemd1.manage-units" && action.lookup("unit") == "my-daemon@.service" && subject.user == "username") { return polkit.Result.YES; } });

Questions:

  1. How can I fix the sudo statement so it will only allow me to run selected services as user username? I read the man, tried and failed to fix it myself.
  2. I would much prefer to use polkit, I have polkit version 0.112, through journalctl I can see polkit added new rules but I can't get the rules right, even when I try static service name it doesn't allow me to control it. What am I doing wrong?
1

After multiple tests and research, I can finally answer myself.

1) Not possible in itself. No way to write something that resembles [a-zA-Z0-9_-]* regexp. It would be possible if I knew precisely how many characters the string should have, but it varies.

2) As said in my comment, option 2 is out too, there isn't required systemd support in my version of systemd. Upgrading required system packages would be possible, but not in the time I have.

So I went with the option one with a twist. I don't allow user to control service directly, I allow to start script that does all the checking I can't do in sudo. If everything is OK, then the service is called.

| improve this answer | |
  • Writing a script in this case seems to be the most sensible option anyway, since this is the level at which Cmnd_Alias in sudoers works ... i.e. instead of whitelisting systemctl carefully craft a script which can be used in a Cmnd_Alias. If you wanted to make it seamless, you could place the script in the user's PATH and call it systemctl but limit the scope of commands/services this script enables the user to act upon. – 0xC0000022L Dec 2 '19 at 10:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.