Bug#923921: systemd: Updating systemd breaks Dovecot (and possibly other services)

[Michael Prokop]

* Nico Haase [Thu Mar 07, 2019 at 08:33:57AM +0100]:
> Package: systemd
> Version: 241-1~bpo9+1
> Severity: normal

> Dear Maintainer,

> this morning, apticron reminded me (once more) to upgrade some packages from stretch-backports. These included dovecot-core and systemd (and others). After having installed all of them, Dovecot refused to start.

> The following lines were reported in daemon.log:

> Mar  7 07:35:25 host systemd[1]: Started Dovecot IMAP/POP3 email server.
> Mar  7 07:35:25 host systemd[30913]: dovecot.service: Failed to set up mount namespacing: Permission denied
> Mar  7 07:35:25 host systemd[30913]: dovecot.service: Failed at step NAMESPACE spawning /usr/sbin/dovecot: Permission denied
> Mar  7 07:35:25 host systemd[1]: dovecot.service: Main process exited, code=exited, status=226/NAMESPACE
> Mar  7 07:35:25 host systemd[1]: dovecot.service: Failed with result 'exit-code'.

> I have no clue how to solve this, as there a no canonical sources for that messages. The only obvious thing was to downgrade systemd to 232-25+deb9u9 again, which let me start Dovecot again.

> If there is anything I can do to help you spot the error, please ask. I'm not that experienced with systemd, but I'd be able to run upgrades or other commands that could provide more information.

So you're using a (quite old) Proxmox kernel:

> Kernel: Linux 4.4.134-1-pve (SMP w/12 CPU cores)

Any reason why you don't use a more recent version like 4.15.18-11-pve?

Also the dovecot.service uses:

> -> Unit dovecot.service:
[...]
> 	PrivateTmp: yes
> 	PrivateDevices: yes

[...]

If you're changing those setting(s) to "false" it might also work
for you, while I'd recommend to switch to either an official Debian
kernel or at least a more recent and supported Proxmox kernel.

regards,
-mika-
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-systemd-maintainers/attachments/20190307/244095bb/attachment.sig>