- The ubuntu version is 20.04
- I am running a http service on port 6000.
- I have created the service and as a user root i can run the service successfully
- I have created a account
svc_auto_bm
and wanted this user to have the capability to start service http.server.service
I did configure the file
root@LB1EDGRSISNBX02:/etc/systemd/system# cat http.server.service
[Unit]
Description = Job that runs simple http server daemon
[Service]
Type=simple
WorkingDirectory=/home/svc_auto_bm/projects/lab_automation_bot/output
User=svc_auto_bm
ExecStart=/usr/bin/python3 -m http.server 6000
ExecStop=/bin/kill `/bin/ps aux | /bin/grep http.server | /bin/grep -v grep | /usr/bin/awk '{ print $2 }'`
Restart=on-abort
[Install]
WantedBy=wmulti-user.target
root@LB1EDGRSISNBX02:/etc# lsb_release 0a
Usage: lsb_release [options]
lsb_release: error: No arguments are permitted
root@LB1EDGRSISNBX02:/etc# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 20.04.6 LTS
Release: 20.04
Codename: focal
root@LB1EDGRSISNBX02:/etc#
There are two problems:
When I ran as non root user svc_auto_bm
it list user for providing password and in that list svc_auto_bm
is missing
It should have accepted the command automatically because i have configured the following for polkit in cd /etc/polkit-1/localauthority/50-local.d
:
root@LB1EDGRSISNBX02:/etc/polkit-1/localauthority/50-local.d# cat service-auth.pkla
[Allow svc_auto_bm to start/stop/restart services]
Identity=unix-group:svc_auto_bm
Action=org.freedesktop.systemd1.manage-units
ResultActive=yes
root@LB1EDGRSISNBX02:/etc/polkit-1/localauthority/50-local.d#
I have also configured the rules in /etc/polkit-1/rules.d
cd /etc/polkit-1/rules.d
root@LB1EDGRSISNBX02:/etc/polkit-1/rules.d# cat service-auth.rules
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
subject.isInGroup("svc_auto_bm")) {
if (action.lookup("unit") == "http.server.service") {
var verb = action.lookup("verb");
if (verb == "start" || verb == "stop" || verb == "restart") {
return polkit.Result.YES;
}
}
}
});
root@LB1EDGRSISNBX02:/etc/polkit-1/rules.d# cat http.server.rules
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
subject.isInGroup("svc_auto_bm")) {
if (action.lookup("unit") == "http.server.service") {
var verb = action.lookup("verb");
if (verb == "start" || verb == "stop" || verb == "restart") {
return polkit.Result.YES;
}
}
}
});
root@LB1EDGRSISNBX02:/etc/polkit-1/rules.d# cat svc_auth_bm.rules
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
subject.isInGroup("svc_auto_bm")) {
if (action.lookup("unit") == "http.server.service") {
var verb = action.lookup("verb");
if (verb == "start" || verb == "stop" || verb == "restart") {
return polkit.Result.YES;
}
}
}
});
root@LB1EDGRSISNBX02:/etc/polkit-1/rules.d#