iwd doesn't work with openresolv

iwd doesn't work with openresolv

[Yuri Kanivetsky]

[-- Attachment #1: Type: text/plain, Size: 837 bytes --]

Hi,

If I run it as is, I get:

Dec 27 13:27:21 yuri iwd[716]: cp: cannot create regular file
'/etc/resolv.conf.bak': Read-only file system
Dec 27 13:27:21 yuri iwd[717]: /usr/lib/resolvconf/libc: line 230:
/etc/resolv.conf: Read-only file system
Dec 27 13:27:21 yuri iwd[761]: cp: cannot create regular file
'/etc/resolv.conf.bak': Read-only file system
Dec 27 13:27:21 yuri iwd[762]: /usr/lib/resolvconf/libc: line 230:
/etc/resolv.conf: Read-only file system

I can work around it by:

touch /etc/resolv.conf.bak

and overriding:

[Service]
ReadWritePaths=/etc/resolv.conf.bak
ReadWritePaths=/etc/resolv.conf

Others suggested another way to fix it:

RuntimeDirectory=resolvconf
ReadWritePaths=/etc/resolv.conf

https://bugs.archlinux.org/task/67069

Can src/iwd.service.in be adjusted?

Regards,
Yuri

Re: iwd doesn't work with openresolv

[Denis Kenzior]

[-- Attachment #1: Type: text/plain, Size: 815 bytes --]

Hi Yuri,

<snip>

> [Service]
> ReadWritePaths=/etc/resolv.conf.bak
> ReadWritePaths=/etc/resolv.conf
> 
> Others suggested another way to fix it:
> 
> RuntimeDirectory=resolvconf
> ReadWritePaths=/etc/resolv.conf
> 
> https://bugs.archlinux.org/task/67069
> 
> Can src/iwd.service.in be adjusted?

I think this or a similar issue has come up before.  The problem is that iwd 
supports either systemd-resolved or resolvconf.  So for systems that use 
systemd-resolved (which iwd defaults to), punching this security policy 
exception is not needed and arguably it should not be enabled by default.

Perhaps as a compromise we may be able to ship service.in with these lines added 
& commented out.  Not sure if this would be of any help though.  Other ideas are 
welcome.

Regards,
-Denis

Re: iwd doesn't work with openresolv

[Diederik de Haas]

On Mon Jan 3, 2022 at 8:05 PM CET,  wrote:
>> [Service]
>> ReadWritePaths=/etc/resolv.conf.bak
>> ReadWritePaths=/etc/resolv.conf
>> 
>> Others suggested another way to fix it:
>> 
>> RuntimeDirectory=resolvconf
>> ReadWritePaths=/etc/resolv.conf
>> 
>> https://bugs.archlinux.org/task/67069
>> 
>> Can src/iwd.service.in be adjusted?
>
> I think this or a similar issue has come up before.  The problem is that iwd 
> supports either systemd-resolved or resolvconf.  So for systems that use 
> systemd-resolved (which iwd defaults to), punching this security policy 
> exception is not needed and arguably it should not be enabled by default.
>
> Perhaps as a compromise we may be able to ship service.in with these lines added 
> & commented out.  Not sure if this would be of any help though.  Other ideas are 
> welcome.

FWIW, this issue has come up again, but now in the Debian bug tracker:
https://bugs.debian.org/1129196

And Debian's iwd package version 3.11-2 added a patch to add the
ReadWritePaths to iwd.service.in.
https://tracker.debian.org/news/1723586/accepted-iwd-311-2-source-into-unstable/

I don't know what the best/correct solution is, but it seems helpful
that it's documented somewhere (service file, man page, etc) so that
different people don't run into the same issue again and again and have
to search for a solution to it.

Cheers,
  Diederik