ferm: suggested systemd unit file

[Sam Morris]

I just ran into this: Ferm was not started at boot. Running 'journalctl
-b' revealed the following:

    Oct 20 13:18:37 traxus systemd[1]: Found ordering cycle on basic.target/start
    Oct 20 13:18:37 traxus systemd[1]: Found dependency on sysinit.target/start
    Oct 20 13:18:37 traxus systemd[1]: Found dependency on ferm.service/start
    Oct 20 13:18:37 traxus systemd[1]: Found dependency on network-online.target/start
    Oct 20 13:18:37 traxus systemd[1]: Found dependency on network.target/start
    Oct 20 13:18:37 traxus systemd[1]: Found dependency on systemd-networkd.service/start
    Oct 20 13:18:37 traxus systemd[1]: Found dependency on dbus.service/start
    Oct 20 13:18:37 traxus systemd[1]: Found dependency on basic.target/start
    Oct 20 13:18:37 traxus systemd[1]: Breaking ordering cycle by deleting job ferm.service/start
    Oct 20 13:18:37 traxus systemd[1]: Job ferm.service/start deleted to break ordering cycle starting with basic.target/start

I am now using the following unit file to start ferm at boot. I use
WantedBy=network.target in the [Install] section because it seems like
a reasonable thing to do, rather than hook into multi-user.target; I
have CCd pkg-systemd-maintainers for a second opinion.

The unit also uses {Wants,Before}=network-pre.target as advised in the
Debian wiki page linked for firewall/network type services in the
original bug report.

    [Unit]
    Description=ferm firewall configuration
    DefaultDependencies=no
    Wants=network-pre.target
    Before=network-pre.target shutdown.target
    Conflicts=shutdown.target

    [Service]
    Type=oneshot
    RemainAfterExit=yes
    ExecStart=/usr/sbin/ferm /etc/ferm/ferm.conf
    ExecReload=/usr/sbin/ferm /etc/ferm/ferm.conf
    ExecStop=/usr/sbin/ferm -F /etc/ferm/ferm.conf

    [Install]
    WantedBy=network.target

I know you'd prefer to keep backwards-compatibility with
CACHE/FAST/OPTIONS in /etc/default/ferm. You could do so by changing
the unit file to match more closely what is output by 'systemctl cat
ferm.service' on a system that booted with systemd but does _not_ have
a ferm.service unit file in place. The values in [Unit] should be taken
from my example, above, however, or the resulting unit file will not
fix this bug.

The biggest problem with that approach is that you would also pick up
the default handling of DISABLED which is annoying and not necessary
under systemd. Your init script would have to be modified to disregard
the setting for DISABLED when it's being launched by systemd. The
proper way to do that in a /bin/sh script is '[ -d /run/systemd/systemd
]' as used in /lib/lsb/init-functions.d/40-systemd and documented in
sd_booted(3).

Or you could just drop DISABLED which is not even necessary under
sysvinit: 'update-rc.d ferm disable' should work just fine for those
that don't want to rename the symlink in /etc/rcS.d themselves.

-- 
Sam Morris <https://robots.org.uk/>
CAAA AA1A CA69 A83A 892B  1855 D20B 4202 5CDA 27B9

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part
URL: <http://lists.alioth.debian.org/pipermail/pkg-systemd-maintainers/attachments/20151020/539fe45c/attachment.sig>