Ygtjki

L1 and Ln cache: when are they written?

"Spoil" vs "Ruin"

Added a new user on Ubuntu, set password not working?

What if a revenant (monster) gains fire resistance?

dpdt switch to spst switch

How do I color the graph in datavisualization?

Open a doc from terminal, but not by its name

How do you respond to a colleague from another team when they're wrongly expecting that you'll help them?

What is Cash Advance APR?

Is it possible to have a strip of cold climate in the middle of a planet?

Why did the EU agree to delay the Brexit deadline?

Count the occurrence of each unique word in the file

Why does the Sun have different day lengths, but not the gas giants?

Why is it that I can sometimes guess the next note?

Travelling outside the UK without a passport

How can I block email signup overlays or javascript popups in Safari?

Why electric field inside a cavity of a non-conducting sphere not zero?

Delivering sarcasm

What should you do when eye contact makes your subordinate uncomfortable?

Symbol used to indicate indivisibility

If a character has darkvision, can they see through an area of nonmagical darkness filled with lightly obscuring gas?

Can I sign legal documents with a smiley face?

Does an advisor owe his/her student anything? Will an advisor keep a PhD student only out of pity?

How can Trident be so inexpensive? Will it orbit Triton or just do a (slow) flyby?

systemd service management using pkla equivalents to polkit's rules on Debian

2

I'm trying to allow users of a somegroup to manage someunit systemd service.

In polkit (>=0.106), this can be done by adding rules:

/etc/polkit-1/rules.d/20-someunit.rules
---
polkit.addRule(function(action, subject) 
 if (action.id == "org.freedesktop.systemd1.manage-units" 
 && subject.isInGroup("somegroup")
 && (action.lookup("unit") == "someunit.service") )
 verb == "restart") 
 return polkit.Result.YES;
 
 
);

However, I'm on Debian stretch/buster where we have been on polkit 0.105 since 2012. polkit(<0.106) doesn't support the rules.d/* files. Instead, we rely on /etc/polkit-1/localauthority/50-local.d/*.pkla.

Following some examples in pklocalauthority(8), I'm able to get most of this working in an equivalent pkla file:

/etc/polkit-1/localauthority/50-local.d/manage-units.pkla
----
[Allow users to manage services]
Identity=unix-group:somegroup
Action=org.freedesktop.systemd1.manage-units
ResultActive=yes

However, this grants access for ALL actions on ALL services. Is there an equivalent to permitting specific action.lookup() features?

I did try out systemctl enable and systemctl edit, of which both still failed (that's good). So action.lookup("verb") may not be required, but action.lookup("unit") is still quite important.

There are a lot of unanswered questions on this subject:

• https://askubuntu.com/questions/536591


• https://askubuntu.com/questions/875522


• polkit rule is not working

debian systemd polkit

share|improve this question

edited yesterday

Stewart

asked yesterday

StewartStewart

228110

add a comment | 

2

I'm trying to allow users of a somegroup to manage someunit systemd service.

In polkit (>=0.106), this can be done by adding rules:

/etc/polkit-1/rules.d/20-someunit.rules
---
polkit.addRule(function(action, subject) 
 if (action.id == "org.freedesktop.systemd1.manage-units" 
 && subject.isInGroup("somegroup")
 && (action.lookup("unit") == "someunit.service") )
 verb == "restart") 
 return polkit.Result.YES;
 
 
);

However, I'm on Debian stretch/buster where we have been on polkit 0.105 since 2012. polkit(<0.106) doesn't support the rules.d/* files. Instead, we rely on /etc/polkit-1/localauthority/50-local.d/*.pkla.

Following some examples in pklocalauthority(8), I'm able to get most of this working in an equivalent pkla file:

/etc/polkit-1/localauthority/50-local.d/manage-units.pkla
----
[Allow users to manage services]
Identity=unix-group:somegroup
Action=org.freedesktop.systemd1.manage-units
ResultActive=yes

However, this grants access for ALL actions on ALL services. Is there an equivalent to permitting specific action.lookup() features?

I did try out systemctl enable and systemctl edit, of which both still failed (that's good). So action.lookup("verb") may not be required, but action.lookup("unit") is still quite important.

There are a lot of unanswered questions on this subject:

• https://askubuntu.com/questions/536591


• https://askubuntu.com/questions/875522


• polkit rule is not working

debian systemd polkit

share|improve this question

edited yesterday

Stewart

asked yesterday

StewartStewart

228110

add a comment | 

I'm trying to allow users of a somegroup to manage someunit systemd service.

In polkit (>=0.106), this can be done by adding rules:

/etc/polkit-1/rules.d/20-someunit.rules
---
polkit.addRule(function(action, subject) 
 if (action.id == "org.freedesktop.systemd1.manage-units" 
 && subject.isInGroup("somegroup")
 && (action.lookup("unit") == "someunit.service") )
 verb == "restart") 
 return polkit.Result.YES;
 
 
);

However, I'm on Debian stretch/buster where we have been on polkit 0.105 since 2012. polkit(<0.106) doesn't support the rules.d/* files. Instead, we rely on /etc/polkit-1/localauthority/50-local.d/*.pkla.

Following some examples in pklocalauthority(8), I'm able to get most of this working in an equivalent pkla file:

/etc/polkit-1/localauthority/50-local.d/manage-units.pkla
----
[Allow users to manage services]
Identity=unix-group:somegroup
Action=org.freedesktop.systemd1.manage-units
ResultActive=yes

However, this grants access for ALL actions on ALL services. Is there an equivalent to permitting specific action.lookup() features?

I did try out systemctl enable and systemctl edit, of which both still failed (that's good). So action.lookup("verb") may not be required, but action.lookup("unit") is still quite important.

There are a lot of unanswered questions on this subject:

• https://askubuntu.com/questions/536591


• https://askubuntu.com/questions/875522


• polkit rule is not working

debian systemd polkit

share|improve this question

edited yesterday

Stewart

asked yesterday

StewartStewart

228110

/etc/polkit-1/rules.d/20-someunit.rules
---
polkit.addRule(function(action, subject) 
 if (action.id == "org.freedesktop.systemd1.manage-units" 
 && subject.isInGroup("somegroup")
 && (action.lookup("unit") == "someunit.service") )
 verb == "restart") 
 return polkit.Result.YES;
 
 
);

/etc/polkit-1/localauthority/50-local.d/manage-units.pkla
----
[Allow users to manage services]
Identity=unix-group:somegroup
Action=org.freedesktop.systemd1.manage-units
ResultActive=yes

share|improve this question

edited yesterday

Stewart

asked yesterday

StewartStewart

228110

share|improve this question

edited yesterday

Stewart

asked yesterday

StewartStewart

228110

asked yesterday

StewartStewart

228110

asked yesterday

StewartStewart

228110