googleCloudPrint.service - was Re: Headless Google Cloud Print only works when started from ssh -Y

[Gary Stainburn]

I decided to have a go at writing a .service file for this and I don't think 
I've done bad.  The only problem I have is that according to the syslog 
output it appears to be running as root and not as gary.

Can anyone see what I've missed?

Jul  4 11:53:48 lou systemd[1]: Starting Google Chrome running headless as 
Cloud Print Server...
Jul  4 11:53:48 lou systemd[1]: Started Google Chrome running headless as 
Cloud Print Server.
Jul  4 11:53:48 lou CloudPrint[8816]: 
[8821:8821:0704/115348:ERROR:browser_main_loop.cc(209)] Gtk: cannot open 
display:
Jul  4 11:53:48 lou CloudPrint[8816]: 
[8816:8837:0704/115348:WARNING:proxy_service.cc(904)] PAC support disabled 
because there is no system implementation
Jul  4 11:53:48 lou CloudPrint[8816]: The setuid sandbox is not running as 
root. Common causes:
Jul  4 11:53:48 lou CloudPrint[8816]: * An unprivileged process using ptrace 
on it, like a debugger.
Jul  4 11:53:48 lou CloudPrint[8816]: * A parent process set 
prctl(PR_SET_NO_NEW_PRIVS, ...)
Jul  4 11:53:48 lou CloudPrint[8816]: Failed to move to new namespace: PID 
namespaces supported, Network namespace supported, but failed: errno = 
Operation not permitted
Jul  4 11:53:48 lou CloudPrint[8816]: 
[8816:8839:0704/115348:WARNING:print_system_cups.cc(464)] No print server 
specified. Using default print server.

/usr/lib/systemd/googleCloudPrint.service

[Unit]
Description=Google Chrome running headless as Cloud Print Server
After=network.target

[Service]
Type=simple
User=gary
Group=gary
WorkingDirectory=/home/gary/.GoogleCloudPrint
ExecStart=/usr/bin/google-chrome  \
	--type=service --enable-cloud-print-proxy \
	--no-service-autorun \
	--log-level 2 \
	 --enable-logging=stderr \
	--user-data-dir=/home/gary/.GoogleCloudPrint
Restart=always
StandardInput=null
StandardOutput=syslog
StandardError=inherit
SyslogIdentifier=CloudPrint
SyslogFacility=lpr
SyslogLevel=err
PrivateTmp=true

[Install]
WantedBy=multi-user.target