Score:1

Ubuntu

How to allow a user to start/stop a specific system service?

Erel Segal-Halevi

8/31/24, 11:23 AM

I am building a server on which my students will be able to upload their projects, which are Python+Flask web-applications. When I add a new user, I add a new service in /etc/systemd/system/[username].service, that automatically runs the user app.

I would like to allow each user to start, stop and restart his/her own service, but not the services of others. So Alice would be able to do e.g. service Alice restart and Bob will be able to do service Bob restart, but not vice-versa.

is this possible?

2 + 5

permissions

users

services

systemd

muru

8/31/24, 11:29 AM

Can you set up a user service instead? Those are inherently per-user, so the users wouldn't need additional permissions to control them.

Erel Segal-Halevi

8/31/24, 11:43 AM

@muru but a user service stops when the user disconnects. I want the web-apps to remain active even after the users leave.

muru

8/31/24, 11:45 AM

Not if you enable lingering: `sudo loginctl enable-linger <username>`

Erel Segal-Halevi

8/31/24, 12:10 PM

@muru I read that linger consumes a lot of resources, since it keeps the entire user session active after the user disconnects. All I need is a way for a user to run a specific privileged command, without access to other privileged commands.

muru

8/31/24, 12:17 PM

The entire user session that's kept alive is essentially just those user services which are enabled for those user. If this is on a server, which I guess it is, then it's just this service which you're making, because the other usual user services are desktop ones like pulseaudio.

Score:1

Ubuntu

Artur Meinild

8/31/24, 12:33 PM

This could be done with a workaround like this:

Create a Bash script (executable) under /usr/local/bin for each user (called <user>.sh for example's sake).
The script for each user just runs the command to restart that user's service, e.g.: systemctl restart <user>
(If you're creative, you could add different functionality to this script to both start, stop and restart said service.)
Add to the sudoers file the ability for each user to run only their own script. This is done like this (under the # User section):
```
# User
<user> ALL=(ALL:ALL) NOPASSWD: /usr/local/bin/<user>.sh
```

Now each user can run their own /usr/local/bin/<user>.sh without typing a password, and this will restart their service (or do whatever you allow the script to do).

+ 4

muru

8/31/24, 1:24 PM

There's no reason for having the NOPASSWD, it shouldn't be a problem for the students to have to enter their password for a sudo command.

Artur Meinild

8/31/24, 4:32 PM

You're right, that's completely optional. ^^

Erel Segal-Halevi

9/1/24, 1:24 AM

Do I need to add a separate line for each user? Maybe there is a way to add a generic line that allows each "user" to run "/usr/local/bin/user.sh"?

Artur Meinild

9/1/24, 5:47 AM

@ErelSegal-Halevi that depends on how you design your script - but as a basis yes. However, it should be possible to do a clever solution with only one script, but that would take some more work (since it then needs info about who ran the script).

Score:0

Ubuntu

Luca Boccassi

8/31/24, 12:17 PM

Not possible currently to do on a per-unit basis, but will hopefully become possible soon when https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/154 is merged and available in a release

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How to allow a user to start/stop a specific system service?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.