undefined | Better HN

0 pointstwic2y ago0 comments

Does this let them modify the unit file, create units, create timers, etc?

User systemd allows that kind of complete self-service, and so lets you do application deployment and management without touching the root account, which is rather nice.

0 comments

BenjiWiebe2y ago

If they can edit a service that runs with more privileges than they have, that's a privilege escalation vulnerability.

Polkit lets a non-root user restart a root/privileged service without letting the non-root user gain privileges.

j / k navigate · click thread line to collapse

0 pointstwic2y ago0 comments

Does this let them modify the unit file, create units, create timers, etc?

User systemd allows that kind of complete self-service, and so lets you do application deployment and management without touching the root account, which is rather nice.

0 comments

BenjiWiebe2y ago

If they can edit a service that runs with more privileges than they have, that's a privilege escalation vulnerability.

Polkit lets a non-root user restart a root/privileged service without letting the non-root user gain privileges.

j / k navigate · click thread line to collapse