mjhjmtu

I've set up shadowsocks-libev and have been running it with the following systemctl service:

[Unit]
Description=Shadowsocks-Libev Manager Service
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=nobody
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
ExecStart=/usr/bin/ss-manager -c /etc/shadowsocks/%i.json

[Install]
WantedBy=multi-user.target

I recently noticed that my shadowsocks config file (/etc/shadowsocks/manager.json) had global read permissions, so I changed it to 600 and made sure the owner was nobody. For some reason this causes the process to fail to read the configuration file when starting up.

systemctl start shadowsocks-libev-manager@manager.service

ss-manager[1357]: 2018-01-05 11:41:00 ERROR: Invalid config path.

This is the same error I see as when I revoke all read privileges for that file.

However, it works fine if I start shadowsocks using the exact same command from the command line:

sudo -u nobody /usr/bin/ss-manager -c /etc/shadowsocks/manager.json

Similarly, I have no trouble reading the file as nobody using cat or less.

When I check the process started by systemctl in ps it shows that it's running as nobody, and when the process outputs files the owner is set to nobody. Why can't it access this file? Why is there a difference between running it through systemctl and running it from the terminal?

My problem seems similar to this question, but I don't have any quotes in my ExecStart so that solution is not applicable in my case.

I was able to fix the problem, which stemmed from something unique to the user nobody. I'm still not entirely sure what makes that user unique though.

When run as nobody I see the following output in journald:

Started Shadowsocks-Libev Manager Service.
ERROR: Invalid config path.
Main process exited, code=exited, status=255/n/a
Failed with result 'exit-code'.

This is indicative of it being unable to access the config file despite having the necessary permissions.

When run as a different user I newly created (with no home directory) I see the following output in journald instead:

Started Shadowsocks-Libev Manager Service.
ERROR: mkdir: No such file or directory
ERROR: unable to create working directory
Main process exited, code=exited, status=255/n/a
Failed with result 'exit-code'.

This is because it attempts to write to the user's home directory which does not exist.

I then created a new user named shadowsocks with its own home directory:

# useradd -m -s /usr/bin/nologin shadowsocks

Running as this user I encounter no problems.