ubuntu - 如何检查新的systemd用户是否有权执行二进制文件

Question

我意识到这个问题之前已经被问过/回答过几次，但一直没能解决。我有以下 systemd 服务文件:

[Unit]
Description=My client service
ConditionPathExists=/root/go/src/github.com/me/myapp/client/client
After=network.target

[Service]
Type=simple
User=myservice
Group=myservice
LimitNOFILE=1024

Restart=on-failure
RestartSec=10
startLimitIntervalSec=60

WorkingDirectory=/root/go/src/github.com/me/myapp/client
ExecStart=/root/go/src/github.com/me/myapp/client/client

# make sure log directory exists and owned by syslog
PermissionsStartOnly=true
ExecStartPre=/bin/mkdir -p /var/log/myclient
ExecStartPre=/bin/chown syslog:adm /var/log/myclient
ExecStartPre=/bin/chmod 755 /var/log/myclient
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=myservice

[Install]
WantedBy=multi-user.target

然后我创建了一个新用户:
useradd myservice -s /sbin/nologin -M
但是当我尝试运行 systemd 守护进程时，我得到:
Process: 11956 ExecStart=/root/go/src/github.com/me/myapp/client/client (code=exited, status=203/EXEC)
所有这些在我的本地机器(运行 Ubuntu 16.04)上运行良好，但是当我在 scaleway 服务器(也运行 Ubuntu 16.04)上尝试时，我得到了上述错误。我 100% 确定所有路径都是正确的。

我确定 myservice 用户已经成功创建，因为如果我尝试运行: useradd myservice -s /sbin/nologin -M然后我得到 useradd: user 'myservice' already exists
当我检查权限时，我得到了这个:

$ ls -l /lib/systemd/system/myclient.service 
-rwxr-xr-x 1 root root 790 Sep 14 11:48 /lib/systemd/system/myclient.service
$ ls -l /root/go/src/github.com/me/myapp/client/client 
-rwxr-xr-x 1 root root 9167576 Sep 14 12:02 /root/go/src/github.com/me/myapp/client/client

如果我通过简单地运行 /root/go/src/github.com/me/myapp/client/client 来运行应用程序然后它可以正常工作并运行..所以问题似乎与 myservice有关无权运行 client二进制或 myclient.service systemd 守护进程..

我也试过 chown myservice client但结果是一样的。我相信运行 usermod -a -G root myservice与简单地以 root 而不是单独的用户身份运行 systemd 守护进程相同。

我真的不知道我可以采取哪些其他步骤来确保文件由 myservice 执行。用户而不是 root用户..任何帮助将不胜感激

编辑以解决马克的评论:

输出非常长.. 我拿了第一个，然后我一直滚动，直到我相信我遇到了最新的错误:

Sep 14 11:49:17 myapp-c1 systemd[1]: [/lib/systemd/system/myclient.service:14] Unknown lvalue 'startLimitIntervalSec' in se
Sep 14 11:49:18 myapp-c1 systemd[1]: [/lib/systemd/system/myclient.service:14] Unknown lvalue 'startLimitIntervalSec' in se
Sep 14 11:49:20 myapp-c1 systemd[1]: [/lib/systemd/system/myclient.service:14] Unknown lvalue 'startLimitIntervalSec' in se
Sep 14 11:49:20 myapp-c1 systemd[1]: [/lib/systemd/system/myclient.service:14] Unknown lvalue 'startLimitIntervalSec' in se
Sep 14 11:49:22 myapp-c1 systemd[1]: [/lib/systemd/system/myclient.service:14] Unknown lvalue 'startLimitIntervalSec' in se
Sep 14 11:49:23 myapp-c1 systemd[1]: [/lib/systemd/system/myclient.service:14] Unknown lvalue 'startLimitIntervalSec' in se
Sep 14 11:49:24 myapp-c1 systemd[1]: [/lib/systemd/system/myclient.service:14] Unknown lvalue 'startLimitIntervalSec' in se
Sep 14 11:49:24 myapp-c1 systemd[1]: [/lib/systemd/system/myclient.service:14] Unknown lvalue 'startLimitIntervalSec' in se
Sep 14 11:49:51 myapp-c1 systemd[1]: [/lib/systemd/system/myclient.service:14] Unknown lvalue 'startLimitIntervalSec' in se
Sep 14 11:49:51 myapp-c1 systemd[1]: Stopped My client service.
Sep 14 11:49:51 myapp-c1 systemd[1]: [/lib/systemd/system/myclient.service:14] Unknown lvalue 'startLimitIntervalSec' in se
Sep 14 11:49:51 myapp-c1 systemd[1]: [/lib/systemd/system/myclient.service:14] Unknown lvalue 'startLimitIntervalSec' in se
Sep 14 11:49:51 myapp-c1 systemd[1]: [/lib/systemd/system/myclient.service:14] Unknown lvalue 'startLimitIntervalSec' in se
Sep 14 11:51:12 myapp-c1 systemd[1]: [/lib/systemd/system/myclient.service:14] Unknown lvalue 'startLimitIntervalSec' in se
Sep 14 11:51:12 myapp-c1 systemd[1]: Starting My client service...
Sep 14 11:51:12 myapp-c1 systemd[1]: Started My client service.
Sep 14 11:51:12 myapp-c1 systemd[1]: myclient.service: Main process exited, code=exited, status=203/EXEC
Sep 14 11:51:12 myapp-c1 systemd[1]: myclient.service: Unit entered failed state.
Sep 14 11:51:12 myapp-c1 systemd[1]: myclient.service: Failed with result 'exit-code'.
Sep 14 11:51:23 myapp-c1 systemd[1]: myclient.service: Service hold-off time over, scheduling restart.
Sep 14 11:51:23 myapp-c1 systemd[1]: Stopped My client service.

...

Sep 14 12:21:36 myapp-c1 systemd[1]: Started My client service.
Sep 14 12:21:36 myapp-c1 systemd[13245]: myclient.service: Failed at step EXEC spawning /root/go/src/github.com/me/myapp/client/client: 
Sep 14 12:21:36 myapp-c1 systemd[1]: myclient.service: Main process exited, code=exited, status=203/EXEC
Sep 14 12:21:36 myapp-c1 systemd[1]: myclient.service: Unit entered failed state.
Sep 14 12:21:36 myapp-c1 systemd[1]: myclient.service: Failed with result 'exit-code'.
Sep 14 12:21:46 myapp-c1 systemd[1]: myclient.service: Service hold-off time over, scheduling restart.
Sep 14 12:21:46 myapp-c1 systemd[1]: Stopped My client service.
Sep 14 12:21:46 myapp-c1 systemd[1]: Starting My client service...
Sep 14 12:21:46 myapp-c1 systemd[1]: Started My client service.
Sep 14 12:21:46 myapp-c1 systemd[1]: myclient.service: Main process exited, code=exited, status=203/EXEC
Sep 14 12:21:46 myapp-c1 systemd[1]: myclient.service: Unit entered failed state.
Sep 14 12:21:46 myapp-c1 systemd[1]: myclient.service: Failed with result 'exit-code'.
Sep 14 12:21:56 myapp-c1 systemd[1]: myclient.service: Service hold-off time over, scheduling restart.
Sep 14 12:21:56 myapp-c1 systemd[1]: Stopped My client service.
Sep 14 12:21:56 myapp-c1 systemd[1]: Starting My client service...
Sep 14 12:21:56 myapp-c1 systemd[1]: Started My client service.
Sep 14 12:21:56 myapp-c1 systemd[1]: myclient.service: Main process exited, code=exited, status=203/EXEC
Sep 14 12:21:56 myapp-c1 systemd[1]: myclient.service: Unit entered failed state.
Sep 14 12:21:56 myapp-c1 systemd[1]: myclient.service: Failed with result 'exit-code'.
Sep 14 12:22:07 myapp-c1 systemd[1]: myclient.service: Service hold-off time over, scheduling restart.
Sep 14 12:22:07 myapp-c1 systemd[1]: Stopped My client service.
Sep 14 12:22:07 myapp-c1 systemd[1]: Starting My client service...
Sep 14 12:22:07 myapp-c1 systemd[1]: Started My client service.

没错，我以混合顺序添加了用户组。这是我运行命令时的输出:

$ grep myservice /etc/group
myservice:1000:myservice

请注意，我使用了 myservice , 我不认为我应该使用 myclient ?

Answer 1

因为它是从 CLI 而不是从 systemd 运行的在同一台机器上。这是相关常见问题解答的变体:Difference between systemd and terminal starting program .

最可能的原因是在一种情况下设置了环境变量，但在另一种情况下没有设置。还要比较 systemctl show your-unit-unit.service 的输出在它工作的系统和它不工作的系统之间。

还要确认Type=与您正在运行的服务类型相匹配，记录在 man systemd.service 中，并查看二进制文件的文档，看看在什么情况下它会以状态码 203 退出。

最后，查看ls -lthd /root在服务器上。通常为 /root目录具有限制性权限集，仅允许 root 访问其下的文件，但您试图在服务器上运行文件作为下面的文件(失败的地方)，而不是在家(成功的地方)。将代码移至 /home/myservice将解决该问题。