I have several services that need to be user-controlled and I can't use them as user services (their requirement is system service with root access), plus there is weird GROUP/216 bug that I haven't been able to fix no matter what I try.
I have created template service with name [email protected], so it has to be launched as systemctl start my-daemon@<parameter>.service.
The parameter is alphanumeric string, no spaces, tabs, special characters, etc.
I have read Restarting systemd service only as a specific user? and tried the "sudo approach", but as I am using template service, it creates conciderable security problems.
Example sudo line that allows user username to stop one service:
username ALL= NOPASSWD: /bin/systemctl stop my-daemon@*.service
However, I am perfectly aware that this line is security nightmare, as it lets me do this command too:
sudo systemctl stop my-daemon@xyz firewalld.service
And here are two example polkit files, one with static service name and second is template. Both are in /etc/polkit-1/rules.d/ :
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
action.lookup("unit") == "my-daemon2.service" &&
subject.user == "username") {
return polkit.Result.YES;
}
});
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
action.lookup("unit") == "[email protected]" &&
subject.user == "username") {
return polkit.Result.YES;
}
});
Questions:
- How can I fix the sudo statement so it will only allow me to run selected services as user username? I read the man, tried and failed to fix it myself.
- I would much prefer to use polkit, I have polkit version 0.112, through journalctl I can see polkit added new rules but I can't get the rules right, even when I try static service name it doesn't allow me to control it. What am I doing wrong?
