Is it possible to run keyd systemd service as DynamicUser (uid != 0)?

[woojiq]

Start a service like this:

keyd/keyd.service

Lines 7 to 8 in 04c9e15

	Type=simple
	ExecStart=/usr/bin/keyd

is ok on a personal machine, but when you want to create a service "for all" you need to sandbox service as much as possible. Now I'm trying to transfer the keyd service to NixOS and have a little trouble with DynamicUser option. So I'm wondering if this is even possible, I haven't looked at the codebase, maybe someone knows, or even starts the service like that.

[tkna91]

This may help you.

• Why must keyd have only one instance? #105
• keyd per user #228
• Config dir, log file and lock file command line options #70

[woojiq]

That's a bit not what I want to achieve. I understand that keyd can have one instance at a time and cannot be run for a specific user. This is fine. What I want to do is set the DynamicUser option (or User + Group) so that systemd will automatically apply multiple security settings for this service. Also, I tried adding /dev/input and /dev/uinput to DeviceAllow; input to SupplementaryGroups, but still sudo journalctl -eu keyd shows that it doesn't have access to /dev/input/event<num> .

If my wishes are theoretically possible, I can provide my exact solution and errors.
Hope I understand right that DynamicUser and #228 are different issues 🥲

[rvaiya]

I am not familiar with that particular systemd option, but as long as keyd has r/w access to /dev/uinput, /dev/input/event* (e.g the input group on most systems) and/etc/keyd, then it should work.

[woojiq]

Yes, it works. Only my fault as I am not a long time systemd user yet. I added access to /dev/input correctly and it works now. If anyone is interested in this in the future, the issue mentioned above has the answer to how we achieved this.
Cheers.