Bug#923921: systemd: Updating systemd breaks Dovecot (and possibly other services)

[Nico Haase]

Dear Mika, dear Michael,

thank you for your answers and apologies for answering them so late.

Am 07.03.2019 um 09:15 schrieb Michael Prokop:
> * Nico Haase [Thu Mar 07, 2019 at 08:33:57AM +0100]:
>> Package: systemd
>> Version: 241-1~bpo9+1
>> Severity: normal
> 
>> Dear Maintainer,
> 
>> this morning, apticron reminded me (once more) to upgrade some packages from stretch-backports. These included dovecot-core and systemd (and others). After having installed all of them, Dovecot refused to start.
> 
>> The following lines were reported in daemon.log:
> 
>> Mar  7 07:35:25 host systemd[1]: Started Dovecot IMAP/POP3 email server.
>> Mar  7 07:35:25 host systemd[30913]: dovecot.service: Failed to set up mount namespacing: Permission denied
>> Mar  7 07:35:25 host systemd[30913]: dovecot.service: Failed at step NAMESPACE spawning /usr/sbin/dovecot: Permission denied
>> Mar  7 07:35:25 host systemd[1]: dovecot.service: Main process exited, code=exited, status=226/NAMESPACE
>> Mar  7 07:35:25 host systemd[1]: dovecot.service: Failed with result 'exit-code'.
> 
>> I have no clue how to solve this, as there a no canonical sources for that messages. The only obvious thing was to downgrade systemd to 232-25+deb9u9 again, which let me start Dovecot again.
> 
>> If there is anything I can do to help you spot the error, please ask. I'm not that experienced with systemd, but I'd be able to run upgrades or other commands that could provide more information.
> 
> So you're using a (quite old) Proxmox kernel:
> 
>> Kernel: Linux 4.4.134-1-pve (SMP w/12 CPU cores)
> 
> Any reason why you don't use a more recent version like 4.15.18-11-pve?

Yep, you've found the one thing I cannot change: my system is running 
virtualized, and my provider is currently not able to upgrade the kernel.

Even if I know that such checks can get pretty expansive, would it be 
possible to introduce a clear warning if such incompatibilities arise? 
If you know exactly that there might be a feature missing from a more 
current kernel, could you give a clear hint or even reject upgrading the 
package?

Regards
Nico