[sovled] systemD confuseion

Nikita790 · 2021-01-29 01:32:51

ok so im trying to make a systemd service,
this is my service file

[Unit]
Description=Honeygain on boot
After=network.target
StartLimitIntervalSec=0
[Service]
Type=simple
Restart=always
RestartSec=1
User=kamey
ExecStart=/bin/bash /usr/bin/honeygain.sh
[Install]
WantedBy=multi-user.target

and this is the SH file it runs

docker run honeygain/honeygain -tou-accept -email removed -pass removed -device kamey-arch

but it doenst work, status shows

kamey@arch-linux:~]$ systemctl status honeygain

● honeygain.service - Honeygain on boot
Loaded: loaded (/etc/systemd/system/honeygain.service; disabled; vendor preset: disabled)
Active: activating (auto-restart) (Result: exit-code) since Fri 2021-01-29 03:11:48 CET; 9ms ago
Process: 17532 ExecStart=/bin/bash /usr/bin/honeygain.sh (code=exited, status=126)
Main PID: 17532 (code=exited, status=126)

why doesnt it work?

Last edited by Nikita790 (2021-01-29 17:39:54)

ArleCamille · 2021-01-29 01:48:15

It exited because of some errors. Unfortunately, the given information is not enough for us to answer the reason.

Show us the output of this command, which will give the systemd log only related to your service:

journalctl -uhoneygain.service

EDIT: typo, existed -> exited

Last edited by ArleCamille (2021-01-29 02:02:42)

Nikita790 · 2021-01-29 02:39:58

Jan 29 02:43:12 arch-linux docker[7717]: See 'docker run --help'.
Jan 29 02:43:12 arch-linux systemd[1]: honeygain.service: Main process exited, code=exited, status=126/n/a
Jan 29 02:43:12 arch-linux systemd[1]: honeygain.service: Failed with result 'exit-code'.
Jan 29 02:43:13 arch-linux systemd[1]: honeygain.service: Scheduled restart job, restart counter is at 5.
Jan 29 02:43:13 arch-linux systemd[1]: Stopped Honeygain on boot.
Jan 29 02:43:13 arch-linux systemd[1]: Started Honeygain on boot.
Jan 29 02:43:14 arch-linux docker[7727]: docker: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post "http:>

im not sure why this is happening, as

sudo docker ps

works fine

ArleCamille · 2021-01-29 03:09:49

Nikita790 wrote:

[Service]
Type=simple
Restart=always
RestartSec=1
User=kamey
ExecStart=/bin/bash /usr/bin/honeygain.sh

That is because you are running it as a non-superuser. Docker is running but refusing to communicate with an ordinary user.

Do you have a reason to run the daemon in your own home folder? If not, remove the offending line (marked bold) to let systemd run the service as root.

EDIT: maybe instead specifying the same user as docker.service does would suffice, but since I don't know how docker.service is managed, I think we need attention of docker users here.

Last edited by ArleCamille (2021-01-29 03:14:07)

Nikita790 · 2021-01-29 03:10:50

it fixed after doing

sudo chmod 666 /var/run/docker.sock

thanks!

ArleCamille · 2021-01-29 03:18:51

Nikita790 wrote:

it fixed after doing
sudo chmod 666 /var/run/docker.sock
thanks!

No. Don't do that. It is dangerous. Everyone, including the remote attacker, can access the docker's socket. Rather running the offending service as the superuser is a little bit more secure.

If you really worry about running the service as root, rather run the service as the same user as docker.service (you can see the unit file by systemctl cat docker), or use the NoNewPrivileges= option. Man page of systemd.exec(5) says:

man systemd.exec(5) wrote:

NoNewPrivileges=
Takes a boolean argument. If true, ensures that the service
process and all its children can never gain new privileges
through execve() (e.g. via setuid or setgid bits, or
filesystem capabilities). This is the simplest and most
effective way to ensure that a process and its children can
never elevate privileges again. Defaults to false, but
certain settings override this and ignore the value of this
setting. This is the case when SystemCallFilter=,
SystemCallArchitectures=, RestrictAddressFamilies=,
RestrictNamespaces=, PrivateDevices=, ProtectKernelTunables=,
ProtectKernelModules=, ProtectKernelLogs=, ProtectClock=,
MemoryDenyWriteExecute=, RestrictRealtime=,
RestrictSUIDSGID=, DynamicUser= or LockPersonality= are
specified. Note that even if this setting is overridden by
them, systemctl show shows the original value of this
setting. Also see No New Privileges Flag[4].

If you care about security, the unit file should be something like:

EDIT: deleted incorrect information. Please refer to the next post.

This is a less secure version which runs the service as root.

[Unit]
Description=Honeygain on boot
After=network.target
StartLimitIntervalSec=0

[Service]
Type=simple
Restart=always
RestartSec=1
User=root
ExecStart=/bin/bash /usr/bin/honeygain.sh

[Install]
WantedBy=multi-user.target

Last edited by ArleCamille (2021-01-29 03:44:01)

Nikita790 · 2021-01-29 03:27:45

ooh, i see, that was really stupid of me. I will try to make it secure useing the methods you provided, thanks!

ArleCamille · 2021-01-29 03:43:16

Oops, I also made a mistake; docker runs on root actually.

So a canonical solution would be:

[Unit]
Description=Honeygain on boot
After=network.target
StartLimitIntervalSec=0

[Service]
Type=simple
Restart=always
RestartSec=1
User=root
NoNewPrivileges=yes
ExecStart=/bin/bash /usr/bin/honeygain.sh

[Install]
WantedBy=multi-user.target

Last edited by ArleCamille (2021-01-29 04:03:43)

Nikita790 · 2021-01-29 03:45:46

ah thats why it wasnt working, my friend who im making this for has gone to sleep now, i will update you if this works tommorow, thanks a lot!

Last edited by Nikita790 (2021-01-29 03:46:00)

Trilby · 2021-01-29 04:10:15

There's no need for "User=root" as that is a given. There's also no need for either for the script or the /bin/bash in the ExecStart line. Just run the docker command from the ExecStart line and cut out the middle man.

Last edited by Trilby (2021-01-29 04:30:34)

Nikita790 · 2021-01-29 04:25:55

hmm, ok, i will keep the user as it makes it easer for me to understand whats going on,
would this be a good service file?

[Unit]
Description=Honeygain
After=network.target
StartLimitIntervalSec=0
[Service]
Type=simple
Restart=always
RestartSec=1
User=root
NoNewPrivileges=yes
ExecStart=/bin/bash docker run honeygain/honeygain -tou-accept -email removed -pass removed -device kamey-arch
[Install]
WantedBy=multi-user.target

Trilby · 2021-01-29 04:30:08

No. Get rid of /bin/bash.

Nikita790 · 2021-01-29 04:33:59

ok, current file

[Unit]
Description=Honeygain
After=network.target
StartLimitIntervalSec=0
[Service]
Type=simple
Restart=always
RestartSec=1
User=root
NoNewPrivileges=yes
ExecStart=docker run honeygain/honeygain -tou-accept -email removed -pass removed -device kamey-arch
[Install]
WantedBy=multi-user.target

thanks for all of your help! I will update when my friend wakes up

Last edited by Nikita790 (2021-01-29 04:34:33)

Nikita790 · 2021-01-29 17:40:11

ok it works! thanks you guys for all of your help!

Arch Linux

#1 2021-01-29 01:32:51

[sovled] systemD confuseion

#2 2021-01-29 01:48:15

Re: [sovled] systemD confuseion

#3 2021-01-29 02:39:58

Re: [sovled] systemD confuseion

#4 2021-01-29 03:09:49

Re: [sovled] systemD confuseion

#5 2021-01-29 03:10:50

Re: [sovled] systemD confuseion

#6 2021-01-29 03:18:51

Re: [sovled] systemD confuseion

#7 2021-01-29 03:27:45

Re: [sovled] systemD confuseion

#8 2021-01-29 03:43:16

Re: [sovled] systemD confuseion

#9 2021-01-29 03:45:46

Re: [sovled] systemD confuseion

#10 2021-01-29 04:10:15

Re: [sovled] systemD confuseion

#11 2021-01-29 04:25:55

Re: [sovled] systemD confuseion

#12 2021-01-29 04:30:08

Re: [sovled] systemD confuseion

#13 2021-01-29 04:33:59

Re: [sovled] systemD confuseion

#14 2021-01-29 17:40:11

Re: [sovled] systemD confuseion

Board footer