Failed to determine supplementary groups: Operation not permitted

Question

I'm trying to set up watchman as a user service.

I've followed their documentation as closely as possible. This is what I have:

The socket file:

[Unit]
Description=Watchman socket for user %i

[Socket]
ListenStream=/usr/local/var/run/watchman/%i-state/sock
Accept=false
SocketMode=0664
SocketUser=%i
SocketGroup=%i

[Install]
WantedBy=sockets.target

The service file:

[Unit]
Description=Watchman for user %i
After=remote-fs.target
Conflicts=shutdown.target

[Service]
ExecStart=/usr/local/bin/watchman --foreground --inetd --log-level=2
ExecStop=/usr/bin/pkill -u %i -x watchman
Restart=on-failure
User=%i
Group=%i
StandardInput=socket
StandardOutput=syslog
SyslogIdentifier=watchman-%i

[Install]
WantedBy=multi-user.target

Systemd attempts to run watchman but is stuck in a restart loop.
These are the errors I get:

Apr 16 05:41:00 debian systemd[20894]: [email protected]: Failed to determine supplementary groups: Operation not permitted
Apr 16 05:41:00 debian systemd[20894]: [email protected]: Failed at step GROUP spawning /usr/local/bin/watchman: Operation not permitted

I'm 100% sure the group and user I'm enabling this service & socket exists. What am I doing wrong?

are the user and group in `/etc` files or coming from some (perhaps not yet loaded or otherwise flakey) network source? — thrig, Apr 16 '18 at 13:57

score 48 · Accepted Answer · edited Apr 05 '19 at 23:40

48

I was running into the same issue. Googling I found this thread: https://bbs.archlinux.org/viewtopic.php?id=233035

The problem is with how the service is being started. If you specify the user/group in the unit file then you should start the service as a system service.

If you want to start the service as a user service then the User/Group is not needed and can be removed from the unit config. You simply start the service when logged in as the current user passing the --user flag to systemctl.

edited Apr 05 '19 at 23:40

Rui F Ribeiro

55,929
26
146
227

answered Nov 05 '18 at 19:29

Joey J

596
5
5

7

This works. Seems like the error message for this should be much more descriptive of the actual problem because that is not really intuitive from the message – theferrit32 Dec 26 '19 at 22:37
@theferrit32 That's true of a lot of these error messages. Could always submit a patch? – Ken Sharp Nov 07 '21 at 21:19
3 years on, and this saved me a lot of headache. Thank you – KhoPhi Dec 08 '21 at 09:11
2

Be careful of the difference between `User=` and `--user`. see https://unix.stackexchange.com/a/548526/150125 – Cyril Duchon-Doris Apr 05 '22 at 15:44

score 6 · Answer 2 · answered Apr 25 '18 at 14:48

6

I haven't found a solution to my problem but placing the unit files in ~/.config/systemd/user and removing the user parameterization fixed the issue for me.

answered Apr 25 '18 at 14:48

the_drow

443
1
4
8

Failed to determine supplementary groups: Operation not permitted

2 Answers2