Running a systemd service as a user other than root!

Question

I created the following service, amos.service, and it needs to run as amos (member of the amos group)

[Unit]
Description=AMOS Service
After=network.target

[Service]
User=amos
Group=amos
Type=simple
WorkingDirectory=/usr/share/amos
ExecStart=/usr/share/amos/amos_service.sh start
ExecStop=/usr/share/amos/amos_service.sh stop
Restart=on-failure

[Install]
WantedBy=multi-user.target

all the permissions have been set on /usr/share/amos to amos:amos

the amos_service.sh is as follows:

#!/bin/bash

CUDIR=$(dirname "$0")
cd /usr/share/amos

start() {
  exec /usr/share/amos/run_amos.sh >> /var/log/amos.log 2>&1  
}

stop() {
  exec pkill java 
}

case $1 in
  start|stop) "$1" ;;
esac

cd "$CURDIR"

When I run the service initially without any modifications to the directories, meaning, belonging to root, and amos.service not having the User not Group parameter, everything runs great!

Once I change the directories permissions to amos:amos and add the amos.service User & Group, the serive won't work and I get the following : See attached image

What is the difference, if any, between the success and failure cases in terms of the messages logged to /var/log/amos.log ? — sourcejedi, May 04 '17 at 18:59
Also, this configuration is odd in that `/var/log` is owned by root. I think you want to use a directory `/var/log/amos/` which you create as owned by amos. — sourcejedi, May 04 '17 at 19:01
This `exec pkill java` is really bad! If you have any other service using Java, oh well... — Alexis Wilke, Nov 16 '20 at 01:36

ctx · Accepted Answer · 2017-05-04T21:01:49.943

15

Use systemd:

To show the problem use journalctl -xe after you started the service.

You don't need a bash script, put this in your service file:

ExecStart=/usr/share/amos/run_amos.sh

There is no need for ExecStop, systemd will stop all child processes. You can view the output with journalctl -u amos.service.

edited May 04 '17 at 21:01

answered May 04 '17 at 19:36

ctx

2,404
10
17

score 6 · Answer 2 · answered May 04 '17 at 19:40

6

I think you want forking instead of simple. Simple assumes your process doesn't exit, so when it does, it calls the process dead.

You probably want to remove the amos_service.sh script and put it's functionality into the amos.service.

answered May 04 '17 at 19:40

pileofrogs

240
1
8

1

Will make changes as suggested...was reading about it and saw your comment. Will log back results. – itprguy May 04 '17 at 20:44

score 2 · Answer 3 · edited Jun 14 '20 at 07:50

2

First find your config you want to change using the following command:

systemctl list-unit-files

Then change the specific config using the following command:

sudo systemctl edit --full tomcat9.service

This will open the file in the default text editor set in the EDITOR environment variable.

Now add the specific user and group user service section.

edited Jun 14 '20 at 07:50

Edward

2,364
3
16
26

answered Jun 14 '20 at 07:26

KayV

121
4

score 0 · Answer 4 · edited Mar 18 '21 at 10:41

0

Maybe authorize amos user to launch services thanks to the enable-linger option?

loginctl enable-linger amos

(cf. man loginctl, it seems to be mandatory)

edited Mar 18 '21 at 10:41

heilala

103
3

answered Jun 18 '20 at 17:52

Phil Mar

11

Running a systemd service as a user other than root!

4 Answers4

Linked