Score:0

Ubuntu20.04 : How to give non root user access to systemctl

um flag
  • The ubuntu version is 20.04
  • I am running a http service on port 6000.
  • I have created the service and as a user root i can run the service successfully
  • I have created a account svc_auto_bm and wanted this user to have the capability to start service http.server.service

I did configure the file

root@LB1EDGRSISNBX02:/etc/systemd/system# cat http.server.service
[Unit]
Description = Job that runs simple http server daemon

[Service]
Type=simple
WorkingDirectory=/home/svc_auto_bm/projects/lab_automation_bot/output
User=svc_auto_bm
ExecStart=/usr/bin/python3 -m http.server 6000
ExecStop=/bin/kill `/bin/ps aux | /bin/grep http.server | /bin/grep -v grep | /usr/bin/awk '{ print $2 }'`
Restart=on-abort

[Install]
WantedBy=wmulti-user.target

root@LB1EDGRSISNBX02:/etc# lsb_release 0a
Usage: lsb_release [options]

lsb_release: error: No arguments are permitted
root@LB1EDGRSISNBX02:/etc# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 20.04.6 LTS
Release:        20.04
Codename:       focal
root@LB1EDGRSISNBX02:/etc#

There are two problems:

  1. When I ran as non root user svc_auto_bm it list user for providing password and in that list svc_auto_bm is missing

  2. It should have accepted the command automatically because i have configured the following for polkit in cd /etc/polkit-1/localauthority/50-local.d:

    root@LB1EDGRSISNBX02:/etc/polkit-1/localauthority/50-local.d# cat service-auth.pkla
    [Allow svc_auto_bm to start/stop/restart services]
    Identity=unix-group:svc_auto_bm
    Action=org.freedesktop.systemd1.manage-units
    ResultActive=yes
    root@LB1EDGRSISNBX02:/etc/polkit-1/localauthority/50-local.d#
    

I have also configured the rules in /etc/polkit-1/rules.d

cd /etc/polkit-1/rules.d
root@LB1EDGRSISNBX02:/etc/polkit-1/rules.d# cat service-auth.rules
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" &&
        subject.isInGroup("svc_auto_bm")) {
        if (action.lookup("unit") == "http.server.service") {
            var verb = action.lookup("verb");
            if (verb == "start" || verb == "stop" || verb == "restart") {
                return polkit.Result.YES;
            }
        }
    }
});
root@LB1EDGRSISNBX02:/etc/polkit-1/rules.d# cat http.server.rules
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" &&
        subject.isInGroup("svc_auto_bm")) {
        if (action.lookup("unit") == "http.server.service") {
            var verb = action.lookup("verb");
            if (verb == "start" || verb == "stop" || verb == "restart") {
                return polkit.Result.YES;
            }
        }
    }
});
root@LB1EDGRSISNBX02:/etc/polkit-1/rules.d# cat svc_auth_bm.rules
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" &&
        subject.isInGroup("svc_auto_bm")) {
        if (action.lookup("unit") == "http.server.service") {
            var verb = action.lookup("verb");
            if (verb == "start" || verb == "stop" || verb == "restart") {
                return polkit.Result.YES;
            }
        }
    }
});
root@LB1EDGRSISNBX02:/etc/polkit-1/rules.d#
HBruijn avatar
in flag
Rather than a `ps | grep` construct use the dedicated `pgrep` command to identify a process by name or simply use `pkill` when you want to terminate a particular process by name rather than PID.
in flag
Is the user `svc_auto_bm` in the group `svc_auto_bm`?
Darkic43 avatar
tt flag
Check this link it should fix your problem. https://unix.stackexchange.com/questions/192706/how-could-we-allow-non-root-users-to-control-a-systemd-service
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.