Learn › Build and operate services › Give the service only the access it needs

Give the service only the access it needs

3. Give the service only the access it needs

The clock now needs a place to save its ticks. This fresh machine starts the original clock service as camp-clock, without a data directory.

A process needs permission to enter and write in the parent directory before it can create a file there. You will give the service account one private data directory, then check the effective account and both outputs of the new run.

The supplied clock accepts --output PATH. With that option, it keeps printing ticks to the journal and appends time-stamped ticks to PATH. You do not need to write or understand the program's code.

Inspect the account and place

The supplied service should be active, and /var/lib/camp-clock should be absent. Predict whether the current clock could create /var/lib/camp-clock/ticks.log before you give it a directory.

id camp-clock
systemctl status camp-clock.service --no-pager
cat /etc/systemd/system/camp-clock.service
ls -ld /var/lib/camp-clock

id shows the supplied account and its primary group. On this VM, both are named camp-clock. status should show Active: active (running). The unit should contain User=camp-clock and ExecStart=/usr/local/bin/camp-clock, without --output. With ls -ld, -d asks about the directory itself. It should report that the directory does not exist and return a nonzero exit status.

Give that account a private directory

The missing directory explains the next change. Create it and assign it to the service account and its supplied primary group:

sudo mkdir /var/lib/camp-clock
sudo chown camp-clock:camp-clock /var/lib/camp-clock
sudo chmod 700 /var/lib/camp-clock
ls -ld /var/lib/camp-clock

mkdir creates the directory. chown sets its owner and group to camp-clock. chmod 700 lets the owner enter, read and write there while giving other ordinary accounts no directory access. Root can still administer it. The final ls -ld should show camp-clock as owner and group, with permissions beginning drwx------. Do not change /var/lib or give unrelated accounts access.

The existing process still runs without an output path. Change only the saved unit's ExecStart= line to:

ExecStart=/usr/local/bin/camp-clock --output /var/lib/camp-clock/ticks.log

Open the unit with the editor from Lesson 1:

SUDO_EDITOR=nano sudoedit /etc/systemd/system/camp-clock.service

Save with Ctrl+O, Enter, then exit with Ctrl+X. Inspect the saved unit:

cat /etc/systemd/system/camp-clock.service

Check that User=camp-clock remains and ExecStart= points inside the private directory. Predict whether this edit can change the arguments of the process already running. A process keeps the arguments it started with. The manager must read the edited unit, then start a new run.

sudo systemctl daemon-reload
sudo systemctl restart camp-clock.service

daemon-reload reads the edited unit. restart starts a process from that revised unit.

Verify the account and the new file

systemctl status camp-clock.service --no-pager
sudo ls -l /var/lib/camp-clock/ticks.log
sudo tail -n 3 /var/lib/camp-clock/ticks.log
run_id=$(systemctl show -P InvocationID camp-clock.service)
sudo journalctl _SYSTEMD_UNIT=camp-clock.service _SYSTEMD_INVOCATION_ID="$run_id" -n 10 --no-pager

In status, find Active: active (running), its current since time and Main PID. Both file commands need sudo because the directory is private. ls -l should show the new file owned by camp-clock. The shell stores this run's ID in run_id; the journal command shows only clock messages labeled with that ID. Find a tick in the new file and a tick in that filtered journal. Look for a matching tick in both outputs.

For an independent account check, use the current Main PID from status in this command. Replace 1234 with that number:

ps -o euser,pid,comm -p 1234

ps inspects a process. -p selects its PID and -o chooses the displayed columns. EUSER shows the effective account used for ordinary file permission checks; it should be camp-clock. The unit's User= setting states an intention. The effective account, private directory permissions and fresh file and journal lines together show that this run uses the intended access and produces both outputs.

Explain why you chose this owner and directory, which change made the new argument take effect, and how you verified it. In a later service build, choose the account and data path from that VM's facts, then repeat the account, permission and fresh-output checks without copying the clock names.

References: systemd.exec, systemd.service, systemctl, chmod, chown, ps, journal fields, journalctl.

Practice Give the service only the access it needs in a real Linux terminal at The Linux Camp. Progress is verified automatically as you type commands on the machine.