openvpn route-up script fails when run from systemctl

Question

I have a set of programs that must run through VPN and shouldn't have internet access when VPN is not connected on Arch Linux. I do this by creating a network namespace that would contains VPN network interface as the only way to access internet and running those processes in that network namespace.

The issue that I am facing is that while it works fine if I run openvpn as root, but does not work if I run it through systemctl.

OpenVPN configuration:

client
route-noexec
script-security 2
dev tun42
proto udp
remote <remotehost> <remoteport>
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/client/ca.crt
tls-client
remote-cert-tls server
auth-user-pass /etc/openvpn/client/vpn-creds
comp-lzo
verb 1
reneg-sec 0
crl-verify /etc/openvpn/client/crl.pem
route-up /etc/openvpn/client/route-up.sh

route-up.sh:

#!/bin/bash
/bin/whoami

NS=ns

if [ ! -f /var/run/netns/$NS ]; then
    /sbin/ip netns add $NS
fi

/sbin/ip link set $dev netns $NS
/sbin/ip netns exec $NS /sbin/ifconfig lo up
/sbin/ip netns exec $NS /sbin/ifconfig $dev $ifconfig_local pointopoint $ifconfig_remote up
/sbin/ip netns exec $NS /sbin/route add default gw $ifconfig_remote metric 1024

The output of systemctl status openvpn-clien@vpn after trying to start it:

Feb 18 11:57:22 arch openvpn[5216]: root
Feb 18 11:57:22 arch openvpn[5216]: mount --make-shared /var/run/netns failed: Operation not permitted
Feb 18 11:57:22 arch openvpn[5216]: Error: argument "ns" is wrong: Invalid "netns" value
Feb 18 11:57:22 arch openvpn[5216]: Cannot open network namespace "ns": No such file or directory
Feb 18 11:57:22 arch openvpn[5216]: Cannot open network namespace "ns": No such file or directory
Feb 18 11:57:22 arch openvpn[5216]: Cannot open network namespace "ns": No such file or directory
Feb 18 11:57:22 arch openvpn[5216]: WARNING: Failed running command (--route-up): external program exited with error status: 1
Feb 18 11:57:22 arch openvpn[5216]: Initialization Sequence Completed

Same behavior exhibited regardless of whether it ran manually, or automatically on system startup if I enable the service.

systemctl cat [email protected] output:

# /usr/lib/systemd/system/[email protected]
[Unit]
Description=OpenVPN tunnel for %I
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn/client
ExecStart=/usr/bin/openvpn --suppress-timestamps --nobind --config %i.conf
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
KillMode=process

[Install]
WantedBy=multi-user.target

How do I make it properly set up network namespace when run through systemctl?

Answer 1

Had a similar issue with ssh up/down scripts (without using selinux) until I found this question.

Although the question is quite old, I solved it by changing the following sandboxing options in the service definition:

ProtectSystem=true
#ProtectHome=true
ProtectHome=read-only

Maybe this helps someone else. More info can be found here.

Answer 2

I also recently had this issue and it turned out to be selinux. Here is what you can do to mitigate:

cd /etc/openvpn
mkdir -p scripts
chown -R root:root scripts
chmod 0700 scripts
cd scripts
# create up and down scripts here
# placing scripts in this directory is important!!
# restorecon must be run 
restorecon -R /etc/openvpn/scripts/
setsebool openvpn_run_unconfined on

In short, selinux has a precanned configuration that can allow up and down scripts to run so long as they are placed in /etc/openvpn/scripts. Once the scripts are placed in that directory, running restorecon will make sure the proper selinux flags are set on your scripts, and setting the sebool to on will then allow the up and down scripts to run.