[Bug 1969976] [NEW] DynamicUser=1 doesn't get along with services that need dbus-daemon

[Mario Limonciello]

Public bug reported:

Updating to systemd 245.4-4ubuntu3.16 has caused a regression in Ubuntu
20.04, that fwupd-refresh.service always fails to run.

This has been root caused down to the changes in
https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/1871538

Unfortunately this is an upstream issue introduced by stable systemd.
https://github.com/systemd/systemd/issues/22737

The problem also occurs in Ubuntu 22.04 with a newer systemd release.
As discussed in https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/1871538/comments/61 it's a tradeoff of issues.  So within Ubuntu something probably needs to be done about fwupd-refresh.service.

One proposal is to remove DynamicUser=yes from the systemd unit, but
this will mean fwupdgmr refresh runs as root.  It's relatively sandboxed
by other security mechanisms, but still not ideal.  Could we repurpose
any other service account?  Or alternatively we can make a new fwupd
service account that this systemd unit uses.

** Affects: fwupd
     Importance: Unknown
         Status: Unknown

** Affects: systemd
     Importance: Unknown
         Status: Unknown

** Affects: fwupd (Ubuntu)
     Importance: Undecided
         Status: New

** Affects: systemd (Ubuntu)
     Importance: Undecided
         Status: New

** Affects: fwupd (Ubuntu Focal)
     Importance: Undecided
         Status: New

** Affects: systemd (Ubuntu Focal)
     Importance: Undecided
         Status: New

** Affects: fwupd (Ubuntu Impish)
     Importance: Undecided
         Status: New

** Affects: systemd (Ubuntu Impish)
     Importance: Undecided
         Status: New

** Affects: fwupd (Ubuntu Jammy)
     Importance: Undecided
         Status: New

** Affects: systemd (Ubuntu Jammy)
     Importance: Undecided
         Status: New

** Also affects: fwupd (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: systemd (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: fwupd (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: systemd (Ubuntu Impish)
   Importance: Undecided
       Status: New

** Also affects: fwupd (Ubuntu Impish)
   Importance: Undecided
       Status: New

** Also affects: systemd (Ubuntu Focal)
   Importance: Undecided
       Status: New

** Also affects: fwupd (Ubuntu Focal)
   Importance: Undecided
       Status: New

** Bug watch added: github.com/fwupd/fwupd/issues #3037
   https://github.com/fwupd/fwupd/issues/3037

** Also affects: fwupd via
   https://github.com/fwupd/fwupd/issues/3037
   Importance: Unknown
       Status: Unknown

** Bug watch added: github.com/systemd/systemd/issues #22737
   https://github.com/systemd/systemd/issues/22737

** Also affects: systemd via
   https://github.com/systemd/systemd/issues/22737
   Importance: Unknown
       Status: Unknown

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/1969976

Title:
  DynamicUser=1 doesn't get along with services that need dbus-daemon

Status in Fwupd:
  Unknown
Status in systemd:
  Unknown
Status in fwupd package in Ubuntu:
  New
Status in systemd package in Ubuntu:
  New
Status in fwupd source package in Focal:
  New
Status in systemd source package in Focal:
  New
Status in fwupd source package in Impish:
  New
Status in systemd source package in Impish:
  New
Status in fwupd source package in Jammy:
  New
Status in systemd source package in Jammy:
  New

Bug description:
  Updating to systemd 245.4-4ubuntu3.16 has caused a regression in
  Ubuntu 20.04, that fwupd-refresh.service always fails to run.

  This has been root caused down to the changes in
  https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/1871538

  Unfortunately this is an upstream issue introduced by stable systemd.
  https://github.com/systemd/systemd/issues/22737

  The problem also occurs in Ubuntu 22.04 with a newer systemd release.
  As discussed in https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/1871538/comments/61 it's a tradeoff of issues.  So within Ubuntu something probably needs to be done about fwupd-refresh.service.

  One proposal is to remove DynamicUser=yes from the systemd unit, but
  this will mean fwupdgmr refresh runs as root.  It's relatively
  sandboxed by other security mechanisms, but still not ideal.  Could we
  repurpose any other service account?  Or alternatively we can make a
  new fwupd service account that this systemd unit uses.

To manage notifications about this bug go to:
https://bugs.launchpad.net/fwupd/+bug/1969976/+subscriptions