SELinux System Administration Third Edition by Sven Vermeulen

Author:Sven Vermeulen
Language: eng
Format: mobi, epub
Publisher: Packt Publishing Ltd
Published: 2020-11-03T16:00:00+00:00

Using transient services

systemd can also be used to launch applications as if they are services and have them under systemd's control. Such applications are called transient services as they lack the unit files that generally declare how systemd should behave.

Transient services are launched through the systemd-run application. To show this, let's create a simple Python script (one that calculates Pi up to 10,000 digits):

from decimal import Decimal, getcontext

getcontext().prec=10000

with open('/tmp/pi.out', 'w') as f:

print(sum(1/Decimal(16)**k * (

Decimal(4)/(8*k+1)-

Decimal(2)/(8*k+4)-

Decimal(1)/(8*k+5)-

Decimal(1)/(8*k+6)) for k in range(10000)), file=f)

As this takes some time, we can opt to run this Python script under systemd's control:

# systemd-run python3.6 /tmp/pi.py

Running as unit: run-rf9ce45c...f343.service

As transient services do not have unit files to manage, changing the SELinux context must be accomplished through the command line as well. Of course, this is only needed if the standard domain transitions defined in the policy do not result in the wanted behavior:

# systemd-run -p SELinuxContext=guest_u:guest_r:guest_t:s0 python3.6 /tmp/pi.py

The systemd-run application supports this through the --property (or -p) option, through which unit file properties can be added. In the previous example, we use this option to run the script in the guest_t domain using the SELinuxContext property, similar to how we would define this in the unit file itself.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.