[SOLVED] Can no longer launch mpd as user via systemd --user start mpd

ipyakuza · 2020-02-05 06:34:01

I've updated my system with all of the latest packages via pacman. I was able to run mpd via a user running "systemctl --user start mpd" prior to updating my system today. However at some point after updating today this is no longer the case. Whenever I try to start it, it instantly fails throwing the messages below. Specifically it looks like something failing with systemd dropping capabilities. I tried to do some basic web searches and couldn't find enough to understand what this was. It almost sounds like perhaps the latest kernel/updates includes something that breaks user permissions for some systemd user services. Wondering if anybody was having similar issues? I have to run mpd as a user/service due to it's dependency with pulseaudio (being a user level service it required mpd to run as a user service to play nicely). Can anyone point me in the right direction of where I should look for more details around systemd / user level services / dropping capabilities?

Feb 04 18:08:17 hakkaisan systemd[720]: Starting Music Player Daemon...
-- Subject: A start job for unit UNIT has begun execution
-- Defined-By: systemd
-- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- A start job for unit UNIT has begun execution.
-- 
-- The job identifier is 100.
Feb 04 18:08:17 hakkaisan systemd[15631]: mpd.service: Failed to drop capabilities: Operation not permi>
Feb 04 18:08:17 hakkaisan systemd[15631]: mpd.service: Failed at step CAPABILITIES spawning /usr/bin/mp>
-- Subject: Process /usr/bin/mpd could not be executed
-- Defined-By: systemd
-- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- The process /usr/bin/mpd could not be executed and failed.
-- 
-- The error number returned by this process is ERRNO.
Feb 04 18:08:17 hakkaisan systemd[720]: mpd.service: Main process exited, code=exited, status=218/CAPAB>
-- Subject: Unit process exited
-- Defined-By: systemd
-- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- An ExecStart= process belonging to unit UNIT has exited.
-- 
-- The process' exit code is 'exited' and its exit status is 218.
Feb 04 18:08:17 hakkaisan systemd[720]: mpd.service: Failed with result 'exit-code'.
-- Subject: Unit failed
-- Defined-By: systemd
-- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- The unit UNIT has entered the 'failed' state with result 'exit-code'.
Feb 04 18:08:17 hakkaisan systemd[720]: Failed to start Music Player Daemon.
-- Subject: A start job for unit UNIT has failed
-- Defined-By: systemd
-- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- A start job for unit UNIT has finished with a failure.
-- 
-- The job identifier is 100 and the job result is failed.

Last edited by ipyakuza (2020-02-05 15:22:16)

seth · 2020-02-05 07:51:05

Does your service contain "ProtectKernelModules=yes"?

ipyakuza · 2020-02-05 14:23:00

It did (see below). I flipped it to no and the service started just fine (thank you). Is this a new directive? I just took a vanilla copy of the mpd.service file a while ago and had no issues. Not sure what would have changed recently.

[Unit]
Description=Music Player Daemon
Documentation=man:mpd(1) man:mpd.conf(5)
After=network.target sound.target

[Service]
Type=notify
ExecStart=/usr/bin/mpd --no-daemon

# Enable this setting to ask systemd to watch over MPD, see
# systemd.service(5).  This is disabled by default because it causes
# periodic wakeups which are unnecessary if MPD is not playing.
#WatchdogSec=120

# allow MPD to use real-time priority 50
LimitRTPRIO=50
LimitRTTIME=infinity

# disallow writing to /usr, /bin, /sbin, ...
ProtectSystem=yes

# more paranoid security settings
NoNewPrivileges=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
# AF_NETLINK is required by libsmbclient, or it will exit() .. *sigh*
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
RestrictNamespaces=yes

[Install]
WantedBy=default.target
Also=mpd.socket

seth · 2020-02-05 14:27:13

Current versions have

# Note that "ProtectKernelModules=yes" is missing in the user unit
# because systemd 232 is unable to reduce its own capabilities
# ("Failed at step CAPABILITIES spawning /usr/bin/mpd: Operation not
# permitted")

Not sure when this was aded, but somewhen after systemd 232 (which was released quite a while ago)

ipyakuza · 2020-02-05 15:17:59

Greatly appreciate your help on this,

Arch Linux

#1 2020-02-05 06:34:01

[SOLVED] Can no longer launch mpd as user via systemd --user start mpd

#2 2020-02-05 07:51:05

Re: [SOLVED] Can no longer launch mpd as user via systemd --user start mpd

#3 2020-02-05 14:23:00

Re: [SOLVED] Can no longer launch mpd as user via systemd --user start mpd

#4 2020-02-05 14:27:13

Re: [SOLVED] Can no longer launch mpd as user via systemd --user start mpd

#5 2020-02-05 15:17:59

Re: [SOLVED] Can no longer launch mpd as user via systemd --user start mpd

Board footer