User service problems on linux-hardened

Description:

The hardening options cause the service to not start in linux-hardened. Specifically, the options which cause the errors are:

ProtectKernelModules=true
ProtectKernelLogs=true
PrivateUsers=yes

Reading through this issue, it seems like there should be some fallback for when unprivileged namespaces are disabled in the kernel, but the service just refuses to run on my system.

Additional info:

• package version(s):
  • fluidsynth - 2.3.6-1
  • systemd - 256.5-1
  • linux-hardened - 6.10.6.hardened1-1
• config and/or log files:
  • Snippet from journalctl: fluidsynth-journal.log
• link to upstream bug report, if any:
  • Related to the issue from 2 years ago.

Related problem in another package

Steps to reproduce:

1. Boot with linux-hardened
2. Attempt to start fluidsynth service
3. See error in journal

added priority3-normal severity4-low statusunconfirmed labels

assigned to @freswa, @toolybird, and @gromit

It seems to me like it's expected when running under the hardened kernel. The service file comes from upstream so technically there is no packaging issue. Let's give the PMs an opportunity to chime in..

added scopequestion statusconfirmed labels and removed statusunconfirmed label

assigned to @dvzrv and @ainola and unassigned @freswa, @toolybird, and @gromit

changed due date to September 26, 2024

@vladaviedov: I have made a note in the upstream ticket, but I guess it's unlikely to be changed.

I guess there are workarounds for this scenario, e.g.:

• temporarily enable user namespaces by running as root:

  sysctl kernel.unprivileged_userns_clone=1

• provide an override to the fluidsynth user service that enables the hardening options relying on user namespaces

Thanks, I was able to make an override.

It might make sense to keep the issue open until a consensus is reached on this in the other package.

The PM has provided an answer in the comments above. There is no packaging issue so we shall close for now.

closed

added resolutioncompleted label