From e48460d6f288f595740c88abfe97817a80e6e558 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 27 Jul 2026 03:43:38 +0000 Subject: [PATCH] Fix the actual cause of every "file does not exist": ProtectHome=true Chased this as an ACL-ordering problem for the last several commits, and those fixes were real and worth keeping, but none of them could ever have fixed this: ProtectHome=true in the systemd unit doesn't just restrict permissions, it mounts an empty, invisible filesystem over /home, /root, and /run/user for the whole unit. ASTERISK_CONFIG_DIR lives under /root/docker/... (or /home//docker/... on a non-root install), so the relay process could never see it regardless of any ACL grant on the real filesystem underneath -- from inside the sandboxed unit it genuinely doesn't exist, while a plain unsandboxed shell (confirmed live: `sudo -u smsrelay cat pstn-personal-dids.conf` outside systemd) reads the exact same path fine. Fix: ProtectHome=read-only instead of true. Still stops this service from writing into /home or /root -- all it should ever need is read -- it just stops hiding them outright. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01JDyKC6Kdg7tofmYSmRtgww --- services/sms-inbound.sh | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/services/sms-inbound.sh b/services/sms-inbound.sh index 0e3b827..118d7f3 100644 --- a/services/sms-inbound.sh +++ b/services/sms-inbound.sh @@ -496,7 +496,19 @@ Restart=on-failure RestartSec=3 NoNewPrivileges=true ProtectSystem=strict -ProtectHome=true +# NOT "true" -- that doesn't just restrict permissions, it mounts an +# empty, invisible filesystem over /home, /root and /run/user for this +# unit, full stop. ASTERISK_CONFIG_DIR lives under /root/docker/... (or +# /home//docker/... on a non-root install), so with ProtectHome=true +# the relay process can never see it, no ACL or ownership on the real +# filesystem can fix that, and every read looks exactly like "the file +# doesn't exist" from inside the unit while a plain, unsandboxed shell +# (e.g. `sudo -u smsrelay cat ...`) reads it fine. Confirmed live: this +# was the actual cause of every "does not exist" seen while chasing what +# looked like an ACL-ordering problem -- read-only still protects /home +# and /root from being written to by this service (all it should ever +# need is read), it just stops hiding them outright. +ProtectHome=read-only PrivateTmp=true [Install]