6

I have a service that I start using systemd. The service user and group are changed to a non-privileged user.

[Service]
...
User=regular_user
Group=regular_user
...

At some point the service needs to start another process, which is expected to become root. That other process has its 's' bit set and it uses setuid() to become root.

The process works just fine if I start it. However, somehow, when the service tries to start it, the setuid() function returns with an error:

Operation not permitted.

I've seen some options about capabilities, but I have no clue whether those are what needs to be used to keep the setuid() capability working in my service. I tried a few things and none helped so far.

For example, I tried that:

AmbientCapabilities=CAP_SETGID CAP_SETUID
SecureBits=keep-caps

And although the process does not seem to generate an error anymore, it still does not do what it is supposed to do (again, if I run that process in my console, it works just fine!)

8

I actually found the NoNewPrivileges= option that allows my process children to use the setuid().

From what they are saying, it is certainly not an option one should lightly choose to use. However, the default is: do not allow the setuid() feature. (what they mean by «elevate privileges».)

What worked for me was to do this:

NoNewPrivileges=false

Note that the documentation does not clearly say that the default for this option is true on Ubuntu 16.04. This may vary depending on the OS.

  • On which OS and version was the default tested to be set to true? – Mark Stosberg Oct 10 '16 at 14:19
  • 1
    @MarkStosberg, I added the OS info in the answer. – Alexis Wilke Oct 10 '16 at 17:05
  • 2
    After I filled a bug report, the default value for this is now documented. It defaults to false for system services, but can be defaulted to true for user-managed services if certain other directives are set. Details are here: github.com/systemd/systemd/commit/… – Mark Stosberg Oct 28 '16 at 15:18
  • 1
    @MarkStosberg, thank you for fixing the docs. That's a big job for such a large project. – Alexis Wilke Oct 28 '16 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.