Debian – systemd service management using pkla equivalents to polkit’s rules on Debian

debianpolkitsystemd

I'm trying to allow users of a somegroup to manage someunit systemd service.

In polkit (>=0.106), this can be done by adding rules:

/etc/polkit-1/rules.d/20-someunit.rules
---
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" 
        && subject.isInGroup("somegroup")
        && (action.lookup("unit") == "someunit.service") )
    {
        var verb = action.lookup("verb");
        if (verb == "start" || verb == "stop" || verb == "restart") {
            return polkit.Result.YES;
        }
    }
});

However, I'm on Debian stretch/buster where we have been on polkit 0.105 since 2012. polkit(<0.106) doesn't support the rules.d/* files. Instead, we rely on /etc/polkit-1/localauthority/50-local.d/*.pkla.

Following some examples in pklocalauthority(8), I'm able to get most of this working in an equivalent pkla file:

/etc/polkit-1/localauthority/50-local.d/manage-units.pkla
----
[Allow users to manage services]
Identity=unix-group:somegroup
Action=org.freedesktop.systemd1.manage-units
ResultActive=yes

However, this grants access for ALL actions on ALL services. Is there an equivalent to permitting specific action.lookup() features?

I did try out systemctl enable and systemctl edit, of which both still failed (that's good). So action.lookup("verb") may not be required, but action.lookup("unit") is still quite important.

There are a lot of unanswered questions on this subject:

Best Answer

it's not possible. This feature was implemented for the .rules-variant only

https://github.com/systemd/systemd/pull/1159

Related Question