Splunk Enterprise

Using polkit allows for stopping/starting other systemd services

amartin6
Path Finder

We upgraded to 8.1.2 and want to use workload manager, workload manager requires systemd.  With 8.1.x you can allow the splunk user to stop/start the systemd splunk service, which works fine however it seems to be to broad of a configuration and also allows for stopping/starting other systemd services as well.  Is there a way to lock down the polkit rule where it doesn't grant beyond the splunk service?  I'll do more research on polkit to see if I can find a way but wondering if others have done this.

 

sh-4.2$ sudo /apps/splunk/bin/splunk enable boot-start -systemd-managed 1 -create-polkit-rules 1 -user splunk
CAUTION: The system has systemd version < 237 and polkit version > 105. With this combination, polkit rule created for this user will enable this user to manage all systemd services.Are you sure you want to continue [y/n]? y
Systemd unit file installed at /etc/systemd/system/Splunkd.service.
Polkit rules file installed at /etc/polkit-1/rules.d/10-Splunkd.rules.
Configured as systemd managed service.

sh-4.2$ sudo su - splunk

splunk@qasshd$ systemctl stop amazon-ssm-agent.service
splunk@qasshd$ systemctl status amazon-ssm-agent.service
● amazon-ssm-agent.service - amazon-ssm-agent
Loaded: loaded (/etc/systemd/system/amazon-ssm-agent.service; enabled; vendor preset: disabled)
Active: inactive (dead) since Wed 2021-02-10 22:19:39 UTC; 7s ago
Process: 1130 ExecStart=/usr/bin/amazon-ssm-agent (code=exited, status=0/SUCCESS)
Main PID: 1130 (code=exited, status=0/SUCCESS)
splunk@qasshd$ systemctl start amazon-ssm-agent.service
splunk@qasshd$ systemctl status amazon-ssm-agent.service
● amazon-ssm-agent.service - amazon-ssm-agent
Loaded: loaded (/etc/systemd/system/amazon-ssm-agent.service; enabled; vendor preset: disabled)
Active: active (running) since Wed 2021-02-10 22:19:55 UTC; 3s ago
Main PID: 5087 (amazon-ssm-agen)
Memory: 30.6M
CGroup: /system.slice/amazon-ssm-agent.service
├─5087 /usr/bin/amazon-ssm-agent
└─5101 /usr/bin/ssm-agent-worker
splunk@qasshd$

This is our rules file:

/etc/polkit-1/rules.d/10-Splunkd.rules
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
subject.user == "splunk")
{
return polkit.Result.YES;
}
});

Labels (1)
Tags (2)
0 Karma

svarkhede
Splunk Employee
Splunk Employee

If systemd version is greater than 236 and polkit version is greater than 0.105 then user has access to only Splunk service managed by systemd else it gives access to all the services managed by systemd.

https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/RunSplunkassystemdservice#:~:text=file%20na...

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Yes, they do.  Because RHEL7's systemd and polkit are just OLD and the features you need really aren't there.  See https://www.duanewaddle.com/splunk-7-2-2-and-systemd/

0 Karma

amartin6
Path Finder

Correct, the older version of polkit is what we discovered

0 Karma

amartin6
Path Finder

splunk@qasshd$ rpm -qa systemd
systemd-219-78.el7_9.2.x86_64

0 Karma

amartin6
Path Finder

splunk@qasshd$ rpm -qa polkit
polkit-0.112-26.el7.x86_64
splunk@qasshd$

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...