Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
Upgrade from debian 10 to debian 11

resolvconf is called during startup from an openvpn service, but fails with the message

openvpn[4511]: /sbin/resolvconf: 31: kill: Operation not permitted
openvpn[4020]: WARNING: Failed running command (--up/--down): external program exited with error status: 1
openvpn[4020]: Exiting due to fatal error

Thus, the openvpn connection is not started.

restarting the service with openvpn-client@example will bring up openvpn

It seems, that this is related to the capabilities of openvpn, when run as a service

https://forums.openvpn.net/viewtopic.php?f=4&t=24993&sid=14319b7b38867b271a0cb1ac09c994ea&start=20

the only line in resolvconf that uses kill is line 874

if $have_pid && ! kill -0 "$pid"; then

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

booting the system, where openvpn-client@example has been enabled as service

   * What was the outcome of this action?
openvpn is not started because of the failure in resolvconf

   * What outcome did you expect instead?
working openvpn connection
*** End of the template - remove these template lines ***

I just checked. Giving the permission for kill CAP_KILL in

/lib/systemd/system/openvpn-client@.service

resolves the problem.


But besides kill there are other ways to see if a process exists e.g.

ps -o pid= -p <pid>

However, by replaing the relevant line in /sbin/resolvconf still resulted
in the error  message.


Regards

Dominik

Hi!

Catched the same issue. I'm not using systemd service. Openvpn is
started manually from shell as root. Script security is set to 2 to
allow run everything.
Multiple times openvpn restart connection and script executes well. But
sometimes script exits with error code:

```

+ : /var/run/avahi-daemon/pid
+ [ -s /var/run/avahi-daemon/pid ]
+ cat /var/run/avahi-daemon/pid
+ kill -HUP 935
/sbin/resolvconf: 31: kill: Operation not permitted

+ retval=1
```

Source file is: `/lib/resolvconf/libc.d/avahi-daemon`

Many openresolv subscribers send SIGHUP to resolver processes so they
reload their configuration so the capability is definitely needed.

Roy