Writing a systemd service file

[Alex]

Hi,
I'm trying to write a service file for a daemon and having some
problems. I believe the issue is with the ability to give the process
write and read access to parts of the filesystem which appear to
somehow be restricted.

The daemon is the Avira virus scanner, which runs under amavisd-new.

The daemon's home directory is
/usr/local/savapi-sdk-linux_glibc24_x86_64, and it needs write access
in the modules directory.

The daemon can run as root or as the amavis user. It drops its
privileges to the amavis user after starting anyway.

Here is what I have so far:

# cat /etc/systemd/system/savapi.service
[Unit]
Description=Avira Antivirus SDK
Documentation=http://www.ijs.si/software/amavisd/#doc
After=network.target
Wants=clamd(a)amavisd.service
Wants=postfix.service
RequiresMountsFor="/usr/local/savapi-sdk-linux_glibc24_x86_64"

[Service]
Type=forking
User=amavis
Group=amavis
PIDFile=/var/run/amavisd/savapi.pid
ExecStart=/var/spool/amavisd/savapi.sh start
ExecReload=/var/spool/amavisd/savapi.sh reload
Restart=on-failure
#PrivateTmp=
PrivateDevices=false
CapabilityBoundingSet=
ProtectSystem=full
ProtectHome=true

[Install]
WantedBy=multi-user.target

I've specified "RequiresMountsFor", which I understood could be used
to provide access to parts of the filesystem. I've also disabled
PrivateTmp and PrivateDevices.

The ExecStart script just spawns the savapi daemon:

        #!/bin/bash
        cd /usr/local/savapi-sdk-linux_glibc24_x86_64/bin
        ./savapi --config=savapi.conf &

When I attempt to start the service, journalctl -xe shows me:
Validation failed for option 'ModulesDir' with value
'/usr/local/savapi-sdk-linux_glibc24_x86_64/modules'. Path cannot be
accessed (no write permission).

ModulesDir is /usr/local/savapi-sdk-linux_glibc24_x86_64/modules

When I run the script manually as root or as the amavis user, it runs
successfully.

I think the problem is that I don't understand how systemd processes
access the filesystem and the restrictions on permissions.

Any ideas greatly appreciated.
Thanks,
Alex

[stan]

On Thu, 29 Jun 2017 23:27:04 -0400
Alex <mysqlstudent(a)gmail.com&gt; wrote:

>  Hi,
>  I'm trying to write a service file for a daemon and having some
>  problems. I believe the issue is with the ability to give the process
>  write and read access to parts of the filesystem which appear to
>  somehow be restricted. 
[snip]

You'll probably get more response to this on the devel list,
devel(a)lists.fedoraproject.org

I don't know anything about this process, but I wonder if it doesn't
have something to do with using /usr/local instead of /usr?

[Garry T. Williams]

On Thursday, June 29, 2017 11:27:04 PM EDT Alex wrote:
>  When I attempt to start the service, journalctl -xe shows me:
>  Validation failed for option 'ModulesDir' with value
>  '/usr/local/savapi-sdk-linux_glibc24_x86_64/modules'. Path cannot be
>  accessed (no write permission).
>  
>  ModulesDir is /usr/local/savapi-sdk-linux_glibc24_x86_64/modules
>  
>  When I run the script manually as root or as the amavis user, it runs
>  successfully. 
Sounds like Selinux -- not systemd.

-- 
Garry T. Williams

[Rick Stevens]

On 06/30/2017 01:50 PM, Garry T. Williams wrote:
>  On Thursday, June 29, 2017 11:27:04 PM EDT Alex wrote:
> > When I attempt to start the service, journalctl -xe shows me:
> > Validation failed for option 'ModulesDir' with value
> > '/usr/local/savapi-sdk-linux_glibc24_x86_64/modules'. Path cannot be
> > accessed (no write permission).
> >
> > ModulesDir is /usr/local/savapi-sdk-linux_glibc24_x86_64/modules
> >
> > When I run the script manually as root or as the amavis user, it runs
> > successfully.
>  
>  Sounds like Selinux -- not systemd. 
Uhm, possibly. Only a browse through the AVC log would tell.
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, AllDigital    ricks(a)alldigital.com -
- AIM/Skype: therps2        ICQ: 226437340           Yahoo: origrps2 -
-                                                                    -
-      Always remember you're unique, just like everyone else.       -
----------------------------------------------------------------------

[Ed Greshko]

On 07/01/17 06:33, Rick Stevens wrote:
>  On 06/30/2017 01:50 PM, Garry T. Williams wrote:
> > On Thursday, June 29, 2017 11:27:04 PM EDT Alex wrote:
> >> When I attempt to start the service, journalctl -xe shows me:
> >> Validation failed for option 'ModulesDir' with value
> >> '/usr/local/savapi-sdk-linux_glibc24_x86_64/modules'. Path cannot be
> >> accessed (no write permission).
> >>
> >> ModulesDir is /usr/local/savapi-sdk-linux_glibc24_x86_64/modules
> >>
> >> When I run the script manually as root or as the amavis user, it runs
> >> successfully.
> > Sounds like Selinux -- not systemd.
>  Uhm, possibly. Only a browse through the AVC log would tell. 
Maybe, maybe not.  Many of the selinux rules these days are set "dontaudit" and
you
won't get an AVC.  So, to test it I found it best to either setenforce 0 or run
semodule to disable dontaudit and then look to see if an AVC is created.


-- 
Fedora Users List - The place to go to speculate endlessly

[Alex]

Hi,

On Fri, Jun 30, 2017 at 6:41 PM, Ed Greshko <ed.greshko(a)greshko.com&gt; wrote:
>  On 07/01/17 06:33, Rick Stevens wrote:
> > On 06/30/2017 01:50 PM, Garry T. Williams wrote:
> >> On Thursday, June 29, 2017 11:27:04 PM EDT Alex wrote:
> >>> When I attempt to start the service, journalctl -xe shows me:
> >>> Validation failed for option 'ModulesDir' with value
> >>> '/usr/local/savapi-sdk-linux_glibc24_x86_64/modules'. Path cannot be
> >>> accessed (no write permission).
> >>>
> >>> ModulesDir is /usr/local/savapi-sdk-linux_glibc24_x86_64/modules
> >>>
> >>> When I run the script manually as root or as the amavis user, it runs
> >>> successfully.
> >> Sounds like Selinux -- not systemd.
> > Uhm, possibly. Only a browse through the AVC log would tell.
>
>  Maybe, maybe not.  Many of the selinux rules these days are set "dontaudit" and
> you
>  won't get an AVC.  So, to test it I found it best to either setenforce 0 or run
>  semodule to disable dontaudit and then look to see if an AVC is created. 
No, selinux was disabled at boot (security=0).

The problem has something to do with /usr/local itself. Changing the
path to /var/lib/daemon-dir fixed the problem.

There's some relationship to systemd and the ability for it to control
write access to system directories.

I've read through much of the systemd documentation now, and don't see
any option which controls whether a daemon has write access to normal
system directories.

Someone with more knowledge of how it all works will hopefully comment.









>
>
> --
> Fedora Users List - The place to go to speculate endlessly
>
>
> _______________________________________________
> users mailing list -- users(a)lists.fedoraproject.org
> To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>