Arch Linux

nimo

Member

Registered: 2016-01-01

Posts: 2

How to give daemon access to audio when invoked from systemd?

When I manually ssh as normal user and start the daemon process it can play sounds through aplay.

However when the daemon process is started via systemd it seems like it no longer has access to the audio system. aplay then returns: 

main:722: audio open error: No such device.

The id command reveals that when manually logging in as user, then that user is part of the audio group, but when invoked from systemd and running id it's no longer a part of the audio group.

What's the correct way of giving audio access to a process started from systemd?

tom.ty89

Member

Registered: 2012-11-15

Posts: 897

Re: How to give daemon access to audio when invoked from systemd?

Is the daemon started by a system unit or user unit? Also you said "it's no longer a part of the audio group" according to id, but what is "it" after all though (i.e. the uid).

nimo

Member

Registered: 2016-01-01

Posts: 2

Re: How to give daemon access to audio when invoked from systemd?

Is the daemon started by a system unit or user unit? Also you said "it's no longer a part of the audio group" according to id, but what is "it" after all though (i.e. the uid).

Thanks for your reply!

It is refering to the user.

When quote the output from id to hopefully make things clearer.

When running id after ssh'ing or su'ing to user tellstick:

[tellstick@pi ~]$ id
uid=1001(tellstick) gid=1002(tellstick) groups=1002(tellstick),14(uucp),92(audio),1001(plugdev)
[tellstick@pi ~]$ whoami
tellstick

When running id from a script executed from the daemon that has dropped privileges to user tellstick but started as root from systemd:

id
uid=1001(tellstick) gid=1001(plugdev) groups=1001(plugdev)
whoami
tellstick

I start the daemon by as root running:

systemctl start telldus

the daemon automatically drop privileges to user tellstick. Does this mean that it's started by system unit?

Last edited by nimo (2016-01-05 09:59:39)

tom.ty89

Member

Registered: 2012-11-15

Posts: 897

Re: How to give daemon access to audio when invoked from systemd?

Hmm I am not how exactly your daemon work and why/how it drops privileges to the user.

Btw it's kind of weird that your uid and gid does not match. What's "plugdev" anyway? Why group "tellstick" is 1002 while user "tellstick" is 1001? :S.

It is a system unit, otherwise you start it with `systemctl --user start telldbus`

I test here with the following units:

[Unit]
Description=Whatever

[Service]
ExecStart=/usr/bin/bash -c 'id > /home/tom/sample_root; aplay -l >> /home/tom/sample_root'

[Unit]
Description=Whatever

[Service]
User=tom
ExecStart=/usr/bin/bash -c 'id > /home/tom/sample_tom; aplay -l >> /home/tom/sample_tom'

sample_root:

uid=0(root) gid=0(root) groups=0(root)
**** List of PLAYBACK Hardware Devices ****
card 0: STX [Xonar STX], device 0: Multichannel [Multichannel]
  Subdevices: 1/1
  Subdevice #0: subdevice #0
card 0: STX [Xonar STX], device 1: Digital [Digital]
  Subdevices: 1/1
  Subdevice #0: subdevice #0

sample_tom:

uid=1000(tom) gid=1000(tom) groups=1000(tom),10(wheel)
**** List of PLAYBACK Hardware Devices ****
card 0: STX [Xonar STX], device 0: Multichannel [Multichannel]
  Subdevices: 1/1
  Subdevice #0: subdevice #0
card 0: STX [Xonar STX], device 1: Digital [Digital]
  Subdevices: 1/1
  Subdevice #0: subdevice #0

and:

[tom@localhost ~]$ id
uid=1000(tom) gid=1000(tom) groups=1000(tom),10(wheel)
[tom@localhost ~]$ aplay -l
**** List of PLAYBACK Hardware Devices ****
card 0: STX [Xonar STX], device 0: Multichannel [Multichannel]
  Subdevices: 1/1
  Subdevice #0: subdevice #0
card 0: STX [Xonar STX], device 1: Digital [Digital]
  Subdevices: 1/1
  Subdevice #0: subdevice #0
[tom@localhost ~]$ sudo id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),19(log)
[tom@localhost ~]$ sudo aplay -l
**** List of PLAYBACK Hardware Devices ****
card 0: STX [Xonar STX], device 0: Multichannel [Multichannel]
  Subdevices: 1/1
  Subdevice #0: subdevice #0
card 0: STX [Xonar STX], device 1: Digital [Digital]
  Subdevices: 1/1
  Subdevice #0: subdevice #0
[tom@localhost ~]$ 

aplay -l works with tom without audio group because it's the current login user and systemd has a udev rule set ACLs for that by default.

Last edited by tom.ty89 (2016-01-05 10:20:09)