I am attempting to use openvpn with a raspberry Pi 4b (arm64) server using systemd to manage the tunnel. I have followed this documentation: https://wiki.archlinux.org/title/Mullvad#Using_systemd[1]. I can successfully start the connection from the command line using: [code]sudo systemd start openvpn-client@mullvad.service[/code] I am trying to daemonized the service so it runs automatically when the service starts it with this command: [code]sudo systemd enable openvpn-client@mullvad.service[/code] When I reboot the server, I get this message: `Feb 28 19:40:54 server openvpn[1353]: /sbin/resolvconf: 31: kill: Operation not permitted Feb 28 19:40:54 server openvpn[872]: WARNING: Failed running command (--up/--down): external program exited with error status: 1 Feb 28 19:40:54 server openvpn[872]: Exiting due to fatal error Feb 28 19:40:54 server systemd[1]: openvpn-client@mullvad.service: Main process exited, code=exited, status=1/FAILURE Feb 28 19:40:54 server systemd[1]: openvpn-client@mullvad.service: Failed with result 'exit-code'.` The key error looks to be this line: [code]openvpn[1353]: /sbin/resolvconf: 31: kill: Operation not permitted[/code] So it looks like the systemd is having trouble running the [code]update-resolv-conf[/code] script during boot. I have tried using the default script that came with my distribution (Raspberry PI OS x64 which is Debian buster) and also the Mullvad supplied script, both are almost identical and they both fail in the same way. Any ideas on what the script is trying to kill where the operation is not permitted? Why does it work when I run it from the command line but not when the system runs it during boot? I checked the permissions. The script is owned by root and and is executable. Here is the script that is failing: [code][ "$dev" ] || exit 0 split_into_parts() { part1="$1" part2="$2" part3="$3" } case "$script_type" in up) NMSRVRS="" SRCHS="" for optionvarname in ${!foreign_option_*} ; do option="${!optionvarname}" echo "$option" split_into_parts $option if [ "$part1" = "dhcp-option" ] ; then if [ "$part2" = "DNS" ] ; then NMSRVRS="${NMSRVRS:+$NMSRVRS }$part3" elif [ "$part2" = "DOMAIN" ] ; then SRCHS="${SRCHS:+$SRCHS }$part3" fi fi done R="" [ "$SRCHS" ] && R="search $SRCHS " for NS in $NMSRVRS ; do R="${R}nameserver $NS " done echo -n "$R" | /sbin/resolvconf -a "${dev}.openvpn" ;; down) /sbin/resolvconf -d "${dev}.openvpn" ;; esac[/code] System Information: - OpenVPN 2.5.1 aarch64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2021

OpenVPN fails to start with error: resolvconf: 31: kill: Operation not permitted when starting openvpn-client tunnel

iooopenvpn

I am attempting to use openvpn with a raspberry Pi 4b (arm64) server using systemd to manage the tunnel. I have followed this documentation: https://wiki.archlinux.org/title/Mullvad#Using_systemd[1].

I can successfully start the connection from the command line using:

sudo systemd start openvpn-client@mullvad.service

I am trying to daemonized the service so it runs automatically when the service starts it with this command:

sudo systemd enable openvpn-client@mullvad.service

When I reboot the server, I get this message:
`Feb 28 19:40:54 server openvpn[1353]: /sbin/resolvconf: 31: kill: Operation not permitted
Feb 28 19:40:54 server openvpn[872]: WARNING: Failed running command (--up/--down): external program exited with error status: 1
Feb 28 19:40:54 server openvpn[872]: Exiting due to fatal error
Feb 28 19:40:54 server systemd[1]: openvpn-client@mullvad.service: Main process exited, code=exited, status=1/FAILURE
Feb 28 19:40:54 server systemd[1]: openvpn-client@mullvad.service: Failed with result 'exit-code'.`

The key error looks to be this line:

openvpn[1353]: /sbin/resolvconf: 31: kill: Operation not permitted

So it looks like the systemd is having trouble running the

update-resolv-conf

script during boot. I have tried using the default script that came with my distribution (Raspberry PI OS x64 which is Debian buster) and also the Mullvad supplied script, both are almost identical and they both fail in the same way.

Any ideas on what the script is trying to kill where the operation is not permitted?
Why does it work when I run it from the command line but not when the system runs it during boot?
I checked the permissions. The script is owned by root and and is executable.

Here is the script that is failing:

[ "$dev" ] || exit 0

split_into_parts()
{
        part1="$1"
        part2="$2"
        part3="$3"
}

case "$script_type" in
  up)
        NMSRVRS=""
        SRCHS=""
        for optionvarname in ${!foreign_option_*} ; do
                option="${!optionvarname}"
                echo "$option"
                split_into_parts $option
                if [ "$part1" = "dhcp-option" ] ; then
                        if [ "$part2" = "DNS" ] ; then
                                NMSRVRS="${NMSRVRS:+$NMSRVRS }$part3"
                        elif [ "$part2" = "DOMAIN" ] ; then
                                SRCHS="${SRCHS:+$SRCHS }$part3"
                        fi
                fi
        done
        R=""
        [ "$SRCHS" ] && R="search $SRCHS
"
        for NS in $NMSRVRS ; do
                R="${R}nameserver $NS
"
        done
        echo -n "$R" | /sbin/resolvconf -a "${dev}.openvpn"
        ;;
  down)
        /sbin/resolvconf -d "${dev}.openvpn"
        ;;
esac

System Information:
- OpenVPN 2.5.1 aarch64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2021

300000

You start open on from PI user and dont have Access permission on openvpn config file. You need deal with file permissions first and start again .

iooopenvpn

300000 wrote You start open on from PI user and dont have Access permission on openvpn config file. You need deal with file permissions first and start again .

Hi, could you explain this a bit more? Are you suggesting that I need to start openvpn as a Pi user?

I am trying to get the script started from a systemd service, shouldn't this use the root account?

For example, the script lives in /etc/openvpn and files here are owned by root. Are you suggesting I change this folder permission to the pi users group?

xalucardx

Since RaspiOS is downloading the packages from Debian's repo. A bug report will probably need to be filled on the Debian tracker. Looks like there was one already filed: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=998388

Here is a summary of the workaround:

sudo systemctl edit openvpn-client@.service

Notice that I'm adding each option twice. Once with blank values, and again with the needed values. You have to "clear out" each option before systemd will recognize the overridden changes.

Besides the extra "blank options". The only other change was made was adding "CAP_KILL" at the end of the "CapabilityBoundingSet=" option.

For example:

### Editing /etc/systemd/system/openvpn-client@.service.d/override.conf
### Anything between here and the comment below will become the new contents of the file

[Unit]
Description=
Description=OpenVPN tunnel for %I
After=
After=network-online.target
Wants=
Wants=network-online.target
Documentation=
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=
Type=notify
PrivateTmp=
PrivateTmp=true
WorkingDirectory=
WorkingDirectory=/etc/openvpn/client
ExecStart=
ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf
CapabilityBoundingSet=
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_KILL
LimitNPROC=
LimitNPROC=10
DeviceAllow=
DeviceAllow=/dev/null rw
DeviceAllow=
DeviceAllow=/dev/net/tun rw
ProtectSystem=
ProtectSystem=true
ProtectHome=
ProtectHome=true
KillMode=
KillMode=process

[Install]
WantedBy=multi-user.target

### Lines below this comment will be discarded

### /lib/systemd/system/openvpn-client@.service
# [Unit]
# Description=OpenVPN tunnel for %I
# After=network-online.target
# Wants=network-online.target
# Documentation=man:openvpn(8)
# Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
# Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO
#
# [Service]
# Type=notify
# PrivateTmp=true
# WorkingDirectory=/etc/openvpn/client
# ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf
# CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
# LimitNPROC=10
# DeviceAllow=/dev/null rw
# DeviceAllow=/dev/net/tun rw
# ProtectSystem=true
# ProtectHome=true
# KillMode=process
#
# [Install]
# WantedBy=multi-user.target

Once you save the systemd override file, you need to run the following:

sudo systemctl daemon-reload
sudo systemctl restart openvpn-client@mullvad.service

If that doesn't work... A second option is to replace "openresolv" with "resolvconf".

sudo apt remove --purge openresolv
sudo apt install resolvconf

I don't know what pros and cons there are to swapping out openresolv for resolvconf... YMMV...

The third and last option is to comment out "user nobody" and "group nogroup" in your openvpn user config file. This is the worse option of all three...

Hope this helps!