- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Using polkit allows for stopping/starting other systemd services
![amartin6 amartin6](https://community.splunk.com/legacyfs/online/avatars/564065.jpg)
We upgraded to 8.1.2 and want to use workload manager, workload manager requires systemd. With 8.1.x you can allow the splunk user to stop/start the systemd splunk service, which works fine however it seems to be to broad of a configuration and also allows for stopping/starting other systemd services as well. Is there a way to lock down the polkit rule where it doesn't grant beyond the splunk service? I'll do more research on polkit to see if I can find a way but wondering if others have done this.
sh-4.2$ sudo /apps/splunk/bin/splunk enable boot-start -systemd-managed 1 -create-polkit-rules 1 -user splunk
CAUTION: The system has systemd version < 237 and polkit version > 105. With this combination, polkit rule created for this user will enable this user to manage all systemd services.Are you sure you want to continue [y/n]? y
Systemd unit file installed at /etc/systemd/system/Splunkd.service.
Polkit rules file installed at /etc/polkit-1/rules.d/10-Splunkd.rules.
Configured as systemd managed service.
sh-4.2$ sudo su - splunk
splunk@qasshd$ systemctl stop amazon-ssm-agent.service
splunk@qasshd$ systemctl status amazon-ssm-agent.service
● amazon-ssm-agent.service - amazon-ssm-agent
Loaded: loaded (/etc/systemd/system/amazon-ssm-agent.service; enabled; vendor preset: disabled)
Active: inactive (dead) since Wed 2021-02-10 22:19:39 UTC; 7s ago
Process: 1130 ExecStart=/usr/bin/amazon-ssm-agent (code=exited, status=0/SUCCESS)
Main PID: 1130 (code=exited, status=0/SUCCESS)
splunk@qasshd$ systemctl start amazon-ssm-agent.service
splunk@qasshd$ systemctl status amazon-ssm-agent.service
● amazon-ssm-agent.service - amazon-ssm-agent
Loaded: loaded (/etc/systemd/system/amazon-ssm-agent.service; enabled; vendor preset: disabled)
Active: active (running) since Wed 2021-02-10 22:19:55 UTC; 3s ago
Main PID: 5087 (amazon-ssm-agen)
Memory: 30.6M
CGroup: /system.slice/amazon-ssm-agent.service
├─5087 /usr/bin/amazon-ssm-agent
└─5101 /usr/bin/ssm-agent-worker
splunk@qasshd$
This is our rules file:
/etc/polkit-1/rules.d/10-Splunkd.rules
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
subject.user == "splunk")
{
return polkit.Result.YES;
}
});
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![Splunk Employee Splunk Employee](/html/@F88B7774A2BF2E9108D79A067A92A581/rank_icons/employee-16.png)
If systemd version is greater than 236 and polkit version is greater than 0.105 then user has access to only Splunk service managed by systemd else it gives access to all the services managed by systemd.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![dwaddle dwaddle](https://community.splunk.com/legacyfs/online/avatars/403.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Yes, they do. Because RHEL7's systemd and polkit are just OLD and the features you need really aren't there. See https://www.duanewaddle.com/splunk-7-2-2-and-systemd/
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![amartin6 amartin6](https://community.splunk.com/legacyfs/online/avatars/564065.jpg)
Correct, the older version of polkit is what we discovered
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![amartin6 amartin6](https://community.splunk.com/legacyfs/online/avatars/564065.jpg)
splunk@qasshd$ rpm -qa systemd
systemd-219-78.el7_9.2.x86_64
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![amartin6 amartin6](https://community.splunk.com/legacyfs/online/avatars/564065.jpg)
splunk@qasshd$ rpm -qa polkit
polkit-0.112-26.el7.x86_64
splunk@qasshd$
![](/skins/images/89D5ADE867CBAF0B5A525B7E23D83D7E/responsive_peak/images/icon_anonymous_message.png)