<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-4">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="en-SE" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US">Hi Andrei,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US">As indicated in the logs no SELINUX nor APPARMOR is enabled.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;color:black;mso-fareast-language:EN-US">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black;mso-fareast-language:EN-US">Christopher Wong<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div id="mail-editor-reference-message-container">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">From:
</span></b><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">systemd-devel <systemd-devel-bounces@lists.freedesktop.org> on behalf of Andrei Borzenkov <arvidjaar@gmail.com><br>
<b>Date: </b>Saturday, 9 December 2023 at 07:13<br>
<b>To: </b>systemd-devel@lists.freedesktop.org <systemd-devel@lists.freedesktop.org><br>
<b>Subject: </b>Re: [systemd-devel] Manual start of user@<uid>.service failed with permission denied<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">On 08.12.2023 23:53, Mantas Mikulėnas wrote:<br>
...<br>
<br>
>><br>
>> Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Will mount<br>
>> /run/user/1001 owned by 1001:118<br>
>><br>
>> Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Mounting tmpfs<br>
>> (tmpfs) on /run/user/1001 (MS_NOSUID|MS_NODEV<br>
>> "mode=0700,uid=1001,gid=118,size=99426304,nr_inodes=24274")...<br>
>><br>
>> Dec 08 17:33:29 host systemd[1]: Finished User Runtime Directory<br>
>> /run/user/1001.<br>
>><br>
>> Dec 08 17:33:29 host systemd[1]: Starting User Manager for UID 1001...<br>
>><br>
>> Dec 08 17:33:29 host systemd[36280]: systemd 254.7-2-g9edc143 running in<br>
>> user mode for user 1001/ida. (-PAM -AUDIT -SELINUX -APPARMOR +IMA -SMACK<br>
>> +SECCOMP +GCRYPT +GNUTLS +OPENSSL -ACL +BLKID +CURL -ELFUTILS -FIDO2 -IDN2<br>
>> -IDN -IPTC +KMOD -LIBCRYPTSETUP +LIBFDISK -PCRE2 -PWQUALITY -P11KIT<br>
>> -QRENCODE -TPM2 +BZIP2 -LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON -UTMP<br>
>> -SYSVINIT default-hierarchy=unified)<br>
>><br>
>> Dec 08 17:33:29 host systemd[36280]: Failed to create<br>
>> '/run/user/1001/systemd/inaccessible', ignoring: Permission denied<br>
>><br>
>> Dec 08 17:33:29 host systemd[36280]: Failed to create<br>
>> '/run/user/1001/systemd/inaccessible/reg', ignoring: Permission denied<br>
>><br>
>> Dec 08 17:33:29 host systemd[36280]: Failed to create<br>
>> '/run/user/1001/systemd/inaccessible/dir', ignoring: Permission denied<br>
>><br>
>> Dec 08 17:33:29 host systemd[36280]: Failed to create<br>
>> '/run/user/1001/systemd/inaccessible/fifo', ignoring: Permission denied<br>
>><br>
>> Dec 08 17:33:29 host systemd[36280]: Failed to create<br>
>> '/run/user/1001/systemd/inaccessible/sock', ignoring: Permission denied<br>
>><br>
>> Dec 08 17:33:29 host systemd[36280]: Failed to create<br>
>> '/run/user/1001/systemd/inaccessible/chr', ignoring: Permission denied<br>
>><br>
>> Dec 08 17:33:29 host systemd[36280]: Failed to create<br>
>> '/run/user/1001/systemd/inaccessible/blk', ignoring: Permission denied<br>
>><br>
> <br>
> What's the ownership of /run/user/1001 and /run/user/1001/systemd after all<br>
> of this?<br>
> <br>
> Are you rebooting between tests or just manually starting it?<br>
> <br>
> My current guess is that due to the earlier `systemctl set-environment`,<br>
> some *other* thing that's running as root inherited the /run/user/1001 path<br>
> and created root-owned directories there? That's the issue with setting<br>
> global environment, it needs to be unset afterwards...<br>
> <br>
<br>
"Permission denied" sounds like something LSM related (AppArmor, <br>
SELinux, ...)<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>