Indeed, however the latest upstream from arch 1.4.230-2, only seems to remove the one line SystemCallFilter=~@resources @privileged, /usr/lib/systemd/system/murmur.service, which will still result in it failing to start, unless all the other parameters are removed from the unit file. So the problem may still persist after the upstream hits parabola repos? The orginal issue talks of crashing when a client tries to connect, which isn't the issue here, but given how many extra parameters there now are in the unit file compared to pre 1.4 versions, it may well part of a similar issue?

ryry

It turns out this issue is now up-streamed to, here:
https://bugs.archlinux.org/task/73496

It appears that the change to the systemd unit was one for a better security/privileges situation. Before murmur would run as root and drop to the murmur user, whereas now it runs as the murmur user for the start and the systemd settings re privileges, prevents any change of privilege, which causes issues with the lets encrypt privkey and cert permissions and hence it exits with a failure. The above arch bug page lists how to deal with this change using either acl (and thus allowing murmur user strict access to only the files it needs or by deploying a hook/coping certs to another folder, the location off which is under discussion (according to the bug report disscussions at the bottom).

I can confirm after using acl, and using the new systemd unit config, murmur starts fine and can use the lets encrypt certs without any issue.

ryry

Small question off-topic: could this be prevented with another init system (e.g. OpenRC)? Not advocating for anything, trolling nor looking for a flame war. I just want to know. Thanks.

I haven't used any other init systems myself, at least not day to day and with murmur. However It may work differently with them, as murmur daemon runs can be started and back grounded in the terminal and in that sense I guess is unaffected by the init system, but I don't personally know if openrc etc have similar settings or defaults as to the added settings in the systemd unit file?

ryry

yes, there never was anything for parabola to do about this - i
believe the OP opened this mainly as documentation, to share the
solution, for benefit of others who may have the same problem

Indeed at first I wasn't sure if it was parabola specific issue as there where two separate issues and the latter hadn't been up streamed when I added the report, but both where upstreamed soon after, needless to say I added the solution I found upstream for the benefit of anyone else having the same problem.