systemd: Grant an unprivileged user permission to alter one specific service

Solution 1:

I can think of two ways to do this:

---

One is by making the service a user service rather than a system service.

Instead of creating a system unit, the systemd unit will be placed under the service user's home directory, at $HOME/.config/systemd/user/daemon-name.service. The same user can then manage the service with systemctl --user <action> daemon-name.service.

To allow the user unit to start at boot, root must enable linger for the account, i.e. sudo loginctl enable-linger username. The unit must also be WantedBy=default.target.

---

The other way is by allowing the user access to manage the system unit via PolicyKit. This requires systemd 226 or higher (and PolicyKit >= 0.106 for the JavaScript rules.d files – check with pkaction --version). Note that Debian has deliberately held back PolicyKit to a nearly decade old version 0.105 which does not support this functionality, apparently because of one person's personal opinion, and neither it nor distributions derived from it (like Ubuntu) can use this method.

You would create a new PolicyKit configuration file, e.g. /etc/polkit-1/rules.d/57-manage-daemon-name.rules which checks for the attributes you want to permit. For example:

// Allow alice to manage example.service;
// fall back to implicit authorization otherwise.
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" &&
        action.lookup("unit") == "example.service" &&
        subject.user == "alice") {
        return polkit.Result.YES;
    }
});

The named user can then manage the named service with systemctl and without using sudo.

Solution 2:

sudo is made for that. Edit your /etc/sudoers file with visudo to add a Cmd_alias for the commands you want the unprivileged user to be able to use:

# game server commands
Cmnd_Alias GAME_CMDS = /usr/bin/systemctl start <game service>, /usr/bin/systemctl stop <game service>

and add a line to allow the unprivileged user to use the commands defined with the alias like this:

unprivileged_user ALL=(ALL) NOPASSWD: GAME_CMDS

Read some more documentation on the topic for the various parameters of sudo command.

You may need to install sudo package to have sudo available on your system.