From 458c2a22663337f224233433100d74540784bc0b Mon Sep 17 00:00:00 2001 From: Bendik Aagaard Lynghaug Date: Sat, 3 Oct 2026 13:56:47 +0200 Subject: [PATCH] The socket unit owns /run/varde; the service names no runtime directory RuntimeDirectoryPreserve=yes (0.1.7) made systemd privatise the directory under DynamicUser: /run/varde became a symlink into /run/private, 0700, and no unprivileged client - the redoal relay, a desktop app - could connect. Without RuntimeDirectory= on the service the socket unit creates the directory (DirectoryMode=0755), nothing removes it on a service stop, and nothing privatises it. Co-Authored-By: Claude Fable 5.1 --- dist/varde.service | 12 +++++++----- dist/varde.socket | 3 +++ 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/dist/varde.service b/dist/varde.service index 4e3aa36..8db5d04 100644 --- a/dist/varde.service +++ b/dist/varde.service @@ -15,11 +15,13 @@ Restart=on-failure # Hardening DynamicUser=yes StateDirectory=varde -RuntimeDirectory=varde -# The socket unit's file lives in this directory: removing it on every -# service stop (the default) left varde.socket listening on an unlinked -# path after any restart - "active" with nothing to connect to. -RuntimeDirectoryPreserve=yes +# No RuntimeDirectory= here: varde.socket creates /run/varde for its +# socket file, and the service only uses the activation socket. With +# RuntimeDirectory= on the service, stopping it removed the socket file +# from under the socket unit (0.1.6 and earlier), and preserving it +# (0.1.7/0.1.8) made systemd privatise the directory under DynamicUser - +# /run/varde -> /run/private/varde, 0700 - so no unprivileged client +# could connect at all. NoNewPrivileges=yes ProtectSystem=strict ProtectHome=yes diff --git a/dist/varde.socket b/dist/varde.socket index fdafb64..5a77cd3 100644 --- a/dist/varde.socket +++ b/dist/varde.socket @@ -5,6 +5,9 @@ Description=varde API socket [Socket] ListenStream=/run/varde/varde.sock SocketMode=0666 +# The directory is this unit's, world-readable, so clients of any user +# reach the socket (see varde.service for why the service must not own it). +DirectoryMode=0755 [Install] WantedBy=sockets.target