nextcloud: program escapes dbus-proxy via systemd

[michelesr]

I've started seeing this weird behavior in Nextcloud where it uses dbus to spawn a process via systemd.

systemctl --user -a  | rg nextcl
  dbus-:1.2-com.nextcloudgmbh.Nextcloud@0.service                                                                                                       loaded    active   running   dbus-:1.2-com.nextcloudgmbh.Nextcloud@0.service
  app-dbus\x2d:1.2\x2dcom.nextcloudgmbh.Nextcloud.slice                                                                                                 loaded    active   active    Slice /app/dbus-:1.2-com.nextcloudgmbh.Nextcloud

Seems weird that Nextcloud can do that with the default firejail profile that has dbus-user filter and dbus-user.talk org.freedesktop.secrets only.

Could it be that dbus-proxy is not effective anymore now that Arch Linux has switched to dbus-broker?

Relates to:

• profiles: nextcloud: add dbus-user.own & document dbus service #6211

[michelesr]

Actually... I've tested dbus-proxy and it works fine. It's probably something else triggering the systemd service over dbus.

cat /usr/share/dbus-1/services/com.nextcloudgmbh.Nextcloud.service
[D-BUS Service]
Name=com.nextcloudgmbh.Nextcloud
Exec=/usr/bin/nextcloud --background

[kmk3]

@glitsj16 on Feb 15:

$ cat  ~/.config/firejail/nextcloud.local
dbus-user.own com.nextcloudgmbh.Nextcloud

Should this be added to nextcloud.profile?

[glitsj16]

Should this be added to nextcloud.profile?

@kmk3

Yes we should. But that still leaves the problem that the current firecfg implementation doesn't create an override in ~/.local/share/dbus-1/services. That's a feature which only @rusty-snake's firecfg.py automates AFAIK. Not a very elegant situation IMO if we need to add a convoluted comment in nextcloud.profile to explain all this...

Any thoughts?

[kmk3]

Yes we should. But that still leaves the problem that the current firecfg
implementation doesn't create an override in ~/.local/share/dbus-1/services.
That's a feature which only @rusty-snake's
firecfg.py automates AFAIK. Not
a very elegant situation IMO if we need to add a convoluted comment in
nextcloud.profile to explain all this...

Any thoughts?

I'm not familiar with dbus services, but if it's similar to the overrides of
.desktop files, then it makes sense to me.

[glitsj16]

I'm not familiar with dbus services, but if it's similar to the overrides of
.desktop files, then it makes sense to me.

That's correct, this is indeed a similar situation. I'm preparing an entree on D-Bus overrides for the wiki. The current FAQ on firecfg needs updating anyway now there's native support via firecfg.d. When that's ready I can point the nextcloud comment to it. Should make it a bit easier to keep the comment within reasonable limits.

[michelesr]

Even if you don't add the dbus service override, most users will start Nextcloud at login anyway, and if it owns the dbus name then it will respond to it, and the broker won't need to spawn another instance of Nextcloud. The problem will then arise when the firejailed Nextcloud won't be running, but most of the users will probably keep it running all the time in background anyway.