[systemd-devel] Unprivileged poweroff

2014-09-10 Thread Michal Witanowski
Hi, I was wondering if there is a possibility to call "systemctl poweroff" as non-root user in this scenario: 1.I have no PolicyKit on my system, so I get access denied. 2. Calling with "-f" parameter also fails, with "Must be root" error. 3. I'd like to avoid using "sudo".

Re: [systemd-devel] Shutdown notify

2014-08-20 Thread Michal Witanowski
sers group? Note that I do NOT have PolicyKit in the system... BR, Michal -Original Message- From: Lennart Poettering [mailto:lenn...@poettering.net] Sent: Tuesday, August 19, 2014 1:40 PM To: Michal Witanowski Cc: systemd-devel@lists.freedesktop.org Subject: Re: [systemd-devel] Shutdown

Re: [systemd-devel] Shutdown notify

2014-08-19 Thread Michal Witanowski
What if I'm using systemd built without logind? -Original Message- From: Lennart Poettering [mailto:lenn...@poettering.net] Sent: Tuesday, August 19, 2014 1:40 PM To: Michal Witanowski Cc: systemd-devel@lists.freedesktop.org Subject: Re: [systemd-devel] Shutdown notify On Tue, 19.

[systemd-devel] Shutdown notify

2014-08-19 Thread Michal Witanowski
Hi all, I would like to know if there is a possibility to get notified about upcoming shutdown/restart. For example: . Somebody executes "systemctl reboot" / "systemctl poweroff" . A callback function is called in my service before SIGTERM is triggered on ANY service. .

Re: [systemd-devel] Running a systemd service in capability-only environment as non-root user

2014-05-28 Thread Michal Witanowski
On 05/28/2014 01:52 PM, Mantas Mikulėnas wrote: Not sure what security hole you see here. If the executable owns cap_foo=ei (*not* cap_foo=eip), then running it will not grant any capabilities unless its process (or the parent process) explicitly adds them to the inheritable set... And that's t

Re: [systemd-devel] Running a systemd service in capability-only environment as non-root user

2014-05-28 Thread Michal Witanowski
On 05/28/2014 12:07 AM, Serge Hallyn wrote: Quoting Mantas Mikulėnas (graw...@gmail.com): On Tue, May 27, 2014 at 4:31 PM, Michal Witanowski wrote: Hi, first of all I'd like to mark that I'm not sure if I'm writing in the right place. I have a problem with running a sys

[systemd-devel] Running a systemd service in capability-only environment as non-root user

2014-05-27 Thread Michal Witanowski
022 CapEff: 00010022 CapBnd: 00010022 It looks like the "SecureBits=keep-caps" option, which should preserve permissive caps after root drop according to [1], does not work. Am I doing something wrong? Any response would be very helpful. Best Regards, Mich