I've set up shadowsocks-libev and have been running it with the following systemctl service:
[Unit]
Description=Shadowsocks-Libev Manager Service
Wants=network-online.target
After=network-online.target
[Service]
Type=simple
User=nobody
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
ExecStart=/usr/bin/ss-manager -c /etc/shadowsocks/%i.json
[Install]
WantedBy=multi-user.target
I recently noticed that my shadowsocks config file (/etc/shadowsocks/manager.json
) had global read permissions, so I changed it to 600 and made sure the owner was nobody
. For some reason this causes the process to fail to read the configuration file when starting up.
systemctl start shadowsocks-libev-manager@manager.service
ss-manager[1357]: 2018-01-05 11:41:00 ERROR: Invalid config path.
This is the same error I see as when I revoke all read privileges for that file.
However, it works fine if I start shadowsocks using the exact same command from the command line:
sudo -u nobody /usr/bin/ss-manager -c /etc/shadowsocks/manager.json
Similarly, I have no trouble reading the file as nobody
using cat
or less
.
When I check the process started by systemctl
in ps
it shows that it's running as nobody
, and when the process outputs files the owner is set to nobody
. Why can't it access this file? Why is there a difference between running it through systemctl and running it from the terminal?
My problem seems similar to this question, but I don't have any quotes in my ExecStart so that solution is not applicable in my case.
/etc/shadowsocks
? – Hauke Laging Jan 8 '18 at 20:57/etc/shadowsocks/
hasrwxr-xr-x
permissions. – Altay_H Jan 8 '18 at 21:10/usr/bin/strace -o /tmp/nobody.strace -f /usr/bin/ss-manager -c /etc/shadowsocks/manager.json
and have a look at the file/tmp/nobody.strace
afterwards. That might give you some clue. – Hauke Laging Jan 8 '18 at 21:27/usr/bin/strace: Can't fopen '/tmp/nobody.strace': Permission denied
. Running it directly from the terminal (withsudo -u nobody
) produces the trace file and behaves as expected. I think the usernobody
must be restricted in some strange way. – Altay_H Jan 8 '18 at 21:46strace -p 1 -f
to understand how this process is modified. – Hauke Laging Jan 8 '18 at 22:06