I'm setting up a small number of Linux workstations where users won't have elevated sudo access or permission to run apt/dnf directly. I'd still like them to install and remove system packages from a pre-approved catalog without submitting support tickets—similar to a self-service software portal on other operating systems.
Full MDM platforms seem like they would eventually solve this, but they're probably excessive for the current number of users and may be difficult to get approved. I also considered customizing GNOME Software to show only an internal repository, but the standard BaseOS/AppStream or equivalent repositories must remain enabled for system updates, and the software center would still expose packages from all enabled repositories.
Before building a narrowly scoped custom tool using a controlled repository and polkit permissions, I'm looking for existing software that already supports this use case. Commercial tools are fine, although something focused specifically on package self-service would be easier to justify than a full endpoint-management suite. I'm specifically looking for product recommendations rather than advice on implementing a custom solution.
4 Answers
Rundeck could provide a workable front end for this. You could expose separate jobs for installing or removing approved packages and let the backend perform the privileged operation. It may not feel as polished as a dedicated software catalog, but it’s an existing option worth evaluating if the package list is small.
Another approach is to connect software requests to identity or role management, with Ansible, OpenTofu, or a similar backend applying the change. That gives you an auditable approval path and keeps package installation privileged. The downside is that it may become cumbersome when engineers need a broader and frequently changing selection of tools rather than a few fixed roles.
A tightly scoped sudo or polkit rule can authorize only the approved installation and removal operations instead of granting general administrative access. This is simple and can be backed by a local repository, but it still leaves you responsible for building the catalog and user experience, so it’s closer to an implementation path than a ready-made self-service application.
Some endpoint-management products, such as StratosDesk, may be able to provide a controlled software catalog without giving users unrestricted administrative access. If adopting management software is acceptable, compare whether it supports Linux package deployment, uninstall actions, approval controls, and a user-facing catalog rather than assuming every MDM product offers all of those features.
That could work for clearly defined user categories, but these users are mostly senior engineering staff whose tooling needs vary considerably. I may still offer a few role-based bundles, but constantly adjusting roles would create more friction than it solves.