4 ms·

Loginctl/per-user systemds are for managing interactive sessions. System services with User= is exactly the way you'd go for isolating background daemons.

• ptx 3y ago
  What if you want to let a non-root user manage the systemd unit for a particular service? Is there a better way than per-user systemd instances?
  • chuckadams 3y ago
    chgrp, setfacl, sudo.conf ... lots of choices.
  • acdha 3y ago
    Check example 3.4 here for a polkit policy allowing an arbitrary user to restart a single unit: https://wiki.archlinux.org/title/Polkit https://wiki.archlinux.org/title/Polkit
    • twic 3y ago
      Does this let them modify the unit file, create units, create timers, etc? User systemd allows that kind of complete self-service, and so lets you do application deployment and management without touching the root account, which is rather nice.
      • BenjiWiebe 3y ago
        If they can edit a service that runs with more privileges than they have, that's a privilege escalation vulnerability. Polkit lets a non-root user restart a root/privileged service without letting the non-root user gain privileges.