systemd_service - Add the machine parameter (#82958)

[jimmy-lt]

Fixes #82958

systemctl's --machine option execute the operation in the context of a local user session or a local container.

This provides a failsafe way to run systemd on behalf of another user than setting the XDG_RUNTIME_DIR variable.

SUMMARY

When trying to run systemd as another user, the following is advised:

- name: Run a user service when XDG_RUNTIME_DIR is not set on remote login
  ansible.builtin.systemd_service:
    name: myservice
    state: started
    scope: user
  environment:
    XDG_RUNTIME_DIR: "/run/user/{{ myuid }}"

However, this may not always work and can fail in various ways, typically:

Failed to connect to bus: Operation not permitted

Since systemd 248, the --machine option is available to to open a connection to the session bus of a specific user.

ISSUE TYPE

• Feature Pull Request

ADDITIONAL INFORMATION

- name: Run from within a specific user session
  ansible.builtin.systemd_service:
    name: myservice
    state: started
    scope: user
    machine: myuser@.host

"invocation": {
    "module_args": {
        "daemon_reexec": false,
        "daemon_reload": false,
        "enabled": true,
        "force": null,
        "machine": "myuser@.host",
        "masked": null,
        "name": "myservice",
        "no_block": false,
        "scope": "user",
        "state": "started"
    }
}

[ansibot]

The test ansible-test sanity --test pep8 [explain] failed with 1 error:

lib/ansible/modules/systemd_service.py:88:161: E501: line too long (177 > 160 characters)

click here for bot help

[bcoca]

I would ask for tests but this seems to be very involved in setting up, I would at least add more verification to the parameter passed.

[chschenk]

Hi,
I really would love to see this implemented in ansible. @jimmy-lt are you still working on this PR?
Is there anything I can do to move this PR forward?

[ansibot]

@jimmy-lt All commits must have verified signatures.

Please see this Ansible Forum post for more information.

click here for bot help

[pkingstonxyz]

Looks good to me, but I'm torn on the issue of tests. I agree with @bcoca that this seems too convoluted to fully exercise in the integration test suite, but I don't think it's impossible to add something. The diff I pasted with the basic "current user+localhost" case would at least provide a smoke test if machine gets removed from a systemd version/is incompatible with the oldest supported target.

Something like v would do the trick without much overhead, I think.

@@ -112,11 +112,27 @@
     enabled: true
   register: systemd_enable_ssh_2
 
+- name: Disable ssh 2 with machine
+  systemd:
+    name: '{{ ssh_service }}'
+    enabled: false
+    machine: "@.host"
+  register: systemd_disable_ssh_2_machine
+
+- name: Enable ssh 2 with machine
+  systemd:
+    name: '{{ ssh_service }}'
+    enabled: true
+    machine: "@.host"
+  register: systemd_enable_ssh_2_machine
+
 - assert:
     that:
       - systemd_disable_ssh_2 is not changed
       - systemd_enable_ssh_1 is changed
       - systemd_enable_ssh_2 is not changed
+      - systemd_disable_ssh_2_machine is changed
+      - systemd_enable_ssh_2_machine is changed
 
 - import_tasks: test_unit_template.yml
 - import_tasks: test_indirect_service.yml

[jimmy-lt]

@pkingstonxyz

I've added the tests but for them to pass, dbus-broker must be part of the test containers. As such, I created the pull request distro-test-containers/#137.