systemd "Environment" variable containing %c fails

Question

I'm trying to define a service startup which requires a decryption password set as a variable, along with another couple of variables. That encryption password has %c as part of the variable's contents, and this is causing a problem that I can't seem to get around.

If I go between editing the service definition, doing a systemctl daemon-reload, then systemctl show | grep Env, I can see that....

• if I set Environment="PASSWORD=blah%ci" then I get Environment=PASSWORD=blah/servicei

• if I set Environment="PASSWORD=blah\%ci" then I get Environment=

I also tried enclosing that variable in various different quotes without any real change of behaviour.

I'm using Ubuntu 20.04.

Thanks in advance.

Answer 1

In systemd units, you can use various specifiers in the form %<char> (e.g., most common would be %i for the instance name for template units). Check the "Specifiers" section of man 5 systemd.unit for the full list. While %c is not listed there, I suppose it might be undocumented. In any case, the last item in the table of specifiers is what you need:

Specifier	Meaning	Details
"%%"	Single percent sign	Use "%%" in place of "%" to specify a single percent sign.

So what you need is something like:

Environment="PASSWORD=blah%%ci"

However, an alternative is to use an EnvironmentFile instead, and put such special environment variables in that file (see another answer by me for an example of another such environment variable running afoul of systemd syntax). This might also be marginally more secure, as the systemd unit is often visible to everybody, but EnvironmentFiles can be restricted to be accessible only to root.

A third and much more involved option would be to use credentials instead, but that would require modification of the service as well.