How to add the Kanata service, which runs as a systemd dynamic user, to a group?

randomz · November 27, 2024, 1:35am

There is a bug/feature in Systemd which renders SupplementaryGroups not working with dynamic users

SupplementaryGroups= does not work with dynamic groups

opened 02:07PM - 19 Feb 18 UTC

RFE 🎁 pid1

### Submission type - Bug report ### systemd version the issue has be…en seen with 237 ### Used distribution Exherbo Linux ### In case of bug report: Expected behaviour you didn't see ```bash [root@delta] /run/systemd/system # cat foo.service ``` ```ini [Unit] Requires=create-dynamic-user-group-bar.service After=create-dynamic-user-group-bar.service [Service] DynamicUser=1 User=foo Group=foo ExecStart=/usr/bin/sleep 10 SupplementaryGroups=bar ``` ```bash [root@delta] /run/systemd/system # cat create-dynamic-user-group-bar.service ``` ```ini [Unit] BindsTo=foo.service Before=foo.service [Service] Type=simple DynamicUser=1 User=bar Group=bar ExecStart=/bin/sleep infinity ``` Service foo starting properly with user foo and group foo,bar. ### In case of bug report: Unexpected behaviour you saw ``` Feb 19 delta systemd[1]: Started create-dynamic-user-group-bar.service. Feb 19 delta systemd[1]: Started foo.service. Feb 19 delta systemd[26529]: foo.service: Failed to determine supplementary groups: No such process Feb 19 delta systemd[26529]: foo.service: Failed at step GROUP spawning /usr/bin/sleep: No such process Feb 19 delta systemd[1]: foo.service: Main process exited, code=exited, status=216/GROUP Feb 19 delta systemd[1]: foo.service: Failed with result 'exit-code'. Feb 19 delta systemd[1]: foo.service: Consumed 0 CPU time, received 0B IP traffic, sent 0B IP traffic Feb 19 delta systemd[1]: Stopping create-dynamic-user-group-bar.service... Feb 19 delta systemd[1]: Stopped create-dynamic-user-group-bar.service. Feb 19 delta systemd[1]: create-dynamic-user-group-bar.service: Consumed 3ms CPU time, received 0B IP traffic, sent 0B IP traffic ``` ### In case of bug report: Steps to reproduce the problem Described above, use those services and try running foo.service. In https://github.com/systemd/systemd/issues/7253, @poettering wrote, > So, as it turns out we already support what's proposed here, to some point at least. Here's an example using systemd-run. On the first terminal, try this: > # systemd-run -p DynamicUser=1 -p User=quux1 -p Group=quux -t /bin/bash Running as unit: run-u1694.service Press ^] three times within 1s to disconnect TTY. bash-4.4$ id uid=63920(quux1) gid=62115(quux) groups=62115(quux) context=system_u:system_r:initrc_t:s0 bash-4.4$ And then, on a second terminal, do this: > # systemd-run -p DynamicUser=1 -p User=quux2 -p Group=quux -t /bin/bash Running as unit: run-u1705.service Press ^] three times within 1s to disconnect TTY. bash-4.4$ id uid=65438(quux2) gid=62115(quux) groups=62115(quux) context=system_u:system_r:initrc_t:s0 bash-4.4$ having tested this locally, * Group= will accept dynamic groups created before the service is started. * SupplementaryGroups= would not accept dynamic groups created before the service is started and cause the service to fail. P.S. There is also some scope of improvement wrt the error message, it isn't really clear what it is trying to say.