0

I would like to allow every linux user to see the status of all systemd services.

I created these lines for the /etc/sudoers file:

ALL     ALL = NOPASSWD: /usr/bin/systemctl is-active *
ALL     ALL = NOPASSWD: /usr/bin/systemctl is-enabled *
ALL     ALL = NOPASSWD: /usr/bin/systemctl status *

Are there any security risks which I might not see at the moment?

The fact that every linux use can see the status of all services is not a security risk in my case.

Drifter104
  • 3,693
  • 2
  • 22
  • 39
guettli
  • 3,113
  • 14
  • 59
  • 110
  • 2
    Why sudo in the first place? systemctl can be run by any user, no root necessary. root access is only necessary for start/stop. – Gerald Schneider May 30 '18 at 09:30
  • @GeraldSchneider thank you very much for this hint. If you write your comment as answer, then I will upvote and accept it. – guettli May 30 '18 at 14:14

2 Answers2

3

You're doing this wrong. You should set the policies using polkit, as systemctl binary itself asks the system if user is allowed to perform an operation. E.g.

/etc/polkit-1/rules.d/50-default.rules:

polkit.addAdminRule(function(action, subject) {
    return ["unix-group:wheel"]; });

means that any user from the wheel group can do anything (including service stop/start). There are more extensive examples, questions and the code itself.

Tomasz Pala
  • 398
  • 1
  • 6
1

it's safe, as long as you are running a recent version of sudo, env_reset is enabled and the usual caveats

Luca Gibelli
  • 2,611
  • 1
  • 21
  • 29