Bug#802018: systemd: _SYSTEMCTL_SKIP_REDIRECT=true is leaked to daemon

[Sebastian Schmidt]

Package: systemd
Version: 226-4
Severity: normal
Tags: 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi,

/lib/lsb/init-functions.d/40-systemd exports
_SYSTEMCTL_SKIP_REDIRECT=true to detect when it has been called
recursively again by systemd. This export is actually never cleaned up and
is passed to the daemon. In the case of Puppet, which uses “/etc/init.d
$service $action” (without cleaning up the environment - which is
probably an issue by itself) to query and change a daemon’s status, this
causes the init.d hook to not redirect the call to systemd. For services
that supply an actual systemd unit which does not simply call the init
script (e.g. clamav-freshclam) this can cause the action to fail.

A trivial fix would be:
>   --- a/debian/extra/init-functions.d/40-systemd
>   +++ b/debian/extra/init-functions.d/40-systemd
>   @@ -25,6 +25,8 @@ if [ -d /run/systemd/system ]; then
>                    fi
>                    ;;
>            esac
>   +    elif [ -z "${_SYSTEMCTL_SKIP_REDIRECT:-}" ]; then
>   +        unset _SYSTEMCTL_SKIP_REDIRECT
>        else
>            export _SYSTEMCTL_SKIP_REDIRECT="true"
>        fi

But this doesn’t fix the case when systemd is not calling the init
script twice (because the service has an actual unit). Since the
approach to guard the recursion with an environment variable relies on
systemd not cleaning up the environment I’m not sure how to best fix
this.

Sebastian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBViFm/Phx3EthBlqjAQgIQhAAowyPvUlhWh1wyDGotGFXOQGyHwFx5ov4
afMErBsvfnySQlG56vXZNzhVEqg+Ta7jL+oxlVemZ2PIGowxnp4blV4D5k3VZy63
8bBnwmfnNTVYPG3c3b5tXEADerLz5vZ6qVv/V5OM1KQcVS4hhlxVLFDkZTv9sh3T
Lu/0v7sL1M/t2EdN0GRHYex6Pp7hwZajG8ZmHIUfrgj2yvkAxv6ObRTKLHy1Cjzq
Pc8gKbDtFctoYz6Z4BjfuwTZ8yGVuE85j7lAENCFDczB6w7T3GFiAyWzgg/lGk2a
atA0sZ541nmll4dnZZCoPPn2YVtteWeLKneXtT6q8gyEaIuBHr860EXxh5V1RjFr
gAJIx0fJnk/Y6bT4aYrhEHI3o88EZ+D8pdNyzLvGZt5aeWI0rotakpnBbfXHuPae
Q5IHFiuWx4gV3QP7RBk5+OXQXPhXjs/ntDTrlioIzkAFHBO3f9l75LdimcJUJwIl
dwmhiKYQsah0EfTY2T+gmWclgGsxouUG6cACbx9xc97EkhIy1wxFR1O3/lvnH89F
a5IQp0AMS+1JgjloBXxPFI513Xi3H0w+4H4oC+4ET4vKMqMeS4x8RC3EKaxTe1ep
mOuvQYgCEOVHZuTrGytApHNOnlKhu7ZRAeoxtrDcub2EgJNcVu/0h2DjvgfLwW+W
iGjTUHU3l6w=
=EsOG
-----END PGP SIGNATURE-----