0

The apparmour profile for ejabberd is broken. With startup of ejabberd: sudo systemctrl (re)start ejabberd the process hangs and in the reason is that erlang is unable to communicate with systemd with it's notify hook fails with:

2022-06-01 09:12:46.211457+03:00 [error] <0.356.0>@ejabberd_systemd:handle_info/2:135 Cannot ping watchdog: {badmatch,{error,eacces}}

There is path problem most likely in it or right issue. Funny thing is that with exactly same config on other server works.... Anyone?

Sami Hulkko
  • 95
  • 1
  • 5
  • I have the same issue, [error] <0.343.0>@ejabberd_systemd:handle_info/2:135 Cannot ping watchdog: {badmatch,{error,eacces}} I probably did something wrong in the config, oh well, there goes another sunday sacrificed to the computer gods – Shodan Oct 24 '22 at 08:55
  • It seems to be related to ejabberd behind NAT. – Sami Hulkko Oct 26 '22 at 13:57
  • Thank you for this clue, my ejabberd instance lives in docker with default networking parameters – Shodan Oct 27 '22 at 23:56
  • Yeah I have one in behind NAT with only ports 5222 5269 open and AppArmour fails. Most likely the ejabberd makes some query outward if it is connected with some other port that is relayed to AppArmour. Owerall its service with erlang that fails. – Sami Hulkko Oct 28 '22 at 13:16

2 Answers2

0

This systemd Unit file from 20.04 solves the problem:

Description=A distributed, fault-tolerant Jabber/XMPP server
Documentation=https://www.process-one.net/en/ejabberd/docs/
After=epmd.service network.target
Requires=epmd.service

[Service]
Type=forking
User=ejabberd
Group=ejabberd
LimitNOFILE=65536
Restart=on-failure
RestartSec=5
ExecStart=/bin/sh -c '/usr/sbin/ejabberdctl start && /usr/sbin/ejabberdctl started'
ExecStop=/bin/sh -c '/usr/sbin/ejabberdctl stop && /usr/sbin/ejabberdctl stopped'
ExecReload=/bin/sh -c '/usr/sbin/ejabberdctl reload_config'
PrivateTmp=true
ProtectHome=true
ProtectSystem=full
TimeoutSec=300

[Install]
WantedBy=multi-user.targe

Place here: /lib/systemd/system/ejabberd.service

Riddimshocker
  • 1
0

Works like a charm, watchgog error no longer present and starting the service is no longer hanged What is different compared to the original ejabberd.service: -WatchdogSec=30 (no longer present) -NotifyAccess=all (no longer present) -PrivateDevices=true (no longer present) -AmbientCapabilities=CAP_NET_BIND_SERVICE (no longer present)

  • ExecStart=/bin/sh -c '/usr/sbin/ejabberdctl foreground' (replaced with)
  • ExecStart=/bin/sh -c '/usr/sbin/ejabberdctl start && /usr/sbin/ejabberdctl started'
sigma
  • 1