Configuring Systemd Service to run with root access

Question

I have a service in the form of a node.js application set up with Systemd on Raspbian Jessie and it is using its own user account. However, I am finding that the service does not run correctly because it does not have the necessary permissions. One of the node modules I installed requires root access. If I run the application manually with sudo everything works fine.

Is there a way to tell systemd to run the service with sudo?

How does your unit file looks like, add it to your question? Normally `systemd` runs the unit files with root rights. — Thomas, Oct 02 '16 at 11:57

score 52 · Accepted Answer · answered Oct 02 '16 at 12:00

52

tell systemd to run the service with sudo?

sudo has nothing to with it.

Typically you instruct systemd to run a service as a specific user/group with a User= and Group= directive in the [Service] section of the unit file.

Set those to root (or remove them, as running as root is the default).

answered Oct 02 '16 at 12:00

HBruijn

72,524
21
127
192

2

I had it set up to use a specific user as I was using a guide to configure it. However in my case this wasn't appropriate. I removed this to run as root by default and now everything works! – Luke Oct 03 '16 at 15:07
4

Running as root is not quite the same as running with `User=root`. See my answer. – Mark Stosberg May 01 '18 at 13:38
2

Where can this file be edited? – Matthew Nov 01 '18 at 13:53
https://serverfault.com/a/840999/37681 – HBruijn Nov 01 '18 at 14:41

score 36 · Answer 2 · answered May 01 '18 at 13:38

36

To clear, systemd system services run as root by default, but there is still a difference between the default behavior and running a system service with User=root.

As documented in Environment variables in spawned processes, these variables are only set if User= is set:

$USER, $LOGNAME, $HOME, $SHELL

I tested to confirm this finding. So if you want to run a systemd service as root that needs one of the above variables, you need to set User=root.

answered May 01 '18 at 13:38

Mark Stosberg

3,771
23
27

Thank you! That was the only thing that worked for me on an application that I have – Pedro Borges Mar 02 '19 at 17:55
3

NB if you set User=root you should probably also set Group=root :) https://superuser.com/a/1452367/39364 – rogerdpack Jun 24 '19 at 15:29

daino3 · Answer 3 · 2018-10-25T02:42:59.437

3

a temporary solution, but got it to work in a pinch:

/usr/bin/sudo /bin/bash -lc 'bundle exec rails server -e demo -p 80'

Can run with a user who has sudo privileges in a systemd unit file like so:

[Unit]
Description=Rails Webserver
After=syslog.target

[Service]
Type=simple
User=ubuntu
WorkingDirectory=/var/www/webserver
ExecStart=/usr/bin/sudo /bin/bash -lc 'bundle exec rails server -e demo -p 80'
Restart=always
KillSignal=SIGQUIT

[Install]
WantedBy=multi-user.target

edited Oct 25 '18 at 02:42

answered Oct 25 '18 at 02:34

daino3

199
1
6

This has multiple issues: First, the first two answers explain why using a user and then sudo is unnecessary, and show the right way to do it. Second, you shouldn't be running your webapp as root anyway. Third, your web app should be behind a normal web server such as nginx. – Michael Hampton Oct 25 '18 at 02:45
I won't disagree with you on any of your points. But if someone, like myself, wanted a bare-bones, as-fast-as-you-can standup of a server, this is a viable option that works. – daino3 Oct 25 '18 at 02:47
Almost as fast as you can. Obviously using `sudo` will slow down startup a bit. And it's unnecessary. – Michael Hampton Oct 25 '18 at 02:48
@MichaelHampton I'm trying to write a backdoor, so I've found this answer to be helpful! – Soutzikevich Dec 03 '19 at 22:48
@daino no, using sudo has no defence, It is not necessary. It IS run as root by default. – RichieHH Feb 21 '20 at 20:22

score 1 · Answer 4 · answered Oct 03 '16 at 12:16

1

Run it as a system user in this case by default the service is running as root.

answered Oct 03 '16 at 12:16

Umut

411
3
3

Configuring Systemd Service to run with root access

4 Answers4

Linked