If the service is already running it has to be stopped as a system service and run as a user service. In order to ensure that the service inherits all the correct permissions / acls / se linux policies the service needs to be launched from the limited permissions context.
With the systemd approach you’re not just passing a control handle around. You’re ensuring the process is running under an appropriate security context.
If you want to let multiple users manage the user systems service, I would probably go with sudo and systemd user files. You could create a group which has sudo access etc. The important idea is that an unprivileged user controls an unprivileged service.
What about this makes it “the systemd approach”? runit supports user services too. These are just two different tasks that are needed in different contexts. Sometimes what you need is to “pass a control handle around” to a privileged service. And sometimes you need to actually make a service unprivileged.
If the service is already running it has to be stopped as a system service and run as a user service. In order to ensure that the service inherits all the correct permissions / acls / se linux policies the service needs to be launched from the limited permissions context.
With the systemd approach you’re not just passing a control handle around. You’re ensuring the process is running under an appropriate security context.
If you want to let multiple users manage the user systems service, I would probably go with sudo and systemd user files. You could create a group which has sudo access etc. The important idea is that an unprivileged user controls an unprivileged service.
What about this makes it “the systemd approach”? runit supports user services too. These are just two different tasks that are needed in different contexts. Sometimes what you need is to “pass a control handle around” to a privileged service. And sometimes you need to actually make a service unprivileged.