1

I've got a service that's running fine called "core" that has the following service file:

# /etc/systemd/system/core.service
[Unit]
Description=ExampleCo Core Service

[Service]
Type=simple
ExecStart=/home/example/backend/bin/python3 /home/example/core/core.py
WorkingDirectory=/home/example/core
User=example
Group=example

Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

The service runs perfectly.

I've written a service-status script that runs the following command:

systemctl show -p ActiveState core

This command runs perfectly when called by example, root and user1, but when user2 runs it, they get this error:

Failed to get properties: Access denied

If user2 calls it with sudo, then it works.

Running strace -e trace=connect,sendmsg,recvmsg systemctl show -p ActiveState core shows it's talking to /run/dbus/system_bus_socket, sending AUTH EXTERNAL 12345\r\nNEGOTIATE_UNIX_FD\r\nBEGIN\r\n, and receiving REJECTED EXTERNAL\r\nERROR "Need to authenticate first"\r\n.

Running fuser /run/dbus/system_bus_socket shows two processes listening: systemd (pid=1) and dbus-daemon (pid=474). Running strace -p 474 shows that dbus-daemon is getting the message, opening and reading the passwd file, and rejecting the request without logging anything.

Question: How do I fix this so that user2 can call it?

Meta-questions:

  • Where does systemd log these failures?
    • While running the command once a second, I looked for log files on the system that were less than a minute old, and found no mention of the service or the user.
  • How does systemd decide who can run commands?
    • We're using IPA/sssd/IDM, if that makes a difference.

Operating System: Ubuntu 18.04 Systemd version: systemd-237-3ubuntu10.52.deb

Thanks!

1 Answer 1

0

The answer became obvious once I compared the strace outputs between user1 and user2: dbus-daemon doesn't know about any user that's not in /etc/passwd and will reject their requests with a "Need to authenticate first" error (which is mangled into "Permission denied" by the systemctl command).

And user1 is in /etc/passwd while user2 is an IDM user (LDAP, no entry in /etc/passwd).

Doing getent passwd user2 >> /etc/passwd was enough to enable their access. Now I just have to figure out how to do it correctly. :-/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .