Controlling Upstart job as unprivileged user

Question

What's the best way to allow an unprivileged user to control an upstart job?

By controlling an upstart job I mean starting/stopping/reloading/restarting it:

start myservice 

I can imagine one way to go about it is through sudo; what needs to be done to make this possible? Are there other/better ways?

NB: This question, while similarly named, is very different from Running upstart jobs as unprivileged users, as that one deals with the execution of the actual service instead of the controlling of the job.

Answer 1

In addition to what Tuminoid said, you can actually limit sudo to commands with concrete arguments:

Cmnd_Alias START_MYSQL = /sbin/start mysql
user ALL=(ALL) NOPASSWD: START_MYSQL

With the above two lines in sudoers (you can edit the suoders with visudo command), user account named user will be able to run without password:

$ sudo start mysql

sudo will not be available to the user for anything else, though, with or without password, unless there are other entries in sudoers list that permit it.

Answer 2

You certainly can control the jobs with sudo. You don't need anything special, just sudo start myservice etc. It is the preferred way if you have sudo rights.

Beyond that, you need some mapper running as root to convert your user privileged commands into root commands. I've once done this for a special purpose with a FIFO, that is writeable by user, read by an root privileged upstart script which then maps the commands into start, stop and so on. Certainly not a secure way to do it for a multi-user/production systems.