I'm trying to setup hylafax+ in fedora, either with the rpm file or by source code. hylafax+ is not prepared for systemd, so I wrote i.a. the following file /etc/systemd/system/hylafax-faxgetty-ttyACM0.service, which works fine in ubuntu and Opensuse:[Unit]Description=HylaFAX faxgetty for ttyACM0, ...[Service]User=rootGroup=rootRestart=alwaysRestartSec=30ExecStart=/usr/sbin/faxgetty ttyACM0[Install]WantedBy=multi-user.targetbut gives me the error Can not setup permissions (uid) in fedora.When I run the code:/usr/sbin/faxgetty -D ttyACM0manually as root, it seems to run (the process persists).I found the single location where the error message is produced in the source code of hylafax+ and modified it slightly to be more informative, like this:faxApp::setupPermissions(void){    if (getuid() != 0)        faxApp::fatal(The fax server must run with real uid root.\n);    uid_t euid = geteuid();    const passwd* pwd = getpwnam(FAX_USER);    if (!pwd)        faxApp::fatal(No fax user \%s\ defined on your system!\n            This software is not installed properly!, FAX_USER);    if (euid == 0) {        if (initgroups(pwd->pw_name, pwd->pw_gid) != 0)            faxApp::fatal(Can not setup permissions (supplementary groups));        if (setegid(pwd->pw_gid) < 0)            faxApp::fatal(Can not setup permissions (gid));        if (seteuid(pwd->pw_uid) < 0) {            char buf[50];            sprintf(buf,Perm.for %s %d euid: %d,FAX_USER, pwd->pw_uid, euid);//          faxApp::fatal(Can not setup permissions (uid));            faxApp::fatal(buf);        }Now it gives me:FaxGetty[6359]: Perm.for uucp 10 euid: 0The respective entries of my password files:/etc/passwd:uucp:x:10:10:Facsimile Agent:/var/spool/hylafax:/bin/bash/etc/group:uucp:x:10:uucpCan anybody tell me what might be going wrong?
systemd permission issue with user root
permissions;systemd;setuid
From you output it looks like the following is happening:Your application is running as root.It is able to change groups to a lower privileged groupIt is attempting to switch to a lower privileged user but failing.First, seteuid like allot of syscalls sets the errno which will tell you the actual error. It is best to print this out as part of your error message to get the actual reason for failure.However, it is most likely a permission error. Permission errors as far as you can tell they have permission to do the action (which is weird as root since they should be able to do anything) is an indication that selinux (or similar service like apparmour) is at work. They are the only services I know of that can block the root user from some action.The quickest way to tell if selinux is at fault (I am not that familiar with apparmour) is to check if it is on (ie enforcing)sestatusand then checking for avc denials in the audit logsudo grep avc /var/log/audit/audit.logIf this returns anything then selinux is blocking something. You can further prove it is selinux by temporarily setting ti to permissive with the followingsudo setenforce 0If you are now able to do what you require then it is definitely selinux. You have two options now; permanently set selinux to permissive lowering the security of your system (discouraged) or generating the rules required by your application.