I've set up shadowsocks-libev and have been running it with the following systemctl service:
[Unit] Description=Shadowsocks-Libev Manager Service Wants=network-online.target After=network-online.target [Service] Type=simple User=nobody CapabilityBoundingSet=CAP_NET_BIND_SERVICE ExecStart=/usr/bin/ss-manager -c /etc/shadowsocks/%i.json [Install] WantedBy=multi-user.target
I recently noticed that my shadowsocks config file (
/etc/shadowsocks/manager.json) had global read permissions, so I changed it to 600 and made sure the owner was
nobody. For some reason this causes the process to fail to read the configuration file when starting up.
systemctl start firstname.lastname@example.org
ss-manager: 2018-01-05 11:41:00 ERROR: Invalid config path.
This is the same error I see as when I revoke all read privileges for that file.
However, it works fine if I start shadowsocks using the exact same command from the command line:
sudo -u nobody /usr/bin/ss-manager -c /etc/shadowsocks/manager.json
Similarly, I have no trouble reading the file as
When I check the process started by
ps it shows that it's running as
nobody, and when the process outputs files the owner is set to
nobody. Why can't it access this file? Why is there a difference between running it through systemctl and running it from the terminal?
My problem seems similar to this question, but I don't have any quotes in my ExecStart so that solution is not applicable in my case.