Start systemd service as a user, but run ExecStartPost as root

MQMan · 04-04-2017, 05:05 PM

Hi,

I'm using systemd on a CentOS 7 system to run a user based process. This is working perfectly.

However, I now need to add an additional step that runs after the main process start, but this has to run as root. Just adding the ExecStartPost entry fails with Permission Denied as this step is currently run as the same user as the main process.

How can I get this second step to run as root.

Cheers.

shwaybotx · 04-04-2017, 06:36 PM

Quote:

Originally Posted by MQMan

Permission Denied as this step is currently run as the same user as the main process.

I am very interested in this. I spent half my morning today trying to figure out the exact same thing. I finally figured out the best way to do what I was trying to do was use crontab. In other words, I gave up and went a different way. I'm still interested in the outcome, however.

sundialsvcs · 04-04-2017, 07:42 PM

Obviously, in the general sense, what you would be asking for here is privilege escalation. A non-root process wants to "run something as root." ("Well, don't they all ..."

)

One possibility is to create an entirely root-level sequence that, say, uses some kind of sudo -u userid trick to invoke a particular process under the auspices of a particular user. The owning sequence, however, is still understood to be "rootly," and it therefore could initiate the other processing.

I haven't thought this hare-brained idea completely through, o'course ...

MQMan · 04-04-2017, 11:15 PM

Quote:

Originally Posted by sundialsvcs

A non-root process wants to "run something as root."

Not quite. systemd *is* (or should be) running as root to fire off the user process. It's just that the ExecStartPost inherits the user attribute.

Another possibility would be if there's a way to "chain" another service off the user one, as a dependency, then that would work also.

Quote:

Originally Posted by sundialsvcs

One possibility is to create an entirely root-level sequence that, say, uses some kind of sudo -u userid trick to invoke a particular process under the auspices of a particular user.

I thought that's what's happening now. The systemd process runs as root and starts a process as a particular user. Plus, I also thought that it wasn't possible to use sudo under systemd. But I'm happy to be corrected.

Cheers.

ondoho · 04-05-2017, 02:34 AM

add the command to sudoers NOPASSWD?

jmgibson1981 · 04-05-2017, 12:10 PM

Create another service file and have it run after the user service?

Code:

After = your-user.service

MQMan · 04-05-2017, 02:03 PM

Quote:

Originally Posted by jmgibson1981

Create another service file and have it run after the user service?

Code:

After = your-user.service

Been playing with this all morning, together with lots of Google-fu, and just the After= on the 2nd service didn't do the trick, sorry.

But, the following does appear to do what I want:

On the original service, I added the following:

Code:

Before=2nd.service
Wants=2nd.service

And created that 2nd service with:

Code:

[Unit]
Description=Follow up script that needs to be root
PartOf=original.service

[Service]
Type=oneshot
ExecStart=/usr/local/bin/some.sh
RemainAfterExit=yes

Cheers.

mobusdorphin · 05-06-2019, 12:35 PM

Since this is the top result for my duckduckgo search for starting a process as a user, but execstart[pre|post] as root, I wanted to add this answer

From man 5 systemd.service

Code:

Table 1. Special executable prefixes

...

If the executable path is prefixed with "+" then the process is executed with full privileges. 
In this mode privilege restrictions configured with User=, Group=, CapabilityBoundingSet= or the 
various file system namespacing options (such as PrivateDevices=, PrivateTmp=) are not applied to the 
invoked command line (but still affect any other ExecStart=, ExecStop=, ... lines).

In summary

Code:

[Service]
ExecStartPre=+/usr/bin/privilegedprocess
ExecStart=/home/jamal/userprocess
ExecStartPost=+/usr/bin/anotherrootprocess

User=jamal
Group=jamal

This will start /home/user/userprocess as user jamal, but the ExecStartPre and ExecStartPost will run as root. This should be much simpler and cleaner than creating a subservice that is PartOf the main service.