I have a user vopi under which a systemd service is started (user-mode). The service is a python script that should write a file to a shared directory under path /usr/local/myfolder

The group set to myfolder is bot and I set a sticky bit to make all files created inside beeing owned by group bot.

Currently permissions of myfolder are looks like

drwxrwsr-x root bot ... myfolder

User vopi is inclided in group bot

When I start the script like python main.py it successfully creates a file under myfolder and it have permissions -rw-rw-r-- vopi bot .... However, when I call systemctl --user start myservice it tries to make a file with permissions -rw-r--r-- vopi vopi and fails (I figured this out by temporary setting a group vopi to myfolder

Why does my script running under systemd unit is ignoring sticky bit set on directory and why does permissions are not -rw-rw-r--?

I have tried to set Group= option in unit config but it didn't work. The service failed with error: 216 Group


I set a sticky bit to make all files created inside being owned by group bot.

This suggests that adding a sticky bit makes file ownership and permissions to be inherited from the parent folder. That's not the purpose of sticky bits. Sticky bit is a restricted deletion flag.

The man chmod on Linux describes both its current function and history:

The restricted deletion flag or sticky bit is a single bit, whose interpretation depends on the file type. For directories, it prevents unprivileged users from removing or renaming a file in the directory unless they own the file or the directory; this is called the restricted deletion flag for the directory, and is commonly found on world-writable directories like /tmp.

For regular files on some older systems, the bit saves the program's text image on the swap device so it will load more quickly when run; this is called the sticky bit.

Your 216 Group error comes from the fact that systemd.unit configuration doesn't have such [Unit] Section Option as Group=. It's a systemd.exec (Execution environment configuration) option that belongs to [Service] (, [Socket], [Mount], or [Swap]) sections:

User=, Group=

Set the UNIX user or group that the processes are executed as, respectively. Takes a single user or group name, or a numeric ID as argument.

For system services (services run by the system service manager, i.e. managed by PID 1) and for user services of the root user (services managed by root's instance of systemd --user), the default is root, but User= may be used to specify a different user.

For user services of any other user, switching user identity is not permitted, hence the only valid setting is the same user the user's service manager is running as. If no group is set, the default group of the user is used. This setting does not affect commands whose command line is prefixed with "+".

  • it is already in [Service] group – tr1me Jun 24 '18 at 11:32

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.