systemd service timeout when using sudo

Question

Target

I am trying to run a service (transmission-daemon) in a network namespace for VPN usage. The service should automatically start using systemd.

Implementation details

I am using namespaced-openvpn to create a network namespace. For this I have created the systemd unit file /lib/systemd/system/namespaced-openvpn.service:

[Unit]
Description=Namespaced OpenVPN
After=network.target

[Service]
User=root
Type=notify
ExecStart=/usr/local/sbin/namespaced-openvpn --config /etc/openvpn/myconfig.conf
ExecStop=/bin/kill -s STOP $MAINPID
ExecReload=/bin/kill -s HUP $MAINPID

[Install]
WantedBy=multi-user.target

This works as expected, after starting the service I can open a shell in the network namespace with the following command:

sudo ip netns exec protected sudo -u myuser -i

Running transmission-daemon from this shell also works.

Trying to automate this process I created the unit file /lib/systemd/system/transmission-daemon-vpn.service:

[Unit]
Description=Transmission BitTorrent Daemon in VPN Tunnel
After=namespaced-openvpn.service

[Service]
User=root
Type=notify
ExecStart=ip netns exec protected /usr/bin/sudo -u myuser /usr/bin/transmission-daemon -f --log-error
#ExecStart=/usr/bin/transmission-daemon -f --log-error
ExecStop=/bin/kill -s STOP $MAINPID
ExecReload=/bin/kill -s HUP $MAINPID
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target

Using the commented line as ExecStart works, but is not using the VPN of course. Leaving out /usr/bin/sudo -u myuser also works but I need the daemon to run as a specific user.

Problem

Starting transmission-daemon-vpn fails with following error:

Job for transmission-daemon-vpn.service failed because a timeout was exceeded.
See "systemctl status transmission-daemon-vpn.service" and "journalctl -xe" for details.

---

# systemctl status transmission-daemon-vpn.service

● transmission-daemon-vpn.service - Transmission BitTorrent Daemon in VPN Tunnel
     Loaded: loaded (/lib/systemd/system/transmission-daemon-vpn.service; disabled; vendor preset: enabled)
     Active: failed (Result: timeout) since Wed 2023-01-04 16:13:16 CET; 7min ago
    Process: 8116 ExecStart=ip netns exec protected /usr/bin/sudo -u myuser /usr/bin/transmission-daemon -f --log-error (code=exited, status=0/SUCCESS)
   Main PID: 8116 (code=exited, status=0/SUCCESS)
        CPU: 6.936s

Jan 04 16:11:42 nas systemd[1]: Starting Transmission BitTorrent Daemon in VPN Tunnel...
Jan 04 16:11:42 nas sudo[8116]:     root : PWD=/ ; USER=myuser ; COMMAND=/usr/bin/transmission-daemon -f --log-error
Jan 04 16:11:42 nas sudo[8116]: pam_unix(sudo:session): session opened for user myuser(uid=1000) by (uid=0)
Jan 04 16:13:12 nas systemd[1]: transmission-daemon-vpn.service: start operation timed out. Terminating.
Jan 04 16:13:16 nas ip[8117]: Closing transmission session... done.
Jan 04 16:13:16 nas sudo[8116]: pam_unix(sudo:session): session closed for user myuser
Jan 04 16:13:16 nas systemd[1]: transmission-daemon-vpn.service: Failed with result 'timeout'.
Jan 04 16:13:16 nas systemd[1]: Failed to start Transmission BitTorrent Daemon in VPN Tunnel.
Jan 04 16:13:16 nas systemd[1]: transmission-daemon-vpn.service: Consumed 6.936s CPU time.

Answer 1

Thanks to Tom Yan for the right hint, i.e. using NetworkNamespacePath=.
This is how /lib/systemd/system/transmission-daemon-vpn.service looks now:

[Unit]
Description=Transmission BitTorrent Daemon in VPN Tunnel
After=namespaced-openvpn.service

[Service]
User=myuser
Type=notify
NetworkNamespacePath=/var/run/netns/protected
ExecStart=/usr/bin/transmission-daemon -f --log-error
ExecStop=/bin/kill -s STOP $MAINPID
ExecReload=/bin/kill -s HUP $MAINPID
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target