Cfxtrjtrk

So, I have spent a long time trying to fix a simple systemd service which can lift the kernel lockdown. After a lot of time spent researching and googling I couldn't find an answer to my question.

What I want is a script to run before an existing service called nbfc.service is run. I tried to do this by making a new service which calls this script before nbfc.service is called. My service file looks like this /etc/systemd/system/lift-kernel-lockdown.service:

[Unit]

Description=Disable kernel lockdown feature

Before=nbfc.service



[Service]

ExecStart=/opt/lift_kernel_lockdown.sh

Type=oneshot



[Install]

WantedBy=multi-user.target

The script I wrote looks like this /opt/lift_kernel_lockdown.sh:

#!/bin/bash -ex



DEFAULT_SYSRQ=$(sysctl -n kernel.sysrq)

sysctl -w kernel.sysrq=1

echo x > /proc/sysrq-trigger





sysctl -w kernel.sysrq=${DEFAULT_SYSRQ}

When I run the following command:

systemctl start lift-kernel-lockdown.service

I get the following output:

Job for lift-kernel-lockdown.service failed because the control process exited with error code.

See "systemctl status lift-kernel-lockdown.service" and "journalctl -xe" for details.

After this, I run the command:

systemctl status lift-kernel-lockdown.service

and I get the following output:

lift-kernel-lockdown.service - Disable kernel lockdown feature

   Loaded: loaded (/etc/systemd/system/lift-kernel-lockdown.service; disabled; vendor preset: enabled)

   Active: failed (Result: exit-code) since Sat 2019-04-06 23:48:03 CEST; 2min 34s ago

  Process: 5459 ExecStart=/opt/lift_kernel_lockdown.sh (code=exited, status=203/EXEC)

 Main PID: 5459 (code=exited, status=203/EXEC)



apr 06 23:48:03 davetop systemd[1]: Starting Disable kernel lockdown feature...

apr 06 23:48:03 davetop systemd[5459]: lift-kernel-lockdown.service: Failed to execute command: Permission denied

apr 06 23:48:03 davetop systemd[5459]: lift-kernel-lockdown.service: Failed at step EXEC spawning /opt/lift_kernel_lockdown.sh: Permission denied

apr 06 23:48:03 davetop systemd[1]: lift-kernel-lockdown.service: Main process exited, code=exited, status=203/EXEC

apr 06 23:48:03 davetop systemd[1]: lift-kernel-lockdown.service: Failed with result 'exit-code'.

apr 06 23:48:03 davetop systemd[1]: Failed to start Disable kernel lockdown feature.

When I run the command:

journalctl -xe

I get the output:

                                           wrapper@resource:///org/gnome/gjs/modules/_legacy.js:82:22

                                           _init/<@resource:///org/gnome/shell/ui/keyboard.js:503:13

apr 06 23:48:03 davetop gnome-shell[1495]: JS ERROR: TypeError: this._currentWindow is null

                                           _setCurrentRect@resource:///org/gnome/shell/ui/keyboard.js:536:13

                                           wrapper@resource:///org/gnome/gjs/modules/_legacy.js:82:22

                                           _init/<@resource:///org/gnome/shell/ui/keyboard.js:503:13

apr 06 23:48:03 davetop gnome-shell[1495]: JS ERROR: TypeError: this._currentWindow is null

                                           _setCurrentRect@resource:///org/gnome/shell/ui/keyboard.js:536:13

                                           wrapper@resource:///org/gnome/gjs/modules/_legacy.js:82:22

                                           _init/<@resource:///org/gnome/shell/ui/keyboard.js:503:13

apr 06 23:48:03 davetop polkitd(authority=local)[876]: Operator of unix-session:2 successfully authenticated as unix-user:david to gain TEMPORARY authorization for action org.freedesktop.systemd1.manage-u

apr 06 23:48:03 davetop systemd[1]: Starting Disable kernel lockdown feature...

-- Subject: Unit lift-kernel-lockdown.service has begun start-up

-- Defined-By: systemd

-- Support: http://www.ubuntu.com/support

-- 

-- Unit lift-kernel-lockdown.service has begun starting up.

apr 06 23:48:03 davetop systemd[5459]: lift-kernel-lockdown.service: Failed to execute command: Permission denied

apr 06 23:48:03 davetop systemd[5459]: lift-kernel-lockdown.service: Failed at step EXEC spawning /opt/lift_kernel_lockdown.sh: Permission denied

-- Subject: Process /opt/lift_kernel_lockdown.sh could not be executed

-- Defined-By: systemd

-- Support: http://www.ubuntu.com/support

-- 

-- The process /opt/lift_kernel_lockdown.sh could not be executed and failed.

-- 

-- The error number returned by this process is 13.

apr 06 23:48:03 davetop gnome-shell[1495]: JS ERROR: Exception in callback for signal: activate: Error: Error invoking IBus.set_global_engine_async: Expected function for callback argument callback, got u

                                           setEngine@resource:///org/gnome/shell/misc/ibusManager.js:207:9

                                           wrapper@resource:///org/gnome/gjs/modules/_legacy.js:82:22

                                           activateInputSource@resource:///org/gnome/shell/ui/status/keyboard.js:490:13

                                           wrapper@resource:///org/gnome/gjs/modules/_legacy.js:82:22

                                           _emit@resource:///org/gnome/gjs/modules/signals.js:128:27

                                           activate@resource:///org/gnome/shell/ui/status/keyboard.js:65:9

                                           wrapper@resource:///org/gnome/gjs/modules/_legacy.js:82:22

                                           _inputSourcesChanged@resource:///org/gnome/shell/ui/status/keyboard.js:620:13

                                           wrapper@resource:///org/gnome/gjs/modules/_legacy.js:82:22

                                           reload@resource:///org/gnome/shell/ui/status/keyboard.js:369:9

                                           wrapper@resource:///org/gnome/gjs/modules/_legacy.js:82:22

                                           _ibusSetContentType@resource:///org/gnome/shell/ui/status/keyboard.js:691:9

                                           wrapper@resource:///org/gnome/gjs/modules/_legacy.js:82:22

                                           _emit@resource:///org/gnome/gjs/modules/signals.js:128:27

                                           _setContentType@resource:///org/gnome/shell/misc/ibusManager.js:183:9

                                           wrapper@resource:///org/gnome/gjs/modules/_legacy.js:82:22

apr 06 23:48:03 davetop systemd[1]: lift-kernel-lockdown.service: Main process exited, code=exited, status=203/EXEC

apr 06 23:48:03 davetop systemd[1]: lift-kernel-lockdown.service: Failed with result 'exit-code'.

apr 06 23:48:03 davetop systemd[1]: Failed to start Disable kernel lockdown feature.

-- Subject: Unit lift-kernel-lockdown.service has failed

-- Defined-By: systemd

-- Support: http://www.ubuntu.com/support

-- 

-- Unit lift-kernel-lockdown.service has failed.

-- 

-- The result is RESULT.

apr 06 23:48:03 davetop polkitd(authority=local)[876]: Unregistered Authentication Agent for unix-process:5450:312328 (system bus name :1.439, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, 

lines 2683-2736/2736 (END)

I truly have no idea where to go from here or how to solve it, I would truly appreciate the help from someone with knowledge about this.