2

I have several services that need to be user-controlled and I can't use them as user services (their requirement is system service with root access), plus there is weird GROUP/216 bug that I haven't been able to fix no matter what I try.

I have created template service with name [email protected], so it has to be launched as systemctl start my-daemon@<parameter>.service. The parameter is alphanumeric string, no spaces, tabs, special characters, etc.

I have read Restarting systemd service only as a specific user? and tried the "sudo approach", but as I am using template service, it creates conciderable security problems.

Example sudo line that allows user username to stop one service:

username ALL= NOPASSWD: /bin/systemctl stop my-daemon@*.service

However, I am perfectly aware that this line is security nightmare, as it lets me do this command too:

sudo systemctl stop my-daemon@xyz firewalld.service

And here are two example polkit files, one with static service name and second is template. Both are in /etc/polkit-1/rules.d/ :

polkit.addRule(function(action, subject) { if (action.id == "org.freedesktop.systemd1.manage-units" && action.lookup("unit") == "my-daemon2.service" && subject.user == "username") { return polkit.Result.YES; } });

polkit.addRule(function(action, subject) { if (action.id == "org.freedesktop.systemd1.manage-units" && action.lookup("unit") == "[email protected]" && subject.user == "username") { return polkit.Result.YES; } });

Questions:

  1. How can I fix the sudo statement so it will only allow me to run selected services as user username? I read the man, tried and failed to fix it myself.
  2. I would much prefer to use polkit, I have polkit version 0.112, through journalctl I can see polkit added new rules but I can't get the rules right, even when I try static service name it doesn't allow me to control it. What am I doing wrong?
1

1 Answer 1

1

After multiple tests and research, I can finally answer myself.

1) Not possible in itself. No way to write something that resembles [a-zA-Z0-9_-]* regexp. It would be possible if I knew precisely how many characters the string should have, but it varies.

2) As said in my comment, option 2 is out too, there isn't required systemd support in my version of systemd. Upgrading required system packages would be possible, but not in the time I have.

So I went with the option one with a twist. I don't allow user to control service directly, I allow to start script that does all the checking I can't do in sudo. If everything is OK, then the service is called.

1
  • Writing a script in this case seems to be the most sensible option anyway, since this is the level at which Cmnd_Alias in sudoers works ... i.e. instead of whitelisting systemctl carefully craft a script which can be used in a Cmnd_Alias. If you wanted to make it seamless, you could place the script in the user's PATH and call it systemctl but limit the scope of commands/services this script enables the user to act upon. Dec 2, 2019 at 10:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .