1

I want to run fossil as systemd service under non-root user.

useradd  -r fossil

touch /etc/systemd/system/fossil.service

fossil.service file:

[Unit]
User=fossil
Group=fossil
Description=Fossil Service
After=network.target
StartLimitIntervalSec=0
 
[Service]
Type=simple
User=fossil
Group=fossil
WorkingDirectory=/opt/fossil/repos
ExecStart=/usr/bin/fossil server --localhost  --port 9000 --repolist  /opt/fossil/repos
Restart=always
RestartSec=3
 
[Install]
WantedBy=multi-user.target

Fossil user/group is an owner of /opt/fossil directory.

sudo systemctl daemon-reload
sudo systemctl stop fossil
sudo systemctl start fossil
sudo systemctl status fossil -l

Output:

fossil.service - Fossil Service
       Loaded: loaded (/etc/systemd/system/fossil.service; enabled; vendor preset: enabled)
       Active: activating (auto-restart) (Result: exit-code) since Mon 2022-09-26 17:59:10 CEST; 1s ago
      Process: 2015 ExecStart=/usr/bin/fossil server --localhost --port 9000 --repolist /opt/fossil/repos (code=exited, status=200/CHDIR)
     Main PID: 2015 (code=exited, status=200/CHDIR)

sudo journalctl -u fossil

Print output:

.... systemd[12954]: fossil.service: Changing to the requested working directory failed: Permission denied
Sep 27 systemd[12954]: fossil.service: Failed at step CHDIR spawning /usr/bin/fossil: Permission denied
Sep 27 systemd[1]: fossil.service: Main process exited, code=exited, status=200/CHDIR
Sep 27 systemd[1]: fossil.service: Failed with result 'exit-code'.
Sep 27 systemd[1]: fossil.service: Service RestartSec=3s expired, scheduling restart.
Sep 27 systemd[1]: fossil.service: Scheduled restart job, restart counter is at 1.
Sep 27 systemd[1]: Stopped Fossil Service.
Sep 27 systemd[1]: Started Fossil Service.
ls -all /opt/fossil
drwxr-xr-x 4 fossil fossil 4096 Sep 27 repos

If I remove line

User=fossil

Everything work fine.

How can I fossil as fossil user

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Kusalananda
    Sep 27, 2022 at 22:55

1 Answer 1

0

I don't know anything about fossil, but your problem is clearly related to permissions.

If you ever ran sudo fossil ... /opt/fossil/repos, then it is possible that you now have a file in that directory which is owned by root and not world-writable.

A catch-all solution would be:

sudo chown -R fossil:fossil /opt/fossil

A slightly more targeted approach would be

sudo chown -R fossil:fossil /opt/fossil/repos

This will recursively change ownership of all files/directories it needs to fossil.

This is usually safe to do in /opt/<package>/ because /opt usually contains relocatable packages which are not dependencies of other packages and contents which are intended to be run in their own little world anyways.

I am even more comfortable with this because the binary /usr/bin/fossil is not in /opt and so fossil will not be able to overwrite itself.

But it's good to offer as narrow of permissions as possible. So see what's in /opt/fossil. If it is split up into the traditional bin/, etc/, lib/, var/, then do this on var/ only. If it has configuration files that it should not touch itself, then ensure those are not owned by fossil. If it clearly has a read-write data directory, like /opt/fossil/repos, then chown that directory only.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .