AKR Developer Blog | create a Linux systemd service and make it runable for non-root users

We can easily delegate management of running a process/script into Linux by systemd. systemd is a Linux system tool that one of its features is bootstrapping start and manage system processes. For better understanding we are going to create a custom systemd service to make it easy to start, stop, restart our script as well as configure it to start at boot. And we make non-root users able to use these facilities.

1. Create a systemd service

Suppose that we have a script in /usr/bin/myscript.sh Also suppose that there is a Linux user named myuser in group ourgroup Now this is the main part of the story in which we make a file in /etc/systemd/system/myservice.service including below directives:

[Unit]
Description=Run myscript service as user myuser
SyslogIdentifier=myscript

[Service]
Type=simple
User=myuser
Group=ourgroup
ExecStart=/bin/bash /usr/bin/myscript.sh
[Install]
WantedBy=multi-user.target

[Unit]

Description=Run myscript service as user myuser

SyslogIdentifier=myscript

[Service]

Type=simple

User=myuser

Group=ourgroup

ExecStart=/bin/bash /usr/bin/myscript.sh

[Install]

WantedBy=multi-user.target

I'm not going to make this tutorial a long story by describing about parts of .service file. So let's find out how we can make sense about its usability. Run this command to make your myscipt.service loaded into systemd:

$sudo systemctl daemon-reload

1	$sudo systemctl daemon-reload

Now as a sudoer user you are able to manage myscipt.service using systemctl commands:

$sudo systemctl status myservice
$sudo systemctl start myservice
$sudo systemctl stop myservice

$sudo systemctl status myservice

$sudo systemctl start myservice

$sudo systemctl stop myservice

But how we make it possible for not-root users to use these facilities?!

2. Use PolicyKit to allow non-root users to mange the service

PolicyKit is an application-level toolkit for defining and handling the policy. As a practical step here we create a new file in /etc/polkit-1/rules.d/99-ourgroup.rules including:

polkit.addRule(function(action, subject) {
      if (action.id == "org.freedesktop.systemd1.manage-units" &&
        action.lookup("unit") == "myservice.service")  &&
        subject.isInGroup("ourgroup"))
        {
          return polkit.Result.YES;
        }
    })

polkit.addRule(function(action, subject) {

if (action.id == "org.freedesktop.systemd1.manage-units" &&

action.lookup("unit") == "myservice.service") &&

subject.isInGroup("ourgroup"))

{

return polkit.Result.YES;

}

})

3. Define needed sudoer access using visudo

Linux and Unix administrators use sudoers file to allocate system rights to system users. This allows the administrator to control who does what. Visudo command is a secure and safe way of editing the /etc/sudoers file on Linux. So just run $sudo visudo command and add below lines into sudoers file:

    %ourgroup ALL= NOPASSWD: /usr/bin/systemctl restart myservice.service
    %ourgroup ALL= NOPASSWD: /usr/bin/systemctl stop myservice.service
    %ourgroup ALL= NOPASSWD: /usr/bin/systemctl start myservice.service
    %ourgroup ALL= NOPASSWD: /usr/bin/systemctl status myservice.servicee

%ourgroup ALL= NOPASSWD: /usr/bin/systemctl restart myservice.service

%ourgroup ALL= NOPASSWD: /usr/bin/systemctl stop myservice.service

%ourgroup ALL= NOPASSWD: /usr/bin/systemctl start myservice.service

%ourgroup ALL= NOPASSWD: /usr/bin/systemctl status myservice.servicee

create a Linux systemd service and make it runable for non-root users
Home / linux / create a Linux systemd service and make it runable for non-root users

1. Create a systemd service

2. Use PolicyKit to allow non-root users to mange the service

3. Define needed sudoer access using visudo

Leave a Reply Cancel reply