<div dir="ltr"><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Dec 13, 2023 at 10:36 AM Christopher Wong <<a href="mailto:Christopher.Wong@axis.com">Christopher.Wong@axis.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-5267624441854422983">
<div lang="en-SE" style="overflow-wrap: break-word;">
<div class="m_-5267624441854422983WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hi Mantas,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">I tried with StopWhenUnneeded=no in
<a href="mailto:user-runtime-dir@.service" target="_blank">user-runtime-dir@.service</a>, then when
<a href="mailto:user@1001.service" target="_blank">user@1001.service</a> fails the status of <a href="mailto:user-runtime-dir@.service" target="_blank">
user-runtime-dir@.service</a> is active. At this state the directory /run/user/1001 is created, it is empty, owned by root. Running the mount command doesn’t show /run/user/1001.</span></p></div></div></div></blockquote><div><br></div><div>Run the "<span>/usr/lib/systemd/systemd-user-runtime-dir start 1001" manually and check whether the mounted filesystem is there afterwards.</span></div><div><span><br></span></div><div><span>If it's still not there, then run "mount -t tmpfs -o uid=1001,mode=0700 none /run/user/1001" and then check whether it stays mounted.<br></span></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-5267624441854422983"><div lang="en-SE" style="overflow-wrap: break-word;"><div class="m_-5267624441854422983WordSection1">
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black"><u></u> <u></u></span></p>
<p class="m_-5267624441854422983p1"><span lang="EN-US" style="font-size:11pt;font-family:"Calibri",sans-serif;color:black">I have mentioned it before, but I want to point out that if I put “</span><span class="m_-5267624441854422983s1"><span style="font-size:11pt;font-family:"Calibri",sans-serif">ExecStartPre=+chown
%i /run/user/%i</span></span><span class="m_-5267624441854422983s1"><span lang="EN-US" style="font-size:11pt;font-family:"Calibri",sans-serif">” in
<a href="mailto:user@.service" target="_blank">user@.service</a> then the <a href="mailto:user@1001.service" target="_blank">
user@1001.service</a> can be started manually. The mount command doesn’t show /run/user/1001 either, but since the service is started the path contains bus socket and systemd directory with content, which are the things I am after.
</span></span><span lang="EN-US" style="font-size:11pt;font-family:"Calibri",sans-serif"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black">The main issue here is that /run/user/1001 is owned by root after
<a href="mailto:user-runtime-dir@.service" target="_blank">user-runtime-dir@.service</a> has been exited successfully.</span></p></div></div></div></div></blockquote><div><br></div><div>No, that's only a symptom of the main issue.</div><div><br></div><div>The current design that systemd implements is to have a user-specific tmpfs mounted at that location (for quota purposes), and so the underlying mountpoint is deliberately created as owned by root – its ownership is not changed because it's supposed to have a new filesystem mounted on top (which would make the mountpoint hidden and its ownership moot).<br></div><div><br></div><div>If you specifically want to *not* have an additional tmpfs there, then you can continue using the manual "ExecStartPre=chown" (or in fact you could replace the entire user-runtime-dir@ with a simpler one that only mkdirs and chowns), but in that case you shouldn't be saying that it's a systemd issue that it doesn't chown something that it was never meant to chown to begin with.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-5267624441854422983"><div lang="en-SE" style="overflow-wrap: break-word;"><div class="m_-5267624441854422983WordSection1"><div><p class="MsoNormal"><span lang="EN-US" style="color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black">Best regards,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black">Christopher Wong<u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<div id="m_-5267624441854422983mail-editor-reference-message-container">
<div>
<div style="border-width:1pt medium medium;border-style:solid none none;border-color:rgb(181,196,223) currentcolor currentcolor;padding:3pt 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12pt"><b><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:black">From:
</span></b><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:black">Mantas Mikulėnas <<a href="mailto:grawity@gmail.com" target="_blank">grawity@gmail.com</a>><br>
<b>Date: </b>Wednesday, 13 December 2023 at 08:08<br>
<b>To: </b>Christopher Wong <<a href="mailto:Christopher.Wong@axis.com" target="_blank">Christopher.Wong@axis.com</a>><br>
<b>Cc: </b>Systemd <<a href="mailto:systemd-devel@lists.freedesktop.org" target="_blank">systemd-devel@lists.freedesktop.org</a>><br>
<b>Subject: </b>Re: [systemd-devel] Manual start of user@<uid>.service failed with permission denied<u></u><u></u></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal">On Tue, Dec 12, 2023 at 6:15 PM Christopher Wong <<a href="mailto:Christopher.Wong@axis.com" target="_blank">Christopher.Wong@axis.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;border-color:currentcolor currentcolor currentcolor rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi Mantas,</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">After
<a href="mailto:user@1001.service" target="_blank">user@1001.service</a> failed, it trigger the stopping process and become inactive.</span><u></u><u></u></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Ah yeah, that makes sense, user-runtime-dir@ has StopWhenUnneeded=yes – so of course after user@1001 crashes you're not going to see anything mounted anymore.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Could you try temporarily removing that option / setting it to 'no', just to see what changes?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;border-color:currentcolor currentcolor currentcolor rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400s1">○ <a href="mailto:user-runtime-dir@1001.service" target="_blank">
user-runtime-dir@1001.service</a> - User Runtime Directory /run/user/1001</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">Loaded: loaded (<a href="mailto:/etc/systemd/system/user-runtime-dir@.service" target="_blank">/etc/systemd/system/user-runtime-dir@.service</a>; static)</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">Drop-In: /usr/lib/systemd/system/service.d</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">└─10-axis.conf, 20-axis-sandbox.conf</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">Active: inactive (dead) since Tue 2023-12-12 16:33:35 CET; 36min ago</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">Duration: 315ms</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">Docs: man:user@.service(5)</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">Process: 16325 ExecStartPre=ls -la /run/user (code=exited, status=0/SUCCESS)</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">Process: 16327 ExecStartPre=mount (code=exited, status=0/SUCCESS)</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">Process: 16329 ExecStart=/usr/lib/systemd/systemd-user-runtime-dir start 1001 (code=exited, status=0/SUCCESS)</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">Process: 16334 ExecStartPost=sleep 5 (code=exited, status=0/SUCCESS)</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">Process: 16347 ExecStartPost=ls -la /run/user/1001 (code=exited, status=0/SUCCESS)</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">Process: 16351 ExecStartPost=mount (code=exited, status=0/SUCCESS)</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">Process: 16361 ExecStop=/usr/lib/systemd/systemd-user-runtime-dir stop 1001 (code=exited, status=0/SUCCESS)</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">Main PID: 16329 (code=exited, status=0/SUCCESS)</span><u></u><u></u></p>
<p class="m_-5267624441854422983m5870886716831619400p1"><span class="m_-5267624441854422983m5870886716831619400apple-converted-space">
</span><span class="m_-5267624441854422983m5870886716831619400s1">CPU: 48ms</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">/etc/fstab don’t include anything on /run/user/1001 and there is no mount unit for run-user-1001.mount either.</span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black">Best regards,</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:black">Christopher Wong</span><u></u><u></u></p>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div id="m_-5267624441854422983m_5870886716831619400mail-editor-reference-message-container">
<div>
<div style="border-width:1pt medium medium;border-style:solid none none;padding:3pt 0cm 0cm;border-color:currentcolor">
<p class="MsoNormal" style="margin-bottom:12pt"><b><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:black">From:
</span></b><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:black">Mantas Mikulėnas <<a href="mailto:grawity@gmail.com" target="_blank">grawity@gmail.com</a>><br>
<b>Date: </b>Tuesday, 12 December 2023 at 17:05<br>
<b>To: </b>Christopher Wong <<a href="mailto:Christopher.Wong@axis.com" target="_blank">Christopher.Wong@axis.com</a>><br>
<b>Cc: </b>Systemd <<a href="mailto:systemd-devel@lists.freedesktop.org" target="_blank">systemd-devel@lists.freedesktop.org</a>><br>
<b>Subject: </b>Re: [systemd-devel] Manual start of user@<uid>.service failed with permission denied</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">That sounds like it's getting immediately unmounted (or maybe not being mounted at all despite the program doing so).<u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Does the user-runtime-dir service continue to show as "active" after this, or does it return to "inactive"?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Does your /etc/fstab have any mentions of /run/user/1001? Or more generally, are there any run-user-1001.mount units? (If you 'systemctl status' this unit, does the status include
a source path?)<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">On Tue, Dec 12, 2023, 17:34 Christopher Wong <<a href="mailto:Christopher.Wong@axis.com" target="_blank">Christopher.Wong@axis.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt;border-color:currentcolor currentcolor currentcolor rgb(204,204,204)">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi Mantas,</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">I currently have the following flow:</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<ol start="1" type="1">
<li class="MsoNormal">
<span lang="EN-US">No /run/user/1001 directory</span><u></u><u></u></li><li class="MsoNormal">
<span lang="EN-US">systemctl start <a href="mailto:user@1001.service" target="_blank">
user@1001.service</a></span><u></u><u></u></li><li class="MsoNormal">
<span lang="EN-US">systemd start <a href="mailto:user-runtime-dir@1001.service" target="_blank">
user-runtime-dir@1001.service</a> which ends successfully.</span><u></u><u></u></li><li class="MsoNormal">
<span lang="EN-US">The directory /run/user/1001 exists now, but is empty, owned by root with mode 0700</span><u></u><u></u></li><li class="MsoNormal">
<span lang="EN-US">I don’t have findmnt on my system, so I used mount, but /run/user/1001 is not listed.</span><u></u><u></u></li><li class="MsoNormal">
<span lang="EN-US">systemd start <a href="mailto:user@1001.service" target="_blank">
user@1001.service</a> which fails due to permission denied.</span><u></u><u></u></li></ol>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">I can’t explain why the /run/user/1001 is owned by root after
<a href="mailto:user-runtime-dir@1001.service" target="_blank">user-runtime-dir@1001.service</a> successfully exited. I added some personal print in systemd code to ensure that the mount command returned success (r=0). Although, the mount was successful the
command “mount” didn’t list it. In the list of mounts starting with /run I could only find these entries:</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p>Dec 12 16:19:35 <span lang="EN-US">host</span> mount[14500]: tmpfs on /run type tmpfs (rw,nosuid,nodev,mode=755)<u></u><u></u></p>
<p>Dec 12 16:19:35 <span lang="EN-US">host</span> mount[14500]: tmpfs on /run/credentials type tmpfs (ro,nosuid,nodev,noexec,mode=755)<u></u><u></u></p>
<p>Dec 12 16:19:35 <span lang="EN-US">host </span>mount[14500]: tmpfs on /run/systemd/incoming type tmpfs (ro,nosuid,nodev,mode=755)<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">If I do a chown of the directory in
<a href="mailto:user@1001.service" target="_blank">user@1001.service</a> then it works</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Menlo">root@</span><span lang="SV" style="font-family:Menlo">host</span><span style="font-family:Menlo">:/run/user# ls -la 1001</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Menlo">drwx------ 3 ida root 80 Dec 12 16:19 .</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Menlo">drwxr-xr-x 3 root root 60 Dec 12 16:19 ..</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Menlo">srw-rw-rw- 1 ida ssh-user 0 Dec 12 16:19 bus</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Menlo">drwxr-xr-x 5 ida ssh-user 140 Dec 12 16:19 systemd</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="SV"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">The ”mount” command don’t list /run/user/1001 for the successful case either.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black">Best regards,</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:black">Christopher Wong</span><u></u><u></u></p>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div id="m_-5267624441854422983m_5870886716831619400m_-8990293804925907923m_50470161548180358mail-editor-reference-message-container">
<div>
<div style="border-width:1pt medium medium;border-style:solid none none;padding:3pt 0cm 0cm;border-color:currentcolor">
<p class="MsoNormal" style="margin-bottom:12pt"><b><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:black">From:
</span></b><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:black">Mantas Mikulėnas <<a href="mailto:grawity@gmail.com" target="_blank">grawity@gmail.com</a>><br>
<b>Date: </b>Monday, 11 December 2023 at 17:56<br>
<b>To: </b>Christopher Wong <<a href="mailto:Christopher.Wong@axis.com" target="_blank">Christopher.Wong@axis.com</a>><br>
<b>Cc: </b>Systemd <<a href="mailto:systemd-devel@lists.freedesktop.org" target="_blank">systemd-devel@lists.freedesktop.org</a>><br>
<b>Subject: </b>Re: [systemd-devel] Manual start of user@<uid>.service failed with permission denied</span><u></u><u></u></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">On Mon, Dec 11, 2023, 17:28 Christopher Wong <<a href="mailto:Christopher.Wong@axis.com" target="_blank">Christopher.Wong@axis.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt;border-color:currentcolor currentcolor currentcolor rgb(204,204,204)">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi Mantas,</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">I have added ExecStartPre to
</span><a href="mailto:user@.service" target="_blank"><span lang="EN-US">user@.service</span></a><span lang="EN-US"> to run “id” and “ls -la”:</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal">Dec 11 15:50:34 host systemd-user-runtime-dir[40287]: Will mount /run/user/1001 owned by 1001:118<u></u><u></u></p>
<p class="MsoNormal">Dec 11 15:50:34 host systemd-user-runtime-dir[40287]: Mounting tmpfs (tmpfs) on /run/user/1001 (MS_NOSUID|MS_NODEV "mode=0700,uid=1001,gid=118,size=99426304,nr_inodes=24274")...<u></u><u></u></p>
<p class="MsoNormal">Dec 11 15:50:34 host systemd[1]: Finished User Runtime Directory /run/user/1001.<u></u><u></u></p>
<p class="MsoNormal">Dec 11 15:50:34 host systemd[1]: Starting User Manager for UID 1001...<u></u><u></u></p>
<p class="MsoNormal">Dec 11 15:50:34 host id[40291]: uid=1001(ida) gid=118(ssh-users) groups=118(ssh-users),236(systemd-journal)<u></u><u></u></p>
<p class="MsoNormal">Dec 11 15:50:34 host ls[40293]: drwxr-xr-x 3 root root 60 Dec 11 15:50 .<u></u><u></u></p>
<p class="MsoNormal">Dec 11 15:50:34 host ls[40293]: drwxr-xr-x 98 root root 2120 Dec 11 15:30 ..<u></u><u></u></p>
<p class="MsoNormal">Dec 11 15:50:34 host ls[40293]: drwx------ 2 root root 40 Dec 11 15:50 1001<u></u><u></u></p>
<p class="MsoNormal">Dec 11 15:50:34 host systemd[40294]: systemd 254.7-2-g9edc143 running in user mode for user 1001/ida. (-PAM -AUDIT -SELINUX -APPARMOR +IMA -SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL
-ACL +BLKID +CURL -ELFUTILS -FIDO2 -IDN2 -IDN -IPTC +KMOD -LIBCRYPTSETUP +LIBFDISK -PCRE2 -PWQUALITY -P11KIT -QRENCODE -TPM2 +BZIP2 -LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON -UTMP -SYSVINIT default-hierarchy=unified)<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">The /run/user/1001 belongs to root with mode 0700. Should this belong to root?</span><u></u><u></u></p>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<p class="MsoNormal">No, it should be owned by UID 1001 (though still mode 0700).<u></u><u></u></p>
</div>
<div>
<div>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt;border-color:currentcolor currentcolor currentcolor rgb(204,204,204)">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Is it because I manually start
</span><a href="mailto:user@1001.service" target="_blank"><span lang="EN-US">user@1001.service</span></a><span lang="EN-US"> as root?</span><u></u><u></u></p>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<p class="MsoNormal">Which user started the .service is usually not important, all services get a "fresh" environment that's fully described by the unit file.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">So even if you did 'systemctl start' as root, the unit has User=%i so the instance parameter tells it which UID to run as, so will be running as UID 1001. Likewise user-runtime-dir@1001
will get the UID for the mount from its instance name (you can see that the "Mounting tmpfs" message has the correct information).<u></u><u></u></p>
</div>
<div>
<div>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt;border-color:currentcolor currentcolor currentcolor rgb(204,204,204)">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">However, after
</span><a href="mailto:user-runtime-dir@1001.service" target="_blank"><span lang="EN-US">user-runtime-dir@1001.service</span></a>
<span lang="EN-US">has finished it startup, the </span><a href="mailto:user@1001.service" target="_blank"><span lang="EN-US">user@1001.service</span></a><span lang="EN-US"> is started as uid=1001 and therefore can’t create any directories under /run/user/1001.
Resulting in </span><a href="mailto:user@1001.service" target="_blank"><span lang="EN-US">user@1001.service</span></a><span lang="EN-US"> failed to start.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">If I add “</span>ExecStartPre=+chown %i /run/user/%i<span lang="EN-US">” to
</span><a href="mailto:user@.service" target="_blank"><span lang="EN-US">user@.service</span></a><span lang="EN-US"> then it works! But I am unsure if this is really the way fix this.</span><u></u><u></u></p>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">So far, it sounds like the directory is being created *by something else* before user-runtime-dir@ is even invoked.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Try adding the same "-/bin/ls -lad /run/user/%i" as both ExecStartPre and ExecStartPost of user-runtime-dir@ (and maybe even a findmnt). If the directory already exists during ExecStartPre,
start looking for other services or cronjobs, or tmpfiles.d configs, or 'su' invocations, which may cause it to be created.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">There might also be something that chowns it to root *after* it was created correctly. If you actually see the tmpfs mount in 'findmnt' or in 'mount', but it's owned by root despite
having uid=1001 in its mount options, something has chowned it...or your tmpfs feature is broken.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">If you don't see it in findmnt at all, even after user-runtime-dir has succeeded – either the mount failed quietly, or... something (like systemd itself) has quietly unmounted it.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<div>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt;border-color:currentcolor currentcolor currentcolor rgb(204,204,204)">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">Regarding the testing, I have done both restart of everything and manual, but the result is the same. Now that I have the “Environment=XDG_RUNTIME_DIR=/run/user/%i”
I no longer need to do “systemctl set-environment …”</span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">Thank you for taking your time!</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black">Best regards,</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:black">Christopher Wong</span><u></u><u></u></p>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div id="m_-5267624441854422983m_5870886716831619400m_-8990293804925907923m_50470161548180358m_-2724165164821707795mail-editor-reference-message-container">
<div>
<div style="border-width:1pt medium medium;border-style:solid none none;padding:3pt 0cm 0cm;border-color:currentcolor">
<p class="MsoNormal" style="margin-bottom:12pt"><b><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:black">From:
</span></b><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:black">Mantas Mikulėnas <</span><a href="mailto:grawity@gmail.com" target="_blank"><span style="font-size:12pt;font-family:"Aptos",sans-serif">grawity@gmail.com</span></a><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:black">><br>
<b>Date: </b>Friday, 8 December 2023 at 21:53<br>
<b>To: </b>Christopher Wong <</span><a href="mailto:Christopher.Wong@axis.com" target="_blank"><span style="font-size:12pt;font-family:"Aptos",sans-serif">Christopher.Wong@axis.com</span></a><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:black">><br>
<b>Cc: </b>Systemd <</span><a href="mailto:systemd-devel@lists.freedesktop.org" target="_blank"><span style="font-size:12pt;font-family:"Aptos",sans-serif">systemd-devel@lists.freedesktop.org</span></a><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:black">><br>
<b>Subject: </b>Re: [systemd-devel] Manual start of user@<uid>.service failed with permission denied</span><u></u><u></u></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal">On Fri, Dec 8, 2023 at 6:53 PM Christopher Wong <<a href="mailto:Christopher.Wong@axis.com" target="_blank">Christopher.Wong@axis.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt;border-color:currentcolor currentcolor currentcolor rgb(204,204,204)">
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi Mantas,</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">I have from your suggestion done the following:</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal">Putting the below in user@.service<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">[Service]<u></u><u></u></p>
<p class="MsoNormal">...<u></u><u></u></p>
<p class="MsoNormal">Environment=XDG_RUNTIME_DIR=/run/user/%i<u></u><u></u></p>
<p class="MsoNormal">Environment=SYSTEMD_LOG_LEVEL=debug<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Putting the below in user-runtime-dir@.service<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">[Service]<u></u><u></u></p>
<p class="MsoNormal">...<u></u><u></u></p>
<p class="MsoNormal">Environment=SYSTEMD_LOG_LEVEL=debug<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">Then I have disabled the global set-log-level debug (if this is also required, please let me know).</span><u></u><u></u></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Unlike set-environment that's not global, it only affects pid1.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt;border-color:currentcolor currentcolor currentcolor rgb(204,204,204)">
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">What I can see from the logs is that
</span><a href="mailto:user-runtime-dir@1001.service" target="_blank"><span lang="EN-US">user-runtime-dir@1001.service</span></a><span lang="EN-US"> seems to be started and mount /run/user/1001, but addition creation of directory under this mount is getting
permission denied. </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd[1]: Created slice User Slice of UID 1001.<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd[1]: Starting User Runtime Directory /run/user/1001...<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Bus n/a: changing state UNSET -> OPENING<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: sd-bus: starting bus by connecting to /run/dbus/system_bus_socket...<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Bus n/a: changing state OPENING -> AUTHENTICATING<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Bus n/a: changing state AUTHENTICATING -> HELLO<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Sent message type=method_call sender=n/a destination=org.freedesktop.DBus path=/org/freedesktop/DBus interface=org.freedesktop.DBus
member=Hello cookie=1 reply_cookie=0 signature=n/a error-name=n/a error-message=n/a<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Got message type=method_return sender=org.freedesktop.DBus destination=:1.2536 path=n/a interface=n/a member=n/a cookie=1
reply_cookie=1 signature=s error-name=n/a error-message=n/a<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Bus n/a: changing state HELLO -> RUNNING<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Sent message type=method_call sender=n/a destination=org.freedesktop.login1 path=/org/freedesktop/login1 interface=org.freedesktop.DBus.Properties
member=Get cookie=2 reply_cookie=0 signature=ss error-name=n/a error-message=n/a<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Got message type=method_return sender=:1.323 destination=:1.2536 path=n/a interface=n/a member=n/a cookie=15 reply_cookie=2
signature=v error-name=n/a error-message=n/a<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Sent message type=method_call sender=n/a destination=org.freedesktop.login1 path=/org/freedesktop/login1 interface=org.freedesktop.DBus.Properties
member=Get cookie=3 reply_cookie=0 signature=ss error-name=n/a error-message=n/a<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Got message type=method_return sender=:1.323 destination=:1.2536 path=n/a interface=n/a member=n/a cookie=16 reply_cookie=3
signature=v error-name=n/a error-message=n/a<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Bus n/a: changing state RUNNING -> CLOSED<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Will mount /run/user/1001 owned by 1001:118<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd-user-runtime-dir[36278]: Mounting tmpfs (tmpfs) on /run/user/1001 (MS_NOSUID|MS_NODEV "mode=0700,uid=1001,gid=118,size=99426304,nr_inodes=24274")...<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd[1]: Finished User Runtime Directory /run/user/1001.<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd[1]: Starting User Manager for UID 1001...<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd[36280]: systemd 254.7-2-g9edc143 running in user mode for user 1001/ida. (-PAM -AUDIT -SELINUX -APPARMOR +IMA -SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL
-ACL +BLKID +CURL -ELFUTILS -FIDO2 -IDN2 -IDN -IPTC +KMOD -LIBCRYPTSETUP +LIBFDISK -PCRE2 -PWQUALITY -P11KIT -QRENCODE -TPM2 +BZIP2 -LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON -UTMP -SYSVINIT default-hierarchy=unified)<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd[36280]: Failed to create '/run/user/1001/systemd/inaccessible', ignoring: Permission denied<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd[36280]: Failed to create '/run/user/1001/systemd/inaccessible/reg', ignoring: Permission denied<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd[36280]: Failed to create '/run/user/1001/systemd/inaccessible/dir', ignoring: Permission denied<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd[36280]: Failed to create '/run/user/1001/systemd/inaccessible/fifo', ignoring: Permission denied<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd[36280]: Failed to create '/run/user/1001/systemd/inaccessible/sock', ignoring: Permission denied<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd[36280]: Failed to create '/run/user/1001/systemd/inaccessible/chr', ignoring: Permission denied<u></u><u></u></p>
<p class="MsoNormal">Dec 08 17:33:29 host systemd[36280]: Failed to create '/run/user/1001/systemd/inaccessible/blk', ignoring: Permission denied<u></u><u></u></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">What's the ownership of /run/user/1001 and /run/user/1001/systemd after all of this?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Are you rebooting between tests or just manually starting it?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">My current guess is that due to the earlier `systemctl set-environment`, some *other* thing that's running as root inherited the /run/user/1001 path and created root-owned directories
there? That's the issue with setting global environment, it needs to be unset afterwards...<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><br>
-- <u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">Mantas Mikulėnas<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><br clear="all">
<br>
<span class="m_-5267624441854422983gmailsignatureprefix">-- </span><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">Mantas Mikulėnas<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div></blockquote></div><br clear="all"><br><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr">Mantas Mikulėnas</div></div></div>