#16369·chef

chef_client_systemd_timer silently ignores the `user` property

Author: decoyjoeCreated Sep 15, 2026Updated Sep 15, 2026
LabelsStatus: Untriaged

Description

chef_client_systemd_timer accepts a user property, but never writes it into the systemd service unit it generates. The property is dead code. The service_content function in the resource code builds the [Service] section without ever reading new_resource.user.

The result is the user property is silently ignored. Setting user "foobar" produces no warning, no error, and a successful converge without any indication that the user property was applied/updated. Anyone relying on this property to drop privileges to a less-privileged user has a node that is actually running as root.

The property was included in the initial commit of the resource in Add chef_client_systemd_timer resource (14af178), 2020-04-08, and shipped in Chef 16. Looks like the property was simply never wired up to the systemd service unit template.

Chef Version

19.4.32 (current main). Present in every release since 16.0.

Platform Version

Rocky Linux 9. Affects every systemd platform.

Replication Case

ruby
chef_client_systemd_timer "timer with a non-root user" do
  user "foobar"
end

Then inspect the generated unit:

bash
$ cat /etc/systemd/system/chef-client.service
[Unit]
Description=Chef Infra Client periodic execution
After=network.target auditd.service

[Service]
Type=oneshot
ExecStart=/bin/chef-client -c /etc/chef/client.rb
SuccessExitStatus=3
SuccessExitStatus=213
SuccessExitStatus=35
SuccessExitStatus=37
SuccessExitStatus=41

[Install]
WantedBy=multi-user.target

Expected a User=foobar line in the [Service] section.