3

I've set up shadowsocks-libev and have been running it with the following systemctl service:

[Unit]
Description=Shadowsocks-Libev Manager Service
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=nobody
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
ExecStart=/usr/bin/ss-manager -c /etc/shadowsocks/%i.json

[Install]
WantedBy=multi-user.target

I recently noticed that my shadowsocks config file (/etc/shadowsocks/manager.json) had global read permissions, so I changed it to 600 and made sure the owner was nobody. For some reason this causes the process to fail to read the configuration file when starting up.

systemctl start shadowsocks-libev-manager@manager.service

ss-manager[1357]: 2018-01-05 11:41:00 ERROR: Invalid config path.

This is the same error I see as when I revoke all read privileges for that file.

However, it works fine if I start shadowsocks using the exact same command from the command line:

sudo -u nobody /usr/bin/ss-manager -c /etc/shadowsocks/manager.json

Similarly, I have no trouble reading the file as nobody using cat or less.

When I check the process started by systemctl in ps it shows that it's running as nobody, and when the process outputs files the owner is set to nobody. Why can't it access this file? Why is there a difference between running it through systemctl and running it from the terminal?

My problem seems similar to this question, but I don't have any quotes in my ExecStart so that solution is not applicable in my case.

Improve this question
5
  • What are the permissions of /etc/shadowsocks? – Hauke Laging Jan 8 '18 at 20:57
  • /etc/shadowsocks/ has rwxr-xr-x permissions. – Altay_H Jan 8 '18 at 21:10
  • 1
    I do not have a good idea what could be the problem but you could use this command instead /usr/bin/strace -o /tmp/nobody.strace -f /usr/bin/ss-manager -c /etc/shadowsocks/manager.json and have a look at the file /tmp/nobody.strace afterwards. That might give you some clue. – Hauke Laging Jan 8 '18 at 21:27
  • I like the idea, but when I put that in ExecStart I get /usr/bin/strace: Can't fopen '/tmp/nobody.strace': Permission denied. Running it directly from the terminal (with sudo -u nobody) produces the trace file and behaves as expected. I think the user nobody must be restricted in some strange way. – Altay_H Jan 8 '18 at 21:46
  • Maybe it helps to run strace -p 1 -f to understand how this process is modified. – Hauke Laging Jan 8 '18 at 22:06
1

I was able to fix the problem, which stemmed from something unique to the user nobody. I'm still not entirely sure what makes that user unique though.

When run as nobody I see the following output in journald:

Started Shadowsocks-Libev Manager Service.
ERROR: Invalid config path.
Main process exited, code=exited, status=255/n/a
Failed with result 'exit-code'.

This is indicative of it being unable to access the config file despite having the necessary permissions.

When run as a different user I newly created (with no home directory) I see the following output in journald instead:

Started Shadowsocks-Libev Manager Service.
ERROR: mkdir: No such file or directory
ERROR: unable to create working directory
Main process exited, code=exited, status=255/n/a
Failed with result 'exit-code'.

This is because it attempts to write to the user's home directory which does not exist.

I then created a new user named shadowsocks with its own home directory:

# useradd -m -s /usr/bin/nologin shadowsocks

Running as this user I encounter no problems.

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.