Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

contributed systemd unit doesn't work in user session #49

Closed
terinjokes opened this issue Aug 19, 2020 · 6 comments · Fixed by #50
Closed

contributed systemd unit doesn't work in user session #49

terinjokes opened this issue Aug 19, 2020 · 6 comments · Fixed by #50

Comments

@terinjokes
Copy link
Contributor

terinjokes commented Aug 19, 2020 •
edited
Loading

The systemd unit at /contrib/systemd/user/yubikey-agent.service implies that it is suitable for the user systemd daemon, however it contains options that required privileges to run, resulting in errors similar to the following:

systemd[28428]: yubikey-agent.service: Failed to set up mount namespacing: Operation not supported
systemd[28428]: yubikey-agent.service: Failed at step NAMESPACE spawning /usr/bin/yubikey-agent: Operation not supported

This is reflected in similar issues upsteam, such as systemd/systemd#9870. I can try paring the list down to options that work.
terinjokes added a commit to terinjokes/yubikey-agent that referenced this issue Aug 19, 2020
@terinjokes
systemd: remove options unsupported in user daemon
66d1d6a 
Many unit options are documented to not work in the user daemons,
usually with the following note in the systemd.exec(5) man page:

> This option is only available for system services and is not supported
> for services running in per-user instances of the service manager.

In some circumstances these settings work where user namespaces are
supported (by setting the `PrivateUser` option). However users
namespaces are disabled on most distributions.

This changeset pares the options to those supported in user daemons to
allow for ease of use for users.

Fixes: FiloSottile#49
@terinjokes terinjokes mentioned this issue Aug 19, 2020
Merged
@philandstuff
Copy link
Contributor

As a datapoint, I have the provided unit file running unmodified (other than executable path) on my machine as a user service.

I believe the capability to use particular options is distro-specific; I’m running on nixos. Indeed the systemd issue you linked says

OTOH that aspect cna change depending on all sorts of configuration, so I’m not sure how this could be documented in a way that makes sense...

I’m not sure the right solution here. I guess we want distributions to package a unit that uses at many of the given options that work, but ultimately it’s the packager’s job to make it work.

@terinjokes
Copy link
Contributor Author

For what it's worth, I'm on NixOS 20.03.

@philandstuff
Copy link
Contributor

Huh. Well i recently packaged yubikey-agent for NixOS unstable so I’m unsure what might have changed in the meantime.

@terinjokes
Copy link
Contributor Author

I'm unsure. Do you have a different kernel (5.4.58) or systemd (243.7)? I'm happy to move NixOS conversation elsewhere.

@terinjokes
Copy link
Contributor Author

It looks like this requires systemd/systemd@5749f85 which is in systemd v245. Let me see about fetching this from unstable.

@terinjokes
Copy link
Contributor Author

Can confirm, using 245.6 from unstable results in the unmodified unit file working. Looking at Repology, it looks like this version is available on most of the common desktop distributions I'm aware of (backports on Debian Stable, Ubuntu 20.04 LTS, Fedora 32). Biggest outliers look to be NixOS 20.03 and Raspian Stable.

FiloSottile pushed a commit that referenced this issue Sep 5, 2020
@terinjokes
systemd: remove options unsupported in older systemd versions (#50)
5000c32 
Many unit options are documented to not work in the user daemons,
usually with the following note in the systemd.exec(5) man page:

> This option is only available for system services and is not supported
> for services running in per-user instances of the service manager.

In some circumstances these settings work where user namespaces are
supported (by setting the `PrivateUser` option). However users
namespaces are disabled on most distributions.

This changeset pares the options to those supported in user daemons to
allow for ease of use for users.

Fixes #49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

systemd: remove options unsupported in user daemon terinjokes/yubikey-agent
2 participants
@terinjokes @philandstuff