dnscrypt-proxy: service fails to start (systemd)

[hotcapy]

Hello!

Firejail has profile for DNSCrypt-Proxy, but it's unclear for me how to correctly configure it.

I activated Firejail by creating symlink:
sudo ln -s /usr/bin/firejail /usr/local/bin/dnscrypt-proxy

dnscrypt-proxy.service uses /usr/bin/dnscrypt-proxy by default in ExecStart= line.

I followed ArchWiki and edited dnscrypt-proxy.service to use /usr/local/bin/dnscrypt-proxy instead of /usr/bin/dnscrypt-proxy to turn on Firejail:

sudo systemctl edit dnscrypt-proxy.service --drop-in=firejail

Which results in the following file:

[user@host ~]$ cat /etc/systemd/system/dnscrypt-proxy.service.d/firejail.conf
[Service]
ExecStart=
ExecStart=/usr/local/bin/dnscrypt-proxy --config /etc/dnscrypt-proxy/dnscrypt-proxy.toml

After those changes, service fails to start:

[user@host ~]$ sudo systemctl start dnscrypt-proxy.service
[user@host ~]$ systemctl status dnscrypt-proxy.service
× dnscrypt-proxy.service - DNSCrypt-proxy client
     Loaded: loaded (/usr/lib/systemd/system/dnscrypt-proxy.service; disabled; preset: disabled)
    Drop-In: /etc/systemd/system/dnscrypt-proxy.service.d
             └─firejail.conf
     Active: failed (Result: exit-code) since Sat 2023-04-01 00:42:33 +07; 2s ago
   Duration: 40ms
       Docs: https://github.com/jedisct1/dnscrypt-proxy/wiki
    Process: 7751 ExecStart=/usr/local/bin/dnscrypt-proxy --config /etc/dnscrypt-proxy/dnscrypt-proxy.toml (code=exited, status=1/FAILURE)
   Main PID: 7751 (code=exited, status=1/FAILURE)
        CPU: 39ms

Apr 01 00:42:33 host systemd[1]: Started DNSCrypt-proxy client.
Apr 01 00:42:33 host dnscrypt-proxy[7751]: Error getpwuid: main.c:252 init_cfg: Success
Apr 01 00:42:33 host systemd[1]: dnscrypt-proxy.service: Main process exited, code=exited, status=1/FAILURE
Apr 01 00:42:33 host systemd[1]: dnscrypt-proxy.service: Failed with result 'exit-code'.

Using dnscrypt-proxy instead of /usr/local/bin/dnscrypt-proxy not changes this behavior.

At first I thought that maybe app have no access to it's folder /etc/dnscrypt-proxy, but adding something like these lines to dnscrypt-proxy.local changes nothing:

noblacklist /etc/dnscrypt-proxy
whitelist /etc/dnscrypt-proxy
ignore private-etc

I'm not sure why DNSCrypt-Proxy exists as command-line tool with some available options since usually it works as service or socket (perhaps, to check configuration file for errors). However, I tried to execute it directly. And there is difference in output depending on wether I use dnscrypt-proxy or firejail dnscrypt-proxy. It's strange, because there is a /usr/local/bin/dnscrypt-proxy symlink!

[user@host ~]$ dnscrypt-proxy
[2023-03-31 18:14:44] [FATAL] Unable to load the configuration file [dnscrypt-proxy.toml] -- Maybe use the -config command-line switch?
[user@host ~]$ firejail dnscrypt-proxy
Error getpwuid: main.c:252 init_cfg: No such file or directory

Firejail symlinks usually work fine with every other app I use - checked it many times with firejail --list / firejail --top / firemon / aa-status / etc.

I'm sorry for adding too many info which perhaps not very required here.
Obviously, I don't understand something about Firejail & systemd services in general and doing it in wrong way. For now I reverted all manual changes which I made.
So, thank you in advance for any possible help!

[kmk3]

(Offtopic)

For reporting a bug/issue with a profile, please open an issue and follow the
bug report template:

• https://github.com/netblue30/firejail/issues/new?template=bug_report.md

Bugs are tracked in the issue tracker; discussions have poor UX for this. The
latter are intended for things like general discussion and Q&A.

I'd suggest opening a new issue for each of the following discussions:

• dnscrypt-proxy: service fails to start (systemd) #5771
  Edit: This was answered below
• freeoffice-textmaker: cannot create unique identifier #5772
  Edit: Moved to #5773

[hotcapy]

Done, here is an issue for FreeOffice.

[rusty-snake]

IF YOU WANT TO USE FIREJAIL FOR SANDBOXING INSTEAD OF SYSTEMD, you have to disable the systemd sandboxing.

Namely CapabilityBoundingSet, DynamicUser, NoNewPrivileges, ProtectSystem, RestrictNamespaces, SystemCallFilter.

[hotcapy]

Oh, got it. Reading wiki page about Firejail & systemd right now...
Sorry to everyone who has read original message. My knowledge is still poor and I wasn't aware of systemd sandboxing.
dnscrypt-proxy itself actually working fine with Firejail, it just requires additional privileges.
# firejail /usr/bin/dnscrypt-proxy -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml
Firejail profile is correct, not an issue. I'm sorry again.