I'm setting up a small number of Linux workstations where users won't have elevated sudo access or permission to manage apt/dnf directly. I'd like to give them a self-service interface for installing and removing system packages from an approved catalog, similar to Company Portal on Windows or Self Service on macOS, without requiring support tickets.
Full endpoint-management or MDM platforms seem excessive for this small deployment, and I haven't found a narrowly focused tool that fits. I considered customizing GNOME Software to use only approved repositories, but the standard BaseOS and AppStream repositories must remain enabled for system updates, and the software center exposes packages from every enabled repository.
Are there existing FOSS or commercial tools that already support this use case? I'm specifically looking for product recommendations rather than guidance on building a custom repository, application, and polkit rules, since I already have a custom implementation planned if nothing suitable exists.
3 Answers
Rundeck could be adapted for this by exposing approved installation and removal jobs to users. It probably wouldn’t feel as polished as a dedicated software catalog, but it may be workable if the deployment is small and you want to avoid building a complete frontend.
Another approach is to let users request software through an identity or access-management workflow, with a backend such as Ansible or OpenTofu performing the package changes. This provides auditing and keeps the actual package operations privileged, though it may be more process-heavy than a true self-service catalog.
That model makes sense for fixed user roles, but these users are mostly experienced platform, DevOps, cloud, and software engineers. Their package needs change often, so constantly updating role definitions would create a lot of friction. Role-based defaults may still be useful, but they don’t fully solve the broader need.
If you don’t need a graphical catalog, a tightly scoped sudo policy could allow users to run only approved package-management commands or wrapper scripts. For a more complete endpoint-management product, something like Stratosdesk may be worth evaluating, although a full management platform could be more than you need.
A local repository combined with narrowly scoped privileges is roughly the custom design I’d use, but I’m specifically trying to identify an existing tool before implementing that solution myself.
That’s a possible fallback, but I already have a straightforward custom approach in mind. I’m mainly hoping there’s an existing end-user tool designed specifically for this rather than a general automation interface.