Looking for a way to forbid start/stop bash script without using systemctl

Question

I'd like to prevent direct use of start/stop bash scripts without using "systemctl start/stop service"

Is there a bash way to insert that in scripts ?

One possible approach is to change the script and detect whether it is called by SystemD. There may be a risk that this change is overridden by updates. Another approach would be to really enforce not starting it. That would be much more complicated (I guess). You could create AppArmor profiles for (a) the shell in general (or all relevant shells) and forbid access to the respective script and (b) the shell when called by SystemD and allow it.. — Hauke Laging, Apr 22, 2020 at 17:28
A basic question to answer: Why do you even use such a script in the first place? — JdeBP, Apr 22, 2020 at 22:11
This script is used to start/stop a java application service, and can be used by many users. As a SystemD service unit is now deployed on all servers, we'd like to avoid confusions, and possible mistakes. As SystemD not aware of a started service if it used the startup script directly. — beneteos, Apr 23, 2020 at 7:56
Thanks for your ideas @HaukeLaging but "change the script and detect whether it is called by SystemD", but how can I achieve this ? by checking PID ? Scripts are used on Centos & Redhat systems — beneteos, Apr 23, 2020 at 8:30

Hauke Laging · Accepted Answer · 2020-04-23 17:29:00Z

You can check within the script whether it has been called by SystemD and e.g. abort with an error message if not or call systemctl.

There are several ways for determining the parent, e.g.:

Very simple but not 100% certain: Check whether the PPID is 1:
```
grep -q '^PPid: *1$' /proc/$$/status
```
systemctl status $$ >/dev/null 2>&1 (exit code is 0 for SystemD processes)
Set a unique environment variable in the SystemD unit file and check for it
```
if [ 'yes' != "$STARTED_BY_SYSTEMD" ]; then ...
```

1 Answer 1