[systemd-devel] User service with suid executable

[Lennart Poettering]

On Fri, 08.01.16 13:49, Martin Novák (mtnvk at seznam.cz) wrote:

> On 01/08/2016 11:27 AM, Simon McVittie wrote:
> > On 07/01/16 23:14, Martin Novák wrote:
> >> I've created this (toy) user service for running desktop of differnt
> >> user
> >
> > I don't think a user service is an appropriate tool for this job. If you
> > have sudo privileges, you can use a system service, or perhaps even a
> > user service that runs as the other user.
> 
> Well, I have sudo privileges for the other user, not for root. Besides,
> the service executable could have been setuid for different user and not
> root. I think both are valid use cases. Imagine 2 developers working on
> a multiseat system wanting to share their programs for accessing some
> webservice without revealing their credentials. The other developer may
> want to use it from a systemd timer unit. Distasteful as it may be, it's
> the straightforward way to do the job and it's secure if used
> correctly.

You should be able to write a polkit policy that allows your user to
invoke the "start" operation on that specific unit. polkit receives
enough details from systemd so that you can express this, without
involving sudo or anything like that.

Lennart

-- 
Lennart Poettering, Red Hat