Arch Linux

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 341

[SOLVED] Make systemctl to fail instead of asking for authentication

Is it possible to prevent systemctl from asking for authentication if operation requies root permissions? For example, current behavior:

[dimich@dimich ~]$ systemctl stop cups
==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ====
Authentication is required to stop 'cups.service'.
Authenticating as: root
Password: 

I would like systemctl just to fail with some error message and non-zero exit status.

Last edited by dimich (2025-03-25 22:42:32)

saf1

Member

Registered: 2011-04-04

Posts: 27

Re: [SOLVED] Make systemctl to fail instead of asking for authentication

       --no-ask-password
           Do not query the user for authentication for privileged operations.

read the

man systemctl

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 341

Re: [SOLVED] Make systemctl to fail instead of asking for authentication

       --no-ask-password
           Do not query the user for authentication for privileged operations.

Thank you for the answer. Sorry, I didn't specify that I want it without additional command line options. Of course, it is possible to make shell alias like systemctl='systemctl --no-ask-password'. However, I though it should be some PAM or D-Bus related global option.

schard

Forum Moderator

From: Hannover

Registered: 2016-05-06

Posts: 2,213

Website

Re: [SOLVED] Make systemctl to fail instead of asking for authentication

It appears that there's no configuration option for this, just the command line parameter.
You could modify the source and recompile systemd.

---

Inofficial first vice president of the Rust Evangelism Strike Force

saf1

Member

Registered: 2011-04-04

Posts: 27

Re: [SOLVED] Make systemctl to fail instead of asking for authentication

Thank you for the answer. Sorry, I didn't specify that I want it without additional command line options. Of course, it is possible to make shell alias like systemctl='systemctl --no-ask-password'. However, I though it should be some PAM or D-Bus related global option.

ok, I see that’s a bit beyond what I know. maybe someone else can help. good luck.

Last edited by saf1 (2025-03-25 21:44:23)

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 341

Re: [SOLVED] Make systemctl to fail instead of asking for authentication

Managed to get desired behavior with polkit rule. I created /etc/polkit-1/rules.d/10-no-user-systemctl.rules:

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" ||
        action.id == "org.freedesktop.systemd1.manage-unit-files" ||
        action.id == "org.freedesktop.systemd1.set-environment" ||
        action.id == "org.freedesktop.systemd1.reload-daemon" ||
        action.id == "org.freedesktop.systemd1.bypass-dump-ratelimit")
    {
        return polkit.Result.NO;
    }
});

Not sure if it doesn't break something else but it works:

[dimich@dimich ~]$ systemctl stop cups
Failed to stop cups.service: Access denied
See system logs and 'systemctl status cups.service' for details.

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 341

Re: [SOLVED] Make systemctl to fail instead of asking for authentication

You could modify the source and recompile systemd.

Yep, sources modification is always a working solution but last resort.
Thanks for suggestion to take a look into sources, from there I figured out that it uses polkit, not PAM.

Lone_Wolf

Administrator

From: Netherlands, Europe

Registered: 2005-10-04

Posts: 13,469

Re: [SOLVED] Make systemctl to fail instead of asking for authentication

Not sure if it doesn't break something else

You have tested root can still use those commands ?
(If you use the wheel or sudo group you should also test that).

---

Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.

clean chroot building not flexible enough ?
Try clean chroot manager by graysky

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 341

Re: [SOLVED] Make systemctl to fail instead of asking for authentication

You have tested root can still use those commands ?

Sure, systemctl managing commands work fine with sudo. As far as I know, polkit is involved for unprivileged users only.

Last edited by dimich (2025-03-26 14:05:55)