DatabaseDir bugs

[kocv59]

/var/lib/vnstat is being created even if DatabaseDir is changed.

If DatabaseDir points to a symlink it doesn't start.

vnstat.service: Failed to set up special execution directory in /var/lib: Too many levels of symbolic links
vnstat.service: Failed at step STATE_DIRECTORY spawning /usr/sbin/vnstatd: Too many levels of symbolic links

[vergoh]

/var/lib/vnstat is being created even if DatabaseDir is changed.

Could you provide step by step instructions on how to reproduce this behaviour? The implementation reads the configuration file before database directory processing and that processing uses the value from the configuration file without having anything hardcoded. Is this related to hardened systemd service, the simple one or some other way of starting the daemon?

If DatabaseDir points to a symlink it doesn't start.

I haven't tested yet but I suspect the errors you are getting are coming from systemd instead of vnStat. The implementation in vnStat for handling the database directory is using stat() which queries the file or directory the symlink points to (if the target exists) instead of the symlink itself. STATE_DIRECTORY or (StateDirectory=) is part of systemd and not vnStat. If you change the database directory to something non-default while using the hardened systemd service file then you'd need to update that service file to apply the hardening to the correct new database directory. vnStat has no control over that systemd's behaviour, otherwise it wouldn't be a too great hardening after all.

[kocv59]

Try and set DatabaseDir to /usr/files/vnstat in /etc/vnstat.conf and add ReadWritePaths=/usr/files/vnstat under [Service] to /etc/systemd/system/vnstat.service.d/override.conf and create /usr/files/vnstat yourself. sudo systemctl restart vnstat creates /var/lib/vnstat every restart.

[vergoh]

StateDirectory=vnstat in /etc/systemd/system/vnstat.service is what's causing /var/lib/vnstat getting created by systemd. vnStat itself isn't creating the directory in that situation. When using override.conf with a custom database directory, the correct content in your scenario would be:

[Service]
ReadWritePaths=/usr/files/vnstat
StateDirectory=

in order to avoid systemd creating /var/lib/vnstat for you. StateDirectory= being set empty is what you were missing.