Blob Blame Raw
From 5b36c591ef0e79ee1fd4a0db4644d9d0e8d183ca Mon Sep 17 00:00:00 2001
From: Matus Honek <mhonek@redhat.com>
Date: Mon, 27 May 2019 10:59:03 +0000
Subject: [PATCH] Issue 49875 - Move SystemD service config to a drop-in file

Bug Description:
Runtime configuration options are mixed into the service specification
which should seldom be changed by users.

Fix Description:
Move the runtime configuration options into a drop-in file. These options
are then automatically pulled in by SystemD.

Additional Info:
Erasing the default values of the mentioned options to implicitly pull in
system defaults which are more sane nowadays.

The .service file is now common for xsan and non-xsan builds, the former
differring only by an additional drop-in file.

Related https://pagure.io/389-ds-base/issue/49875

Author: Matus Honek <mhonek@redhat.com>

Review by: firstyear, mreynolds, vashirov (thanks!)
---
 Makefile.am                                   | 23 ++++--
 configure.ac                                  |  2 +
 .../systemd.template.service.custom.conf.in   | 52 +++++++++++++
 wrappers/systemd.template.service.in          | 57 +-------------
 .../systemd.template.service.xsan.conf.in     | 11 +++
 wrappers/systemd.template.xsan.service.in     | 77 -------------------
 6 files changed, 85 insertions(+), 137 deletions(-)
 create mode 100644 wrappers/systemd.template.service.custom.conf.in
 create mode 100644 wrappers/systemd.template.service.xsan.conf.in
 delete mode 100644 wrappers/systemd.template.xsan.service.in

diff --git a/Makefile.am b/Makefile.am
index 01ac3a04d..de9e0c460 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -300,6 +300,7 @@ serverdir = $(libdir)/@serverdir@
 serverplugindir = $(libdir)@serverplugindir@
 taskdir = $(datadir)@scripttemplatedir@
 systemdsystemunitdir = @with_systemdsystemunitdir@
+systemdsystemunitdropindir = @with_systemdsystemunitdir@/$(PACKAGE_NAME)@.service.d
 systemdsystemconfdir = @with_systemdsystemconfdir@
 systemdgroupname = @with_systemdgroupname@
 initdir = @initdir@
@@ -880,6 +881,11 @@ if SYSTEMD
 systemdsystemunit_DATA = wrappers/$(PACKAGE_NAME)@.service \
 	wrappers/$(systemdgroupname) \
 	wrappers/$(PACKAGE_NAME)-snmp.service
+
+systemdsystemunitdropin_DATA = wrappers/$(PACKAGE_NAME)@.service.d/custom.conf
+if with_sanitizer
+systemdsystemunitdropin_DATA += wrappers/$(PACKAGE_NAME)@.service.d/xsan.conf
+endif
 else
 if INITDDIR
 init_SCRIPTS = wrappers/$(PACKAGE_NAME) \
@@ -2314,12 +2320,17 @@ endif
 # yes, that is an @ in the filename . . .
 %/$(PACKAGE_NAME)@.service: %/systemd.template.service.in
 	if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi
-	if [ ! -z ${SANITIZER} ] ; then \
-		service_template=$(shell echo $^ | sed 's/template/template.xsan/g'); \
-		else \
-		service_template=$^; \
-	fi; \
-	$(fixupcmd) $$service_template > $@
+	$(fixupcmd) $^ > $@
+
+%/$(PACKAGE_NAME)@.service.d/custom.conf: %/systemd.template.service.custom.conf.in
+	if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi
+	$(fixupcmd) $^ > $@
+
+if with_sanitizer
+%/$(PACKAGE_NAME)@.service.d/xsan.conf: %/systemd.template.service.xsan.conf.in
+	if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi
+	$(fixupcmd) $^ > $@
+endif
 
 %/$(systemdgroupname): %/systemd.group.in
 	if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi
diff --git a/configure.ac b/configure.ac
index 3660e6816..d329e84a9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -196,6 +196,8 @@ AC_SUBST([ubsan_cflags])
 AC_SUBST([ubsan_rust_defs])
 AM_CONDITIONAL(enable_ubsan,test "$enable_ubsan" = "yes")
 
+AM_CONDITIONAL(with_sanitizer,test "$enable_asan" = "yes" -o "$enable_msan" = "yes" -o "$enable_tsan" = "yes" -o "$enable_ubsan" = "yes")
+
 # Enable CLANG
 AC_MSG_CHECKING(for --enable-clang)
 AC_ARG_ENABLE(clang, AS_HELP_STRING([--enable-clang], [Enable clang (default: no)]),
diff --git a/wrappers/systemd.template.service.custom.conf.in b/wrappers/systemd.template.service.custom.conf.in
new file mode 100644
index 000000000..0dce62826
--- /dev/null
+++ b/wrappers/systemd.template.service.custom.conf.in
@@ -0,0 +1,52 @@
+# To change any of the below values, please use a drop-in file in which
+# you can declare overrides according to systemd.unit(5), either of:
+# - applying to all instances:
+#   /etc/systemd/system/dirsrv@.service.d/custom.conf
+# - applying to a single instance (overriding the above):
+#   /etc/systemd/system/dirsrv@<instance>.service.d/custom.conf
+#
+# Some of the most interesting coniguration options are mentioned below.
+# See systemd.service(5) and systemd.exec(5) for the respective documentation.
+#
+# After updating the service configuration, do not forget to apply the changes:
+# - reload systemd configuration: systemctl daemon-reload
+# - restart the service: systemctl restart @package_name@@<instance>.service
+
+[Service]
+TimeoutStartSec=0
+TimeoutStopSec=600
+
+# These are from man systemd.exec and man systemd.resource-control
+
+# This controls the resources to the direct child of systemd, in
+# this case ns-slapd. Because we are type notify we recieve these
+# limits correctly.
+
+# This controls the number of file handles avaliable. File handles
+# correlate to sockets for the process, and our access to logs and
+# databases.  Note, the configuration setting in Directory Server,
+# "nsslapd-maxdescriptors", can override this limit.
+#LimitNOFILE=
+
+# You can limit the memory in the cgroup with these, and ns-slapd
+# will account for them in it's autotuning.
+# Memory account may be controlled by DefaultMemoryAccounting= in systemd-system.conf
+#MemoryAccounting=yes
+#MemoryLimit=<bytes>
+
+# Limits on the size of coredump that may be produced by the process. It's not
+# specified how this interacts with coredumpd.
+# 0 means not to produce cores.
+#LimitCORE=<bytes>
+
+# Limit number of processes (threads) we may spawn. We don't advise you change
+# this as DS will autodetect your threads / cpus and adjust as needed.
+#LimitNPROC=
+
+# Possible hardening options:
+#PrivateDevices=yes
+#ProtectSystem=yes
+#ProtectHome=yes
+#PrivateTmp=yes
+
+
diff --git a/wrappers/systemd.template.service.in b/wrappers/systemd.template.service.in
index 7142c3492..2ac6f978f 100644
--- a/wrappers/systemd.template.service.in
+++ b/wrappers/systemd.template.service.in
@@ -1,17 +1,6 @@
-# you usually do not want to edit this file - instead, edit the
-# @initconfigdir@/@package_name@.systemd file instead - otherwise,
-# do not edit this file in /lib/systemd/system - instead, do the following:
-# cp /lib/systemd/system/dirsrv\@.service /etc/systemd/system/dirsrv\@.service
-# mkdir -p /etc/systemd/system/@systemdgroupname@.wants
-# edit /etc/systemd/system/dirsrv\@.service - uncomment the LimitNOFILE=8192 line
-# where %i is the name of the instance
-# you may already have a symlink in
-# /etc/systemd/system/@systemdgroupname@.wants/dirsrv@%i.service pointing to
-# /lib/systemd/system/dirsrv\@.service - you will have to change it to link
-# to /etc/systemd/system/dirsrv\@.service instead
-# ln -s /etc/systemd/system/dirsrv\@.service /etc/systemd/system/@systemdgroupname@.wants/dirsrv@%i.service
-# systemctl daemon-reload 
-# systemctl (re)start @systemdgroupname@
+# You should not need to edit this file. Instead, use a drop-in file as described in:
+#   /usr/lib/systemd/system/@package_name@@.service.d/custom.conf
+
 [Unit]
 Description=@capbrand@ Directory Server %i.
 PartOf=@systemdgroupname@
@@ -21,51 +10,11 @@ Before=radiusd.service
 [Service]
 Type=notify
 NotifyAccess=all
-TimeoutStartSec=0
-TimeoutStopSec=600
 EnvironmentFile=-@initconfigdir@/@package_name@
 EnvironmentFile=-@initconfigdir@/@package_name@-%i
 PIDFile=@localstatedir@/run/@package_name@/slapd-%i.pid
 ExecStartPre=@libexecdir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif
 ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i @localstatedir@/run/@package_name@/slapd-%i.pid
 
-#### To change any of these values or directives, you should use a drop in file
-# such as: /etc/systemd/system/dirsrv@<instance>.d/custom.conf
-
-# These are from man systemd.exec and man systemd.resource-control
-
-# This controls the resources to the direct child of systemd, in
-# this case ns-slapd. Because we are type notify we recieve these
-# limits correctly.
-
-# This controls the number of file handles avaliable. File handles
-# correlate to sockets for the process, and our access to logs and
-# databases.  Note, the configuration setting in Directory Server,
-# "nsslapd-maxdescriptors", can override this limit.
-LimitNOFILE=16384
-
-# You can limit the memory in the cgroup with these, and ns-slapd
-# will account for them in it's autotuning.
-# Memory account may be controlled by DefaultMemoryAccounting= in systemd-system.conf
-# MemoryAccounting=true
-# MemoryLimit=bytes
-
-# Limits on the size of coredump that may be produced by the process. It's not
-# specified how this interacts with coredumpd.
-# 0 means not to produce cores.
-# This value is 64G
-LimitCORE=68719476736
-
-# Limit number of processes (threads) we may spawn. We don't advise you change
-# this as DS will autodetect your threads / cpus and adjust as needed.
-# LimitNPROC=
-
-# Hardening options:
-# PrivateDevices=true
-# ProtectSystem=true
-# ProtectHome=true
-# PrivateTmp=true
-
 [Install]
 WantedBy=multi-user.target
-
diff --git a/wrappers/systemd.template.service.xsan.conf.in b/wrappers/systemd.template.service.xsan.conf.in
new file mode 100644
index 000000000..f4bf809b9
--- /dev/null
+++ b/wrappers/systemd.template.service.xsan.conf.in
@@ -0,0 +1,11 @@
+# This file is present because the server has been built with a sanitizer.
+# It is not meant for a production usage.
+[Unit]
+Description=@capbrand@ Directory Server with @SANITIZER@ %i.
+
+[Service]
+# We can't symbolize here, as llvm symbolize crashes when it goes near systemd.
+Environment=ASAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.asan:print_stacktrace=1
+Environment=TSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.tsan:print_stacktrace=1:second_deadlock_stack=1:history_size=7
+Environment=MSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.msan:print_stacktrace=1
+Environment=UBSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.ubsan:print_stacktrace=1
diff --git a/wrappers/systemd.template.xsan.service.in b/wrappers/systemd.template.xsan.service.in
deleted file mode 100644
index 541392ff8..000000000
--- a/wrappers/systemd.template.xsan.service.in
+++ /dev/null
@@ -1,77 +0,0 @@
-# you usually do not want to edit this file - instead, edit the
-# @initconfigdir@/@package_name@.systemd file instead - otherwise,
-# do not edit this file in /lib/systemd/system - instead, do the following:
-# cp /lib/systemd/system/dirsrv\@.service /etc/systemd/system/dirsrv\@.service
-# mkdir -p /etc/systemd/system/@systemdgroupname@.wants
-# edit /etc/systemd/system/dirsrv\@.service - uncomment the LimitNOFILE=8192 line
-# where %i is the name of the instance
-# you may already have a symlink in
-# /etc/systemd/system/@systemdgroupname@.wants/dirsrv@%i.service pointing to
-# /lib/systemd/system/dirsrv\@.service - you will have to change it to link
-# to /etc/systemd/system/dirsrv\@.service instead
-# ln -s /etc/systemd/system/dirsrv\@.service /etc/systemd/system/@systemdgroupname@.wants/dirsrv@%i.service
-# systemctl daemon-reload 
-# systemctl (re)start @systemdgroupname@
-[Unit]
-Description=@capbrand@ Directory Server with @SANITIZER@ %i.
-PartOf=@systemdgroupname@
-After=chronyd.service ntpd.service network-online.target syslog.target
-Before=radiusd.service
-
-[Service]
-Type=notify
-NotifyAccess=all
-TimeoutStartSec=0
-TimeoutStopSec=600
-EnvironmentFile=@initconfigdir@/@package_name@
-EnvironmentFile=@initconfigdir@/@package_name@-%i
-PIDFile=@localstatedir@/run/@package_name@/slapd-%i.pid
-# We can't symbolize here, as llvm symbolize crashes when it goes near systemd.
-Environment=ASAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.asan:print_stacktrace=1
-Environment=TSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.tsan:print_stacktrace=1:second_deadlock_stack=1:history_size=7
-Environment=MSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.msan:print_stacktrace=1
-Environment=UBSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.ubsan:print_stacktrace=1
-LimitCORE=infinity
-ExecStartPre=@libexecdir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif
-ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i @localstatedir@/run/@package_name@/slapd-%i.pid
-
-#### To change any of these values or directives, you should use a drop in file
-# such as: /etc/systemd/system/dirsrv@<instance>.d/custom.conf
-
-# These are from man systemd.exec and man systemd.resource-control
-
-# This controls the resources to the direct child of systemd, in
-# this case ns-slapd. Because we are type notify we recieve these
-# limits correctly.
-
-# This controls the number of file handles avaliable. File handles
-# correlate to sockets for the process, and our access to logs and
-# databases.
-LimitNOFILE=16384
-
-# You can limit the memory in the cgroup with these, and ns-slapd
-# will account for them in it's autotuning.
-# Memory account may be controlled by DefaultMemoryAccounting= in systemd-system.conf
-# MemoryAccounting=true
-# MemoryLimit=bytes
-
-# Limits on the size of coredump that may be produced by the process. It's not
-# specified how this interacts with coredumpd.
-# 0 means not to produce cores.
-# This value is 64G
-LimitCORE=68719476736
-
-# Limit number of processes (threads) we may spawn. We don't advise you change
-# this as DS will autodetect your threads / cpus and adjust as needed.
-# LimitNPROC=
-
-# Hardening options:
-# PrivateDevices=true
-# ProtectSystem=true
-# ProtectHome=true
-# PrivateTmp=true
-
-
-[Install]
-WantedBy=multi-user.target
-
-- 
2.21.0