21 Nov
2022
21 Nov
'22
4:11 p.m.
Hi Folks,
I must conclude that I was not as attentive to "publishing dates" as I should
have been and that I was reading old posts, or posts from "helpful" idiots that
will gladly advise you to do the wrong thing -- they know a way, but don't know a good
way. It turns out, as I should have known all along, that there is a very simple way to
delegate various authorities to control various systemd services to non-root users .
Since I'm playing with "apache" owned files, in group "root", and
I can't log in as "apache" (well, I could, but I choose to make as few
"permanent" changes as I can possibly survive.), I develop as "www", a
member of the "apache" group.
Create or modify:
/etc/systemd/system/57-manage-daemon-name.rules
//
// Allow user "www" to restart various web development services
//
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units") {
if (subject.user == "www") {
if ((action.lookup("unit") == "httpd.service") ||
(action.lookup("unit") ==
"php-fpm.service")) {
var verb = action.lookup("verb");
if ((verb == "start") || (verb == "restart") || (verb ==
"stop")) {
return polkit.Result.YES;
}
}
}
}
});
After creation or modification, "systemctl restart polkit" followed by
"systemctl status polkit" you can determine if your new rule has been
"accepted", and if it has, then it magically works! It is not clear to me that
the qualification of "verb" is necessary, but I have it and it works, so
"If it ain't broke, don't fix it."
There are version restrictions on both polkit and systemd. Debian and Debian derivatives
(Ubuntu) are not current. Apparently you must have systemd version 226 or greater and
polkit 1.06 or greater. Fedora works in this regard.
And finally, this is apparently JavaScript, and JavaScript is finicky about format,
meaning continued lines must end with the opening brace, which is in conflict with my
religious preferences, but I am bound by their mandatory practices when I visit their
temple. This is actually not a JavaScript requirement, but a browser requirement, and as
the most prevalent and dominant use of JavaScript has become indistinguishable from
JavaScript requirements. So, I don't fight it ... Well, not in JavaScript.
--
Chris.
V:916.799.9461
F:916.974.0428
A: Because we read from top to bottom, left to right.
Q: > Why should I start my reply below the quoted text?