From 5b36c591ef0e79ee1fd4a0db4644d9d0e8d183ca Mon Sep 17 00:00:00 2001

From: Matus Honek <mhonek@redhat.com>

Date: Mon, 27 May 2019 10:59:03 +0000

Subject: [PATCH] Issue 49875 - Move SystemD service config to a drop-in file

Bug Description:

Runtime configuration options are mixed into the service specification

which should seldom be changed by users.

Fix Description:

Move the runtime configuration options into a drop-in file. These options

are then automatically pulled in by SystemD.

Additional Info:

Erasing the default values of the mentioned options to implicitly pull in

system defaults which are more sane nowadays.

The .service file is now common for xsan and non-xsan builds, the former

differring only by an additional drop-in file.

Related https://pagure.io/389-ds-base/issue/49875

Author: Matus Honek <mhonek@redhat.com>

Review by: firstyear, mreynolds, vashirov (thanks!)

---

 Makefile.am                                   | 23 ++++--

 configure.ac                                  |  2 +

 .../systemd.template.service.custom.conf.in   | 52 +++++++++++++

 wrappers/systemd.template.service.in          | 57 +-------------

 .../systemd.template.service.xsan.conf.in     | 11 +++

 wrappers/systemd.template.xsan.service.in     | 77 -------------------

 6 files changed, 85 insertions(+), 137 deletions(-)

 create mode 100644 wrappers/systemd.template.service.custom.conf.in

 create mode 100644 wrappers/systemd.template.service.xsan.conf.in

 delete mode 100644 wrappers/systemd.template.xsan.service.in

diff --git a/Makefile.am b/Makefile.am

index 01ac3a04d..de9e0c460 100644

--- a/Makefile.am

+++ b/Makefile.am

@@ -300,6 +300,7 @@ serverdir = $(libdir)/@serverdir@

 serverplugindir = $(libdir)@serverplugindir@

 taskdir = $(datadir)@scripttemplatedir@

 systemdsystemunitdir = @with_systemdsystemunitdir@

+systemdsystemunitdropindir = @with_systemdsystemunitdir@/$(PACKAGE_NAME)@.service.d

 systemdsystemconfdir = @with_systemdsystemconfdir@

 systemdgroupname = @with_systemdgroupname@

 initdir = @initdir@

@@ -880,6 +881,11 @@ if SYSTEMD

 systemdsystemunit_DATA = wrappers/$(PACKAGE_NAME)@.service \

 	wrappers/$(systemdgroupname) \

 	wrappers/$(PACKAGE_NAME)-snmp.service

+

+systemdsystemunitdropin_DATA = wrappers/$(PACKAGE_NAME)@.service.d/custom.conf

+if with_sanitizer

+systemdsystemunitdropin_DATA += wrappers/$(PACKAGE_NAME)@.service.d/xsan.conf

+endif

 else

 if INITDDIR

 init_SCRIPTS = wrappers/$(PACKAGE_NAME) \

@@ -2314,12 +2320,17 @@ endif

 # yes, that is an @ in the filename . . .

 %/$(PACKAGE_NAME)@.service: %/systemd.template.service.in

 	if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi

-	if [ ! -z ${SANITIZER} ] ; then \

-		service_template=$(shell echo $^ | sed 's/template/template.xsan/g'); \

-		else \

-		service_template=$^; \

-	fi; \

-	$(fixupcmd) $$service_template > $@

+	$(fixupcmd) $^ > $@

+

+%/$(PACKAGE_NAME)@.service.d/custom.conf: %/systemd.template.service.custom.conf.in

+	if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi

+	$(fixupcmd) $^ > $@

+

+if with_sanitizer

+%/$(PACKAGE_NAME)@.service.d/xsan.conf: %/systemd.template.service.xsan.conf.in

+	if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi

+	$(fixupcmd) $^ > $@

+endif

 %/$(systemdgroupname): %/systemd.group.in

 	if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi

diff --git a/configure.ac b/configure.ac

index 3660e6816..d329e84a9 100644

--- a/configure.ac

+++ b/configure.ac

@@ -196,6 +196,8 @@ AC_SUBST([ubsan_cflags])

 AC_SUBST([ubsan_rust_defs])

 AM_CONDITIONAL(enable_ubsan,test "$enable_ubsan" = "yes")

+AM_CONDITIONAL(with_sanitizer,test "$enable_asan" = "yes" -o "$enable_msan" = "yes" -o "$enable_tsan" = "yes" -o "$enable_ubsan" = "yes")

+

 # Enable CLANG

 AC_MSG_CHECKING(for --enable-clang)

 AC_ARG_ENABLE(clang, AS_HELP_STRING([--enable-clang], [Enable clang (default: no)]),

diff --git a/wrappers/systemd.template.service.custom.conf.in b/wrappers/systemd.template.service.custom.conf.in

new file mode 100644

index 000000000..0dce62826

--- /dev/null

+++ b/wrappers/systemd.template.service.custom.conf.in

@@ -0,0 +1,52 @@

+# To change any of the below values, please use a drop-in file in which

+# you can declare overrides according to systemd.unit(5), either of:

+# - applying to all instances:

+#   /etc/systemd/system/dirsrv@.service.d/custom.conf

+# - applying to a single instance (overriding the above):

+#   /etc/systemd/system/dirsrv@<instance>.service.d/custom.conf

+#

+# Some of the most interesting coniguration options are mentioned below.

+# See systemd.service(5) and systemd.exec(5) for the respective documentation.

+#

+# After updating the service configuration, do not forget to apply the changes:

+# - reload systemd configuration: systemctl daemon-reload

+# - restart the service: systemctl restart @package_name@@<instance>.service

+

+[Service]

+TimeoutStartSec=0

+TimeoutStopSec=600

+

+# These are from man systemd.exec and man systemd.resource-control

+

+# This controls the resources to the direct child of systemd, in

+# this case ns-slapd. Because we are type notify we recieve these

+# limits correctly.

+

+# This controls the number of file handles avaliable. File handles

+# correlate to sockets for the process, and our access to logs and

+# databases.  Note, the configuration setting in Directory Server,

+# "nsslapd-maxdescriptors", can override this limit.

+#LimitNOFILE=

+

+# You can limit the memory in the cgroup with these, and ns-slapd

+# will account for them in it's autotuning.

+# Memory account may be controlled by DefaultMemoryAccounting= in systemd-system.conf

+#MemoryAccounting=yes

+#MemoryLimit=<bytes>

+

+# Limits on the size of coredump that may be produced by the process. It's not

+# specified how this interacts with coredumpd.

+# 0 means not to produce cores.

+#LimitCORE=<bytes>

+

+# Limit number of processes (threads) we may spawn. We don't advise you change

+# this as DS will autodetect your threads / cpus and adjust as needed.

+#LimitNPROC=

+

+# Possible hardening options:

+#PrivateDevices=yes

+#ProtectSystem=yes

+#ProtectHome=yes

+#PrivateTmp=yes

+

+

diff --git a/wrappers/systemd.template.service.in b/wrappers/systemd.template.service.in

index 7142c3492..2ac6f978f 100644

--- a/wrappers/systemd.template.service.in

+++ b/wrappers/systemd.template.service.in

@@ -1,17 +1,6 @@

-# you usually do not want to edit this file - instead, edit the

-# @initconfigdir@/@package_name@.systemd file instead - otherwise,

-# do not edit this file in /lib/systemd/system - instead, do the following:

-# cp /lib/systemd/system/dirsrv\@.service /etc/systemd/system/dirsrv\@.service

-# mkdir -p /etc/systemd/system/@systemdgroupname@.wants

-# edit /etc/systemd/system/dirsrv\@.service - uncomment the LimitNOFILE=8192 line

-# where %i is the name of the instance

-# you may already have a symlink in

-# /etc/systemd/system/@systemdgroupname@.wants/dirsrv@%i.service pointing to

-# /lib/systemd/system/dirsrv\@.service - you will have to change it to link

-# to /etc/systemd/system/dirsrv\@.service instead

-# ln -s /etc/systemd/system/dirsrv\@.service /etc/systemd/system/@systemdgroupname@.wants/dirsrv@%i.service

-# systemctl daemon-reload 

-# systemctl (re)start @systemdgroupname@

+# You should not need to edit this file. Instead, use a drop-in file as described in:

+#   /usr/lib/systemd/system/@package_name@@.service.d/custom.conf

+

 [Unit]

 Description=@capbrand@ Directory Server %i.

 PartOf=@systemdgroupname@

@@ -21,51 +10,11 @@ Before=radiusd.service

 [Service]

 Type=notify

 NotifyAccess=all

-TimeoutStartSec=0

-TimeoutStopSec=600

 EnvironmentFile=-@initconfigdir@/@package_name@

 EnvironmentFile=-@initconfigdir@/@package_name@-%i

 PIDFile=@localstatedir@/run/@package_name@/slapd-%i.pid

 ExecStartPre=@libexecdir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif

 ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i @localstatedir@/run/@package_name@/slapd-%i.pid

-#### To change any of these values or directives, you should use a drop in file

-# such as: /etc/systemd/system/dirsrv@<instance>.d/custom.conf

-

-# These are from man systemd.exec and man systemd.resource-control

-

-# This controls the resources to the direct child of systemd, in

-# this case ns-slapd. Because we are type notify we recieve these

-# limits correctly.

-

-# This controls the number of file handles avaliable. File handles

-# correlate to sockets for the process, and our access to logs and

-# databases.  Note, the configuration setting in Directory Server,

-# "nsslapd-maxdescriptors", can override this limit.

-LimitNOFILE=16384

-

-# You can limit the memory in the cgroup with these, and ns-slapd

-# will account for them in it's autotuning.

-# Memory account may be controlled by DefaultMemoryAccounting= in systemd-system.conf

-# MemoryAccounting=true

-# MemoryLimit=bytes

-

-# Limits on the size of coredump that may be produced by the process. It's not

-# specified how this interacts with coredumpd.

-# 0 means not to produce cores.

-# This value is 64G

-LimitCORE=68719476736

-

-# Limit number of processes (threads) we may spawn. We don't advise you change

-# this as DS will autodetect your threads / cpus and adjust as needed.

-# LimitNPROC=

-

-# Hardening options:

-# PrivateDevices=true

-# ProtectSystem=true

-# ProtectHome=true

-# PrivateTmp=true

-

 [Install]

 WantedBy=multi-user.target

-

diff --git a/wrappers/systemd.template.service.xsan.conf.in b/wrappers/systemd.template.service.xsan.conf.in

new file mode 100644

index 000000000..f4bf809b9

--- /dev/null

+++ b/wrappers/systemd.template.service.xsan.conf.in

@@ -0,0 +1,11 @@

+# This file is present because the server has been built with a sanitizer.

+# It is not meant for a production usage.

+[Unit]

+Description=@capbrand@ Directory Server with @SANITIZER@ %i.

+

+[Service]

+# We can't symbolize here, as llvm symbolize crashes when it goes near systemd.

+Environment=ASAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.asan:print_stacktrace=1

+Environment=TSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.tsan:print_stacktrace=1:second_deadlock_stack=1:history_size=7

+Environment=MSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.msan:print_stacktrace=1

+Environment=UBSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.ubsan:print_stacktrace=1

diff --git a/wrappers/systemd.template.xsan.service.in b/wrappers/systemd.template.xsan.service.in

deleted file mode 100644

index 541392ff8..000000000

--- a/wrappers/systemd.template.xsan.service.in

+++ /dev/null

@@ -1,77 +0,0 @@

-# you usually do not want to edit this file - instead, edit the

-# @initconfigdir@/@package_name@.systemd file instead - otherwise,

-# do not edit this file in /lib/systemd/system - instead, do the following:

-# cp /lib/systemd/system/dirsrv\@.service /etc/systemd/system/dirsrv\@.service

-# mkdir -p /etc/systemd/system/@systemdgroupname@.wants

-# edit /etc/systemd/system/dirsrv\@.service - uncomment the LimitNOFILE=8192 line

-# where %i is the name of the instance

-# you may already have a symlink in

-# /etc/systemd/system/@systemdgroupname@.wants/dirsrv@%i.service pointing to

-# /lib/systemd/system/dirsrv\@.service - you will have to change it to link

-# to /etc/systemd/system/dirsrv\@.service instead

-# ln -s /etc/systemd/system/dirsrv\@.service /etc/systemd/system/@systemdgroupname@.wants/dirsrv@%i.service

-# systemctl daemon-reload 

-# systemctl (re)start @systemdgroupname@

-[Unit]

-Description=@capbrand@ Directory Server with @SANITIZER@ %i.

-PartOf=@systemdgroupname@

-After=chronyd.service ntpd.service network-online.target syslog.target

-Before=radiusd.service

-

-[Service]

-Type=notify

-NotifyAccess=all

-TimeoutStartSec=0

-TimeoutStopSec=600

-EnvironmentFile=@initconfigdir@/@package_name@

-EnvironmentFile=@initconfigdir@/@package_name@-%i

-PIDFile=@localstatedir@/run/@package_name@/slapd-%i.pid

-# We can't symbolize here, as llvm symbolize crashes when it goes near systemd.

-Environment=ASAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.asan:print_stacktrace=1

-Environment=TSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.tsan:print_stacktrace=1:second_deadlock_stack=1:history_size=7

-Environment=MSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.msan:print_stacktrace=1

-Environment=UBSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.ubsan:print_stacktrace=1

-LimitCORE=infinity

-ExecStartPre=@libexecdir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif

-ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i @localstatedir@/run/@package_name@/slapd-%i.pid

-

-#### To change any of these values or directives, you should use a drop in file

-# such as: /etc/systemd/system/dirsrv@<instance>.d/custom.conf

-

-# These are from man systemd.exec and man systemd.resource-control

-

-# This controls the resources to the direct child of systemd, in

-# this case ns-slapd. Because we are type notify we recieve these

-# limits correctly.

-

-# This controls the number of file handles avaliable. File handles

-# correlate to sockets for the process, and our access to logs and

-# databases.

-LimitNOFILE=16384

-

-# You can limit the memory in the cgroup with these, and ns-slapd

-# will account for them in it's autotuning.

-# Memory account may be controlled by DefaultMemoryAccounting= in systemd-system.conf

-# MemoryAccounting=true

-# MemoryLimit=bytes

-

-# Limits on the size of coredump that may be produced by the process. It's not

-# specified how this interacts with coredumpd.

-# 0 means not to produce cores.

-# This value is 64G

-LimitCORE=68719476736

-

-# Limit number of processes (threads) we may spawn. We don't advise you change

-# this as DS will autodetect your threads / cpus and adjust as needed.

-# LimitNPROC=

-

-# Hardening options:

-# PrivateDevices=true

-# ProtectSystem=true

-# ProtectHome=true

-# PrivateTmp=true

-

-

-[Install]

-WantedBy=multi-user.target

-

-- 

2.21.0