this post was submitted on 13 Apr 2024
230 points (84.8% liked)
linuxmemes
20437 readers
1412 users here now
I use Arch btw
Sister communities:
- LemmyMemes: Memes
- LemmyShitpost: Anything and everything goes.
- RISA: Star Trek memes and shitposts
Community rules
- Follow the site-wide rules and code of conduct
- Be civil
- Post Linux-related content
- No recent reposts
Please report posts and comments that break these rules!
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
What if multiple users have to manage that service?
Edit: nvrmnd, pretty sure the runnit solution won't allow this either, your answer is correct. What about while the service is already running? Wouldn't your solution require a restart?
If the service is already running it has to be stopped as a system service and run as a user service. In order to ensure that the service inherits all the correct permissions / acls / se linux policies the service needs to be launched from the limited permissions context.
With the systemd approach you’re not just passing a control handle around. You’re ensuring the process is running under an appropriate security context.
If you want to let multiple users manage the user systems service, I would probably go with sudo and systemd user files. You could create a group which has sudo access etc. The important idea is that an unprivileged user controls an unprivileged service.
What about this makes it "the systemd approach"? runit supports user services too. These are just two different tasks that are needed in different contexts. Sometimes what you need is to "pass a control handle around" to a privileged service. And sometimes you need to actually make a service unprivileged.
I'm no expert, but I think you could make a special group, set the
supervise
directory to be owned by that group, and add all relevant users to that group? Either way, as I explained in a different reply, running the service as a user vs letting that user control a root service are completely different things, and one is not always a substitute for the other.A generic stack overflow answer:
Do you REALLY need multiple users to manage that service? Maybe it's better to have multiple instances of that service and.... (This goes on and on)