Arch Linux

Xixor

Member

Registered: 2015-06-04

Posts: 3

Help getting systemd to execute script requiring access to gpg

TLDR - I need help setting up a systemd service that can execute a custom script, where in that custom script there is a command that requires access to an unlocked gpg-agent daemon.

I have a custom script - /home/xixor/bin/test.zsh, like this:

#!/bin/zsh

PASSWORD=$(pass alpine-vm/xixor-passwd)
echo $PASSWORD | ssh -tt xixor@xxx.xxx.xxx.xxx "sudo docker-compose -f /home/xixor/docker/docker-compose.yml stop"

I use gpg-agent to cache the password that unlocks my gpg key, which pass needs unlocked in order to produce the password referenced in the code above. The script works fine when I run it from the command line. The script also works if I use cron to run the script (using my user's crontab). When I tried to create a systemd service unit that executes this script, it fails.

Systemd service unit located at /home/xixor/.config/systemd/user/test@xixor.service started with "systemctl --user start test@xixor.service":

[Unit]
Description=test - service
Wants=test@xixor.timer

[Service]
Type=oneshot
ExecStart="/home/xixor/bin/test.zsh"

[Install]
WantedBy=multi-user.target

Failure messages in the log:

systemd[638]: Starting test - service...
test.zsh[596846]: Permission denied, please try again.
test.zsh[596846]: Permission denied, please try again.
test.zsh[596849]: ssh_askpass: exec(/usr/lib/ssh/ssh-askpass): No such file or directory
test.zsh[596846]: xixor@xxx.xxx.xxx.xxx: Permission denied (publickey,password).

I have a dim enough understanding of what is going on to know that systemd runs in a limited environment and does not have access to my unlocked gpg-agent daemon, but do not know enough to troubleshoot this on my own. Any help much appreciated!

Edit - I think my situation is more or less the same as the one posted here with no answers: https://superuser.com/questions/1090844 … d-gpg-keys

Edit 2 - I found a section of the arch wiki on systemd/User that describes importing environmental variables. Running

systemctl --user import-environment

appears to import all my user environmental variables, including

SSH_AUTH_SOCK=/run/user/1000/gnupg/S.gpg-agent.ssh

, which I believe is what I needed. The systemd service unit successfully runs the script so long as my gpg key is cached with gpg-agent.

Last edited by Xixor (2021-03-02 12:31:55)