<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Thanks for the pointer. It turns out that Ubuntu puts
IPAddressDeny=all in systemd-udevd.service. I suppose I could
remove that (reducing protection, as you note) or add an
IPAddressAllow setting to allow access to the DNS server and
remote URL I want to hit, but then I have to worry about keeping
that in sync with the IP address associated with the host name in
the URL. I think it's probably just easier to do this with a timer
that runs a polling script every five seconds, rather than using
udev.</p>
<p> jik<br>
</p>
<div class="moz-cite-prefix">On 8/15/18 7:13 AM, Sietse van Zanen
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:9aac76b95b6843bd8a0cce78d92e00a6@wizdom.nu">
<pre class="moz-quote-pre" wrap="">Jonathan,
Yes that is exactly the case. Look inside he unit filre, systemd-udevd.service. It contains lines like:
PrivateMounts=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
SystemCallFilter=@system-service @module @raw-io
SystemCallErrorNumber=EPERM
SystemCallArchitectures=native
LockPersonality=yes
I think the SystemCallFilter is your culplrit here. Removing it will probably make your script work, but it may also remove important protection.
-Sietse
________________________________
From: systemd-devel <a class="moz-txt-link-rfc2396E" href="mailto:systemd-devel-bounces@lists.freedesktop.org"><systemd-devel-bounces@lists.freedesktop.org></a> on behalf of Jonathan Kamens <a class="moz-txt-link-rfc2396E" href="mailto:jik@kamens.us"><jik@kamens.us></a>
Sent: Wednesday, August 15, 2018 10:31
To: <a class="moz-txt-link-abbreviated" href="mailto:systemd-devel@lists.freedesktop.org">systemd-devel@lists.freedesktop.org</a>
Subject: [systemd-devel] udev script can't resolve host name
Hi,
If I understand correctly, this mailing list can be used for questions about udev as well as about systemd. If that's not correct, somebody please let me know and I will go elsewhere (and if you know where that "elsewhere" should be, please let me know, that would be helpful!); I don't mean to use the list incorrectly.
I want to call a webhook inside a script run via a RUN directive in a udev rule.
When I try to do this, curl says it's unable to resolve the host name of the URL I am asking it to fetch.
To collect more data about the cause of this issue, I also tried doing a "ping -c 1 8.8.8.8" inside the script, and it gets, "sendmsg: Operation not permitted."
I assume this means udev scripts are running inside some sort of restricted environment or something, but I can't figure out what controls the restrictions on that environment, whether I can loosen them, or how.
I'm on Ubuntu 18.04.
Any advice?
Thank you,
Jonathan Kamens
</pre>
</blockquote>
</body>
</html>