rsyncd service ProtectSystem=off has no effect

Question

I'm running Debian 11 with rsyncd 3.2, which has ProtectSystem=full as default.

I'd like to override that, so am using systemctl edit to do so. Here's what I'm putting in the override:

### Editing /etc/systemd/system/rsync.service.d/override.conf
### Anything between here and the comment below will become the new contents of the file

[Service]
ProtectSystem=off

### Lines below this comment will be discarded

The logs report no parsing errors with this and the unit (I think) reloads with the new configuration.

However, I still get "Read-only file system" errors when trying to rsync in to paths in /etc (for example).

What is wrong that I can't override this restriction? Or is this restriction not the issue? The configuration was working fine on Debian 10 before I upgraded to Debian 11, so I assume it the ProtectSystem that's causing the problem.

EDIT: Here's the config in /etc/rsyncd.conf I'm using:

[nameOfMount]
     path = /etc/postfix
     auth users = sysadmin
     secrets file = /etc/rsyncd.secrets
     hosts allow = xxx.xxx.xxx.xxx 
     read only = false
     uid = root
     pre-xfer exec = /usr/local/bin/scriptA.sh
     post-xfer exec = /usr/local/bin/scriptB.sh

The pro/post exec scripts make backup copies of files being transferred, and reload the postfix daemon. The errors from these are for example:

rsync error: requested action not supported (code 4) at clientserver.c(1098) [Receiver=3.2.3]
/bin/cp: cannot create regular file '/etc/postfix/fileName.yyyymmddd': Read-only file system

Answer 1

Let's start with a status check

systemctl show rsync | grep -E 'ProtectSystem|NoNewPrivileges'

On my unmodified system this returns

ProtectSystem=full
NoNewPrivileges=yes

I've picked up on NoNewPrivileges because this setting prevents rsyncd changing its UID.

Now let's look at the time that the rsync daemon was restarted, and make a note of it (22:53 in my case):

ps -ef | grep '[r]sync --daemon'

root     22600     1  0 22:53 ?        00:00:00 /usr/bin/rsync --daemon --no-detach

If I add your two lines to the override,

systemctl edit rsync

[Service]
ProtectSystem=off

I then get this

systemctl show rsync | grep -E 'ProtectSystem|NoNewPrivileges'

ProtectSystem=no
NoNewPrivileges=yes

But the rsync daemon is not restarted:

ps -ef | grep '[r]sync --daemon'

root     22600     1  0 22:53 ?        00:00:00 /usr/bin/rsync --daemon --no-detach

And indeed I find I must do this manually

systemctl restart rsync
ps -ef | grep '[r]sync --daemon'

root     22770     1  1 22:56 ?        00:00:00 /usr/bin/rsync --daemon --no-detach

However, the filesystem is still in read-only mode. We need the extra line:

systemctl edit rsync

[Service]
ProtectSystem=off
NoNewPrivileges=no

Followed by a restart,

systemctl restart rsync

And a final sanity-check,

systemctl show rsync | grep -E 'ProtectSystem|NoNewPrivileges'

On my system this returns the desired end game, which allows me to write to files and directories underneath /etc:

ProtectSystem=no
NoNewPrivileges=no