redsocks failed to start because of user permission

[yongfengdu]

After installation of redsocks:
swupd bundle-add network-basic

systemctl start redsocks is having this error:
Job for redsocks.service failed because the control process exited with error code.
See "systemctl status redsocks.service" and "journalctl -xe" for details.

Looks like it's due to permission error.
Everything works fine after I removed the line
"User=nobody"
in service file:
/lib/systemd/system/redsocks.service

redsocks will start up with root permission.

Reproducible on every version.

[thiagomacieira]

We do have a nobody user, so why does it fail to start with that user?

[ahkok]

Running redsocks as root is strongly discouraged from a security perspective.

Actually, it can, itself, change uid if setup correctly. However, it should run as nobody already - is there any relevant journalctl output you can include?

[yongfengdu]

The results paste have special characters and make the content bigger and bold.

Here is the log of journalctl:

Dec 12 01:43:04 clear-1 systemd[1]: Starting Transparent redirector of any TCP connection to proxy using your firewall...
-- Subject: Unit redsocks.service has begun start-up
-- Defined-By: systemd
-- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit redsocks.service has begun starting up.
Dec 12 01:43:04 clear-1 redsocks[8193]: setsockopt(..., SOL_IP, IP_TRANSPARENT): Operation not permitted
Dec 12 01:43:04 clear-1 systemd[1]: redsocks.service: Can't open PID file /run/redsocks/redsocks.pid (yet?) after start: No such file or directory
Dec 12 01:43:04 clear-1 rm[8196]: /bin/rm: cannot remove '/run/redsocks/redsocks.pid': No such file or directory
Dec 12 01:43:04 clear-1 systemd[1]: redsocks.service: Control process exited, code=exited status=1
Dec 12 01:43:04 clear-1 systemd[1]: redsocks.service: Failed with result 'protocol'.
Dec 12 01:43:04 clear-1 systemd[1]: Failed to start Transparent redirector of any TCP connection to proxy using your firewall.
-- Subject: Unit redsocks.service has failed
-- Defined-By: systemd
-- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit redsocks.service has failed.
--
-- The result is RESULT.

And I also paste my redsocks.conf file for your reference

 # cat /etc/redsocks.conf
base {
        log_debug = on;
        log_info = on;
        daemon = on;
        redirector = iptables;
}
redsocks {
        local_ip = 127.0.0.1;
        local_port = 7777;
        ip = proxy.server.address;
        port = 1080;
        type = socks5;
}
redudp {
        local_ip = 127.0.0.1;
        local_port = 8888;
        ip = proxy.server.address;
        port = 1080;
        udp_timeout = 30;
        udp_timeout_stream = 180;
}
dnstc {
        local_ip = 127.0.0.1;
        local_port = 5300;
}

[fenrus75]

likely a case of /run/redsocks not existing and not being owned by the right user

…

On Tue, Dec 11, 2018 at 6:27 PM dolpher ***@***.***> wrote: This is easy to reproduce, all you need is to add network-basic bundle, and a redsocks.conf file. Here is the log of journalctl: Dec 12 01:43:04 clear-1 systemd[1]: Starting Transparent redirector of any TCP connection to proxy using your fire wall... -- Subject: Unit redsocks.service has begun start-up -- Defined-By: systemd -- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel -- Unit redsocks.service has begun starting up. Dec 12 01:43:04 clear-1 redsocks[8193]: setsockopt(..., SOL_IP, IP_TRANSPARENT): Operation not permitted Dec 12 01:43:04 clear-1 systemd[1]: redsocks.service: Can't open PID file /run/redsocks/redsocks.pid (yet?) after start: No such file or directory Dec 12 01:43:04 clear-1 rm[8196]: /bin/rm: cannot remove '/run/redsocks/redsocks.pid': No such file or directory Dec 12 01:43:04 clear-1 systemd[1]: redsocks.service: Control process exited, code=exited status=1 Dec 12 01:43:04 clear-1 systemd[1]: redsocks.service: Failed with result 'protocol'. Dec 12 01:43:04 clear-1 systemd[1]: Failed to start Transparent redirector of any TCP connection to proxy using yo ur firewall. -- Subject: Unit redsocks.service has failed -- Defined-By: systemd -- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel -- Unit redsocks.service has failed. -- The result is RESULT. And I also paste my redsocks.conf file for your reference cat /etc/redsocks.conf base { log_debug = on; log_info = on; daemon = on; redirector = iptables; } redsocks { local_ip = 127.0.0.1; local_port = 7777; ip = proxy.server.address; port = 1080; type = socks5; } redudp { local_ip = 127.0.0.1; local_port = 8888; ip = proxy.server.address; port = 1080; udp_timeout = 30; udp_timeout_stream = 180; } dnstc { local_ip = 127.0.0.1; local_port = 5300; } — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#322 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABPeFbQ5RcXeDtRst0xkNfVzeZl0-VLJks5u4Gl_gaJpZM4ZM28p> .

[yongfengdu]

Checked that the /run/redsocks is owned by "nobody"

# ls -l /run/
drwxr-xr-x  2 nobody    nobody      40 Dec 12 01:41 redsocks