manpages.ubuntu.com/manpages/trusty/man1/lockfile.1.html tells me lockfile is part of procmail, which implies it is usually not available by default. It doesn’t mention, though, how the lock is implemented (fcntl(2) or flock(2)).

@eyoung100 See my answer below – it turns out that dpkg uses fcntl(2) rather than flock(2). Whether files locked through one method also appear locked to the other method (preventing them from being locked by either method concurrently) is implementation-dependent. I haven’t found any documentation on lockfile – is that a binary (and, if so, what provides it)? Or is it built into the shell (and if so, where can I find documentation on it)?

@eyoung100 When flock(1) returns true, it means it has successfully obtained the lock, that is, no one else is holding it. You can easily verify this by running two instances of flock -n /tmp/sleep.lock sleep 10 && echo Success || echo Could not obtain lock concurrently. The first one will sleep and then report success, the second one will return an error instantly. So this tells me that, when Synaptic is running but not installing, it has neither /var/lib/dpkg/lock-frontend nor /var/lib/dpkg/lock locked.

@RomeoNinov The job would acquire the lock upon starting and hold it until it is finished. During that time the package manager would be unable to acquire the lock.

@RomeoNinov dpkg might start while the job is already running, thus obtaining an actual lock (which inhibits the package manager as long as it is held by another process) would be the better solution.

Good explanation and nice extension for the workarounds I’d proposed. Basically it’s a way to maintain config files for executables that don’t support config files. With user=%i you’re still limited to one config per user (Alice can’t run one web server at 8080 and another at 8081), but my Workaround 2 would remove that limitation.

Indeed, should have been simple. Drawback being that it will cause the unit to report success even if something fails during start, such as the user account or the executable file missing.

...and in fact, man systemd.exec even states: WorkingDirectory= takes a directory path relative to the service's root directory specified by RootDirectory=, or the special value ~.

Just started tests: WorkingDirectory=~ works fine for me, whereas ExecStart will not work without an absolute path – though both these things may be version-dependent. Older versions of systemd do not recognize Type=exec but Type=single is quite similar and should work for this use case, too. (The only difference between the two is that single will wait for fork() before starting followup units whereas exec will wait for both fork() and execve() in the service process to return successfully. Without followup units this should make no difference.)