From 5b36c591ef0e79ee1fd4a0db4644d9d0e8d183ca Mon Sep 17 00:00:00 2001 From: Matus Honek Date: Mon, 27 May 2019 10:59:03 +0000 Subject: [PATCH] Issue 49875 - Move SystemD service config to a drop-in file Bug Description: Runtime configuration options are mixed into the service specification which should seldom be changed by users. Fix Description: Move the runtime configuration options into a drop-in file. These options are then automatically pulled in by SystemD. Additional Info: Erasing the default values of the mentioned options to implicitly pull in system defaults which are more sane nowadays. The .service file is now common for xsan and non-xsan builds, the former differring only by an additional drop-in file. Related https://pagure.io/389-ds-base/issue/49875 Author: Matus Honek Review by: firstyear, mreynolds, vashirov (thanks!) --- Makefile.am | 23 ++++-- configure.ac | 2 + .../systemd.template.service.custom.conf.in | 52 +++++++++++++ wrappers/systemd.template.service.in | 57 +------------- .../systemd.template.service.xsan.conf.in | 11 +++ wrappers/systemd.template.xsan.service.in | 77 ------------------- 6 files changed, 85 insertions(+), 137 deletions(-) create mode 100644 wrappers/systemd.template.service.custom.conf.in create mode 100644 wrappers/systemd.template.service.xsan.conf.in delete mode 100644 wrappers/systemd.template.xsan.service.in diff --git a/Makefile.am b/Makefile.am index 01ac3a04d..de9e0c460 100644 --- a/Makefile.am +++ b/Makefile.am @@ -300,6 +300,7 @@ serverdir = $(libdir)/@serverdir@ serverplugindir = $(libdir)@serverplugindir@ taskdir = $(datadir)@scripttemplatedir@ systemdsystemunitdir = @with_systemdsystemunitdir@ +systemdsystemunitdropindir = @with_systemdsystemunitdir@/$(PACKAGE_NAME)@.service.d systemdsystemconfdir = @with_systemdsystemconfdir@ systemdgroupname = @with_systemdgroupname@ initdir = @initdir@ @@ -880,6 +881,11 @@ if SYSTEMD systemdsystemunit_DATA = wrappers/$(PACKAGE_NAME)@.service \ wrappers/$(systemdgroupname) \ wrappers/$(PACKAGE_NAME)-snmp.service + +systemdsystemunitdropin_DATA = wrappers/$(PACKAGE_NAME)@.service.d/custom.conf +if with_sanitizer +systemdsystemunitdropin_DATA += wrappers/$(PACKAGE_NAME)@.service.d/xsan.conf +endif else if INITDDIR init_SCRIPTS = wrappers/$(PACKAGE_NAME) \ @@ -2314,12 +2320,17 @@ endif # yes, that is an @ in the filename . . . %/$(PACKAGE_NAME)@.service: %/systemd.template.service.in if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi - if [ ! -z ${SANITIZER} ] ; then \ - service_template=$(shell echo $^ | sed 's/template/template.xsan/g'); \ - else \ - service_template=$^; \ - fi; \ - $(fixupcmd) $$service_template > $@ + $(fixupcmd) $^ > $@ + +%/$(PACKAGE_NAME)@.service.d/custom.conf: %/systemd.template.service.custom.conf.in + if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi + $(fixupcmd) $^ > $@ + +if with_sanitizer +%/$(PACKAGE_NAME)@.service.d/xsan.conf: %/systemd.template.service.xsan.conf.in + if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi + $(fixupcmd) $^ > $@ +endif %/$(systemdgroupname): %/systemd.group.in if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi diff --git a/configure.ac b/configure.ac index 3660e6816..d329e84a9 100644 --- a/configure.ac +++ b/configure.ac @@ -196,6 +196,8 @@ AC_SUBST([ubsan_cflags]) AC_SUBST([ubsan_rust_defs]) AM_CONDITIONAL(enable_ubsan,test "$enable_ubsan" = "yes") +AM_CONDITIONAL(with_sanitizer,test "$enable_asan" = "yes" -o "$enable_msan" = "yes" -o "$enable_tsan" = "yes" -o "$enable_ubsan" = "yes") + # Enable CLANG AC_MSG_CHECKING(for --enable-clang) AC_ARG_ENABLE(clang, AS_HELP_STRING([--enable-clang], [Enable clang (default: no)]), diff --git a/wrappers/systemd.template.service.custom.conf.in b/wrappers/systemd.template.service.custom.conf.in new file mode 100644 index 000000000..0dce62826 --- /dev/null +++ b/wrappers/systemd.template.service.custom.conf.in @@ -0,0 +1,52 @@ +# To change any of the below values, please use a drop-in file in which +# you can declare overrides according to systemd.unit(5), either of: +# - applying to all instances: +# /etc/systemd/system/dirsrv@.service.d/custom.conf +# - applying to a single instance (overriding the above): +# /etc/systemd/system/dirsrv@.service.d/custom.conf +# +# Some of the most interesting coniguration options are mentioned below. +# See systemd.service(5) and systemd.exec(5) for the respective documentation. +# +# After updating the service configuration, do not forget to apply the changes: +# - reload systemd configuration: systemctl daemon-reload +# - restart the service: systemctl restart @package_name@@.service + +[Service] +TimeoutStartSec=0 +TimeoutStopSec=600 + +# These are from man systemd.exec and man systemd.resource-control + +# This controls the resources to the direct child of systemd, in +# this case ns-slapd. Because we are type notify we recieve these +# limits correctly. + +# This controls the number of file handles avaliable. File handles +# correlate to sockets for the process, and our access to logs and +# databases. Note, the configuration setting in Directory Server, +# "nsslapd-maxdescriptors", can override this limit. +#LimitNOFILE= + +# You can limit the memory in the cgroup with these, and ns-slapd +# will account for them in it's autotuning. +# Memory account may be controlled by DefaultMemoryAccounting= in systemd-system.conf +#MemoryAccounting=yes +#MemoryLimit= + +# Limits on the size of coredump that may be produced by the process. It's not +# specified how this interacts with coredumpd. +# 0 means not to produce cores. +#LimitCORE= + +# Limit number of processes (threads) we may spawn. We don't advise you change +# this as DS will autodetect your threads / cpus and adjust as needed. +#LimitNPROC= + +# Possible hardening options: +#PrivateDevices=yes +#ProtectSystem=yes +#ProtectHome=yes +#PrivateTmp=yes + + diff --git a/wrappers/systemd.template.service.in b/wrappers/systemd.template.service.in index 7142c3492..2ac6f978f 100644 --- a/wrappers/systemd.template.service.in +++ b/wrappers/systemd.template.service.in @@ -1,17 +1,6 @@ -# you usually do not want to edit this file - instead, edit the -# @initconfigdir@/@package_name@.systemd file instead - otherwise, -# do not edit this file in /lib/systemd/system - instead, do the following: -# cp /lib/systemd/system/dirsrv\@.service /etc/systemd/system/dirsrv\@.service -# mkdir -p /etc/systemd/system/@systemdgroupname@.wants -# edit /etc/systemd/system/dirsrv\@.service - uncomment the LimitNOFILE=8192 line -# where %i is the name of the instance -# you may already have a symlink in -# /etc/systemd/system/@systemdgroupname@.wants/dirsrv@%i.service pointing to -# /lib/systemd/system/dirsrv\@.service - you will have to change it to link -# to /etc/systemd/system/dirsrv\@.service instead -# ln -s /etc/systemd/system/dirsrv\@.service /etc/systemd/system/@systemdgroupname@.wants/dirsrv@%i.service -# systemctl daemon-reload -# systemctl (re)start @systemdgroupname@ +# You should not need to edit this file. Instead, use a drop-in file as described in: +# /usr/lib/systemd/system/@package_name@@.service.d/custom.conf + [Unit] Description=@capbrand@ Directory Server %i. PartOf=@systemdgroupname@ @@ -21,51 +10,11 @@ Before=radiusd.service [Service] Type=notify NotifyAccess=all -TimeoutStartSec=0 -TimeoutStopSec=600 EnvironmentFile=-@initconfigdir@/@package_name@ EnvironmentFile=-@initconfigdir@/@package_name@-%i PIDFile=@localstatedir@/run/@package_name@/slapd-%i.pid ExecStartPre=@libexecdir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i @localstatedir@/run/@package_name@/slapd-%i.pid -#### To change any of these values or directives, you should use a drop in file -# such as: /etc/systemd/system/dirsrv@.d/custom.conf - -# These are from man systemd.exec and man systemd.resource-control - -# This controls the resources to the direct child of systemd, in -# this case ns-slapd. Because we are type notify we recieve these -# limits correctly. - -# This controls the number of file handles avaliable. File handles -# correlate to sockets for the process, and our access to logs and -# databases. Note, the configuration setting in Directory Server, -# "nsslapd-maxdescriptors", can override this limit. -LimitNOFILE=16384 - -# You can limit the memory in the cgroup with these, and ns-slapd -# will account for them in it's autotuning. -# Memory account may be controlled by DefaultMemoryAccounting= in systemd-system.conf -# MemoryAccounting=true -# MemoryLimit=bytes - -# Limits on the size of coredump that may be produced by the process. It's not -# specified how this interacts with coredumpd. -# 0 means not to produce cores. -# This value is 64G -LimitCORE=68719476736 - -# Limit number of processes (threads) we may spawn. We don't advise you change -# this as DS will autodetect your threads / cpus and adjust as needed. -# LimitNPROC= - -# Hardening options: -# PrivateDevices=true -# ProtectSystem=true -# ProtectHome=true -# PrivateTmp=true - [Install] WantedBy=multi-user.target - diff --git a/wrappers/systemd.template.service.xsan.conf.in b/wrappers/systemd.template.service.xsan.conf.in new file mode 100644 index 000000000..f4bf809b9 --- /dev/null +++ b/wrappers/systemd.template.service.xsan.conf.in @@ -0,0 +1,11 @@ +# This file is present because the server has been built with a sanitizer. +# It is not meant for a production usage. +[Unit] +Description=@capbrand@ Directory Server with @SANITIZER@ %i. + +[Service] +# We can't symbolize here, as llvm symbolize crashes when it goes near systemd. +Environment=ASAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.asan:print_stacktrace=1 +Environment=TSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.tsan:print_stacktrace=1:second_deadlock_stack=1:history_size=7 +Environment=MSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.msan:print_stacktrace=1 +Environment=UBSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.ubsan:print_stacktrace=1 diff --git a/wrappers/systemd.template.xsan.service.in b/wrappers/systemd.template.xsan.service.in deleted file mode 100644 index 541392ff8..000000000 --- a/wrappers/systemd.template.xsan.service.in +++ /dev/null @@ -1,77 +0,0 @@ -# you usually do not want to edit this file - instead, edit the -# @initconfigdir@/@package_name@.systemd file instead - otherwise, -# do not edit this file in /lib/systemd/system - instead, do the following: -# cp /lib/systemd/system/dirsrv\@.service /etc/systemd/system/dirsrv\@.service -# mkdir -p /etc/systemd/system/@systemdgroupname@.wants -# edit /etc/systemd/system/dirsrv\@.service - uncomment the LimitNOFILE=8192 line -# where %i is the name of the instance -# you may already have a symlink in -# /etc/systemd/system/@systemdgroupname@.wants/dirsrv@%i.service pointing to -# /lib/systemd/system/dirsrv\@.service - you will have to change it to link -# to /etc/systemd/system/dirsrv\@.service instead -# ln -s /etc/systemd/system/dirsrv\@.service /etc/systemd/system/@systemdgroupname@.wants/dirsrv@%i.service -# systemctl daemon-reload -# systemctl (re)start @systemdgroupname@ -[Unit] -Description=@capbrand@ Directory Server with @SANITIZER@ %i. -PartOf=@systemdgroupname@ -After=chronyd.service ntpd.service network-online.target syslog.target -Before=radiusd.service - -[Service] -Type=notify -NotifyAccess=all -TimeoutStartSec=0 -TimeoutStopSec=600 -EnvironmentFile=@initconfigdir@/@package_name@ -EnvironmentFile=@initconfigdir@/@package_name@-%i -PIDFile=@localstatedir@/run/@package_name@/slapd-%i.pid -# We can't symbolize here, as llvm symbolize crashes when it goes near systemd. -Environment=ASAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.asan:print_stacktrace=1 -Environment=TSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.tsan:print_stacktrace=1:second_deadlock_stack=1:history_size=7 -Environment=MSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.msan:print_stacktrace=1 -Environment=UBSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.ubsan:print_stacktrace=1 -LimitCORE=infinity -ExecStartPre=@libexecdir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif -ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i @localstatedir@/run/@package_name@/slapd-%i.pid - -#### To change any of these values or directives, you should use a drop in file -# such as: /etc/systemd/system/dirsrv@.d/custom.conf - -# These are from man systemd.exec and man systemd.resource-control - -# This controls the resources to the direct child of systemd, in -# this case ns-slapd. Because we are type notify we recieve these -# limits correctly. - -# This controls the number of file handles avaliable. File handles -# correlate to sockets for the process, and our access to logs and -# databases. -LimitNOFILE=16384 - -# You can limit the memory in the cgroup with these, and ns-slapd -# will account for them in it's autotuning. -# Memory account may be controlled by DefaultMemoryAccounting= in systemd-system.conf -# MemoryAccounting=true -# MemoryLimit=bytes - -# Limits on the size of coredump that may be produced by the process. It's not -# specified how this interacts with coredumpd. -# 0 means not to produce cores. -# This value is 64G -LimitCORE=68719476736 - -# Limit number of processes (threads) we may spawn. We don't advise you change -# this as DS will autodetect your threads / cpus and adjust as needed. -# LimitNPROC= - -# Hardening options: -# PrivateDevices=true -# ProtectSystem=true -# ProtectHome=true -# PrivateTmp=true - - -[Install] -WantedBy=multi-user.target - -- 2.21.0