/ dir:/run/user/1000/gvfs type:fuse.gvfsd-fuse - invalid

[rieje]

I have 2 simple user systemd services that simply launches udiskie and weechat.

udiskie.service fails with:

uid 1000, last mount name:/ dir:/run/user/1000/gvfs type:fuse.gvfsd-fuse - invalid noexec mount

weechat.service fails with:

uid 1000, last mount name:/ dir:/run/user/1000/gvfs type:fuse.gvfsd-fuse - invalid read-only mount

When I restart these services, there's no issues and they run as expected, but I always need to restart them after they fail on login.

Any ideas?

[glitsj16]

Sounds like an ordering /racyness issue. Have you tried starting your custom units after gvfs-related user services?
Try adding something like After=gvfs-daemon.service gvfs-metadata.service gvfs-udisks2-volume-monitor.service. And check if there's other gvfs user service units on your system besides those.

Alternatively you could use wrapper scripts for those apps and implement starting after gvfs there:

$ cat ~/bin/udiskie
#!/bin/sh
#
## wrapper for udiskie
#+ sandbox support via firejail

### vars
_app="udiskie"
_bin="/usr/bin/${_app}"

### logic
# start after gvfs (auto-mounting removable devices)
until pgrep gvfs > /dev/null; do
    sleep 1
done

# run sandboxed
exec firejail ${_bin} "$@"

Sidenote: gvfs can be a pain for sandboxing. I've had these gvfs-related options in my globals.local for ages without any weirdness:

## gvfs ##
# RotaJakiro [https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/]
blacklist ${HOME}/.gvfsd/.profile/gvfsd-helper
# gvfs root owned (empty dir)
blacklist ${RUNUSER}/gvfs
# gvfsd (empty dir)
read-only ${RUNUSER}/gvfsd

[rieje]

Thanks, I just needed gvfs-udisks2-volume-monitor.service on Arch Linux.