Systemd-homed has permission issues

Trying to use homectl on Fedora (both workstation 35 and silverblue 36) seems to have Access denied issues. I was able to start systemd-homed via sudo systemctl enable systemd-homed and restarting my computer/VM. However, when I go to create a new user (sudo homectl create user2) is run into the following issue:

$ systemctl status systemd-homed
● systemd-homed.service - Home Area Manager
     Loaded: loaded (/usr/lib/systemd/system/systemd-homed.service; enabled; vendor preset: enabled)
     Active: active (running) since Tue 2022-05-03 22:07:01 EDT; 36s ago
       Docs: man:systemd-homed.service(8)
             man:org.freedesktop.home1(5)
   Main PID: 18985 (systemd-homed)
      Tasks: 1 (limit: 3436)
     Memory: 2.4M
        CPU: 190ms
     CGroup: /system.slice/systemd-homed.service
             └─18985 /usr/lib/systemd/systemd-homed

May 03 22:07:01 fedora systemd-homed[18985]: Successfully loaded private key pair.
May 03 22:07:34 fedora systemd-homed[18985]: Failed to stat /var/mail/, ignoring: Permission denied
May 03 22:07:34 fedora systemd-homed[18985]: user2: changing state absent → creating
May 03 22:07:34 fedora systemd-homework[27482]: Using automatic default storage of 'luks'.
May 03 22:07:34 fedora systemd-homework[27482]: Sizing home to 85% of available disk space, which is 9.9G.
May 03 22:07:34 fedora systemd-homework[27482]: Failed to create home image /home/.#homeworkuser2.home4068b54760dc6464: Permission denied
May 03 22:07:34 fedora systemd-homed[18985]: Operation on user2 failed: Permission denied

I thought this may be an issue with the systemd-homed.service file, but I didn’t see anything about ProtectHome=true, but perhaps its something else with the default systemd-homed.service config?

$ cat /usr/lib/systemd/system/systemd-homed.service
#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Home Area Manager
Documentation=man:systemd-homed.service(8)
Documentation=man:org.freedesktop.home1(5)

After=home.mount

[Service]
BusName=org.freedesktop.home1
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE
DeviceAllow=/dev/loop-control rw
DeviceAllow=/dev/mapper/control rw
DeviceAllow=block-* rw
DeviceAllow=char-hidraw rw
ExecStart=/usr/lib/systemd/systemd-homed
IPAddressDeny=any
KillMode=mixed
LimitNOFILE=524288
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_ALG
RestrictNamespaces=mnt
RestrictRealtime=yes
StateDirectory=systemd/home
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service @mount


[Install]
WantedBy=multi-user.target
Alias=dbus-org.freedesktop.home1.service
Also=systemd-homed-activate.service systemd-userdbd.service

2 Likes