asterisk users - Jan 2020 - permission woes on systemd

I'm running asterisk 16 on Fedora 31. If I start asterisk as user 
asterisk, all goes well. But if I start asterisk from systemd:

asterisk[1411]: [Jan 21 19:36:47] ERROR[1411]: res_sorcery_config.c:320 
sorcery_config_internal_load: Unable to load config file 'pjsip.conf'
Jan 21 19:36:47 asterisk.riverside asterisk[1411]: [Jan 21 19:36:47] 
ERROR[1411]: config_options.c:710 aco_process_config: Unable to load 
config file 'confbridge.conf'
asterisk[1411]: [Jan 21 19:36:47] ERROR[1411]: app_confbridge.c:4351 
load_module: Unable to load config. Not loading module.
asterisk[1411]: [Jan 21 19:36:47] WARNING[1411]: loader.c:2381 
load_modules: Some non-required modules failed to load.
asterisk[1411]: [Jan 21 19:36:47] ERROR[1411]: loader.c:2396 
load_modules: res_stun_monitor declined to load.
asterisk[1411]: [Jan 21 19:36:47] ERROR[1411]: loader.c:2396 
load_modules: res_xmpp declined to load.
asterisk[1411]: [Jan 21 19:36:47] ERROR[1411]: loader.c:2396 
load_modules: Declined modules which depend on res_xmpp: chan_motif
asterisk[1411]: [Jan 21 19:36:47] ERROR[1411]: loader.c:2396 
load_modules: chan_iax2 declined to load.
asterisk[1411]: [Jan 21 19:36:47] ERROR[1411]: loader.c:2396 
load_modules: app_confbridge declined to load.

It seems to be a permission problem:

module load res_xmpp.so
Unable to load module res_xmpp.so
Command 'module load res_xmpp.so' failed.
   == Parsing '/etc/asterisk/xmpp.conf': Not found (Permission denied)

module load res_stun_monitor.so
Unable to load module res_stun_monitor.so
Command 'module load res_stun_monitor.so' failed.
   == Parsing '/etc/asterisk/res_stun_monitor.conf': Not found 
(Permission denied)

module load chan_iax2.so
Unable to load module chan_iax2.so
Command 'module load chan_iax2.so' failed.
   == Parsing '/etc/asterisk/iax.conf': Not found (Permission denied)

But the files are all there, with appropriate permissions (I think) :

ls -l /etc/asterisk | grep 'xmpp\|monitor\|iax\|confbridge'
-rw-r--r--. 1 asterisk asterisk 23674 Dec 12 19:54 confbridge.conf
-rw-r--r--. 1 asterisk asterisk  1250 Dec 12 19:54 iax.conf
-rw-r--r--. 1 asterisk asterisk  2401 Dec 19 18:30 iaxprov.conf
-rw-r--r--. 1 asterisk asterisk  1403 Dec 12 19:54 res_stun_monitor.conf
-rw-r--r--. 1 asterisk asterisk  2728 Dec 12 19:55 xmpp.conf

cat /usr/lib/systemd/system/asterisk.service | grep -v '#'
[Unit]
Description=Asterisk PBX and telephony daemon.
After=nss-lookup.target

[Service]
Type=simple
Environment=HOME=/var/lib/asterisk
WorkingDirectory=/var/lib/asterisk
User=asterisk
Group=asterisk
ExecStart=/usr/sbin/asterisk -f -C /etc/asterisk/asterisk.conf
ExecStop=/usr/sbin/asterisk -rx 'core stop now'
ExecReload=/usr/sbin/asterisk -rx 'core reload'

PrivateTmp=true

[Install]
WantedBy=multi-user.target

So why would starting asterisk as user asterisk work, but fail using 
systemd ?

Any help appreciated.

sean

----- Original Message -----
> From: "sean darcy" <seandarcy2 at gmail.com>
> To: "Asterisk Users Mailing List, Non-Commercial Discussion"
<asterisk-users at lists.digium.com>
> Sent: Tuesday, January 21, 2020 9:22:28 PM
> Subject: [asterisk-users] permission woes on systemd
[..]
> So why would starting asterisk as user asterisk work, but fail using
> systemd ?
> 
Have you checked SELinux?  After creating the configuration files, did you run
'restorecon' on the appropriate asterisk directories?  If not, the files
are not labeled correctly and SELinux might be denying access.

Just a thought.

Michael

(elguero)

On 1/22/20 11:51 AM, Michael L. Young wrote:
> 
> ----- Original Message -----
>> From: "sean darcy" <seandarcy2 at gmail.com>
>> To: "Asterisk Users Mailing List, Non-Commercial Discussion"
<asterisk-users at lists.digium.com>
>> Sent: Tuesday, January 21, 2020 9:22:28 PM
>> Subject: [asterisk-users] permission woes on systemd
> 
> [..]
> 
>> So why would starting asterisk as user asterisk work, but fail using
>> systemd ?
>>
> 
> Have you checked SELinux?  After creating the configuration files, did you
run 'restorecon' on the appropriate asterisk directories?  If not, the
files are not labeled correctly and SELinux might be denying access.
> 
> Just a thought.
> 
> Michael
> 
> (elguero)
> 
Yup. That was it.

Thanks.