[SOLVED] Confusion about Systemd ProtectHome and ReadOnlyPaths

Xyne · 2021-12-07 18:53:47

I would like to configure a service run run as a user with read-only access a single file in the user's home directory.

The following works:

ReadOnlyPaths=/home/user/path/to/foo
ProtectHome=read-only

but the ReadOnlyPaths obviously does nothing here since all of home is read-only. I would expect the following to work but it doesn't:

ReadOnlyPaths=/home/user/path/to/foo
ProtectHome=true

Am I missing something or does ProtectHome=true make it impossible to access anything under home? Do I need to use a bind mount instead to achieve the desired effect (only one file readable under home)?

And is there any way to grant a dynamic user access to a single file under a real user's home directory while hiding everything else, under the assumption that only the real user has access to it under regular file permissions?

Concretely, I want to create a service template (e.g. run_script@.service) to run different scripts in a user's home directory while completely isolating everything on the system. My failed approach was to use

ReadOnlyPaths=%I
ProtectHome=read-only

Last edited by Xyne (2021-12-08 01:35:40)

ewaller · 2021-12-07 19:03:15

Hey Xyne, people cannot respond to you in this subforum. You may want to pick another.

Xyne · 2021-12-07 21:46:06

Not the first time that I've made this mistake.
Moving...

progandy · 2021-12-07 22:04:31

Here are the relevant sections of the systemd manpages:

man systemd.exec wrote:

...
ProtectHome=
Takes a boolean argument or the special values "read-only" or "tmpfs". If true, the directories /home/, /root, and /run/user are made inaccessible and empty for processes invoked by this unit. If
set to "read-only", the three directories are made read-only instead. If set to "tmpfs", temporary file systems are mounted on the three directories in read-only mode. The value "tmpfs" is useful
to hide home directories not relevant to the processes invoked by the unit, while still allowing necessary directories to be made visible when listed in BindPaths= or BindReadOnlyPaths=.
Setting this to "yes" is mostly equivalent to set the three directories in InaccessiblePaths=. Similarly, "read-only" is mostly equivalent to ReadOnlyPaths=, and "tmpfs" is mostly equivalent to
TemporaryFileSystem= with ":ro".
...
Paths listed in InaccessiblePaths= will be made inaccessible for processes inside the namespace along with everything below them in the file system hierarchy. This may be more restrictive than
desired, because it is not possible to nest ReadWritePaths=, ReadOnlyPaths=, BindPaths=, or BindReadOnlyPaths= inside it. For a more flexible option, see TemporaryFileSystem=.

Xyne · 2021-12-08 01:35:11

@progandy
Thanks. I had actually tried the different combinations of read-only, true and tmpfs with and without binds but rereading the documentation carefully to the example under TemporaryFileSystem:

TemporaryFileSystem=/var:ro
BindReadOnlyPaths=/var/lib/systemd

The equivalent didn't work with my unit but that finally led me to the real problem: an incorrect SystemCallArchitectures and UMask.

Between posting in the wrong forum, not having read the docs carefully and the error being somewhere else, I'm on a roll!

I'm marking as solved but I would still be interesting if anyone knows a way to grant the dynamic user read-only access to another user's file under a tmpfs home directory.

progandy · 2021-12-08 04:53:08

Xyne wrote:

I'm marking as solved but I would still be interesting if anyone knows a way to grant the dynamic user read-only access to another user's file under a tmpfs home directory.

As far as I know, If the owner has not granted permissions sufficient for the other (non-root) user, then it is impossible without bindfs (which you packaged in the AUR), but it that is not integrated in systemd.
Edit: maybe you could run it with execstart(pre) with an exclamation mark prefix (!/bin/foo) as described in Table 1 in systemd.service

Anyways, I do not see much use for that. If you do need to run a user script as a restricted system service, you need root access to create the service anyways. Then you could also create a hardlink or copy in an accessible location.

Last edited by progandy (2021-12-08 05:08:13)

Xyne · 2021-12-10 02:36:11

Moving back to system administration where it belongs

Arch Linux

#1 2021-12-07 18:53:47

[SOLVED] Confusion about Systemd ProtectHome and ReadOnlyPaths

#2 2021-12-07 19:03:15

Re: [SOLVED] Confusion about Systemd ProtectHome and ReadOnlyPaths

#3 2021-12-07 21:46:06

Re: [SOLVED] Confusion about Systemd ProtectHome and ReadOnlyPaths

#4 2021-12-07 22:04:31

Re: [SOLVED] Confusion about Systemd ProtectHome and ReadOnlyPaths

#5 2021-12-08 01:35:11

Re: [SOLVED] Confusion about Systemd ProtectHome and ReadOnlyPaths

#6 2021-12-08 04:53:08

Re: [SOLVED] Confusion about Systemd ProtectHome and ReadOnlyPaths

#7 2021-12-10 02:36:11

Re: [SOLVED] Confusion about Systemd ProtectHome and ReadOnlyPaths

Board footer