I'm just starting to explore systemd init scripts after upgrading to Ubuntu 16.04LTS. What should the ownership and file permissions be on my .service files?
It currently is by default:
-rw-rw-r-- 1 me me 225 Dec 20 21:57 my.service
After symbolically linking to the systemd directory, it looks like other files are just completely open (777), even mine:
lrwxrwxrwx 1 root root 40 Dec 20 21:31 dbus-org.freedesktop.Avahi.service -> /lib/systemd/system/avahi-daemon.service
Think of systemd units as config files, not scripts. They are not run by the kernel, do not have the #! shebang line, and therefore do not need to be executable. (In fact if you do make them executable, systemd will print a warning to system logs.)
Yes, there's no point in hiding the contents (which can be retrieved via systemctl anyway). Again, systemd will warn about useless attempts to make the units non-public.
Only if the user is fully trusted (i.e. a system administrator). Think about what they could achieve: they could put arbitrary commands in the unit file, reboot the system, and those commands would be run with full root privileges.
So if an untrusted user could write to system .service files, they could become root very quickly.
They are system configuration files, located in /etc, so root would be the natural choice. (It doesn't matter that much – but do see the previous section about writability.)
They aren't. Your example is a symlink, not a file. Symlinks do not have their own permissions at all – the system always returns the same dummy value, but never uses it for anything. (By the way, rwx rwx rwx is 0777, not 0755.)
If you look at all regular files in /etc/systemd/system or /usr/lib/systemd/system, you'll see that nearly all of them have permissions 0644 (rw- r-- r--).
