I have a custom Systemd service (my.service) running a binary with unprivileged user serv.
I can watch logs for that service with journalctl -fu my.service as I am in the systemd-journal group.
Can I give permissions to user joe so that they can run journalctl -fu my.service without adding joe to systemd-journal?
Currently, if joe runs journalctl -fu my.service, they get:
Hint: You are currently not seeing messages from other users and the system.
Users in groups 'adm', 'systemd-journal' can see all messages.
Pass -q to turn off this notice.
I want joe to not be able to see all system logs. I only want to enable seeing specific units' logs.
Of course I could add joe to systemd-journal group but that would give them access to all logs.
I could also add a specific sudo exception for joe so that they could run sudo journalctl -fu my.service but that only works for one set of flags. There are other flags to journalctl that joe might want to use. Maybe they want to watch all logs that they're allowed to see at once. Maybe they have some custom filtering they want to add.
Is there a way to do this with journalctl (or other) configuration that I'm not seeing?