Merge pull request #30220 from yuwata/journald-vs-soft-reboot

unit: stop journald before SIGKILL on soft-reboot

man/systemd-soft-reboot.service.xml

@@ -30,8 +30,8 @@
     <para><filename>systemd-soft-reboot.service</filename> is a system service that is pulled in by
     <filename>soft-reboot.target</filename> and is responsible for performing a userspace-only reboot
     operation. When invoked, it will send the <constant>SIGTERM</constant> signal to any processes left
-    running (but does not follow up with <constant>SIGKILL</constant>, and does not wait for the processes to
-    exit). If the <filename>/run/nextroot/</filename> directory exists (which may be a regular directory, a
+    running (but does not wait for the processes to exit), and follow up with <constant>SIGKILL</constant>.
+    If the <filename>/run/nextroot/</filename> directory exists (which may be a regular directory, a
     directory mount point or a symlink to either) then it will switch the file system root to it. It then
     reexecutes the service manager off the (possibly now new) root file system, which will enqueue a new boot
     transaction as in a normal reboot.</para>

src/varlinkctl/varlinkctl.c

@@ -376,6 +376,7 @@ static int verb_call(int argc, char *argv[], void *userdata) {
         arg_json_format_flags &= ~JSON_FORMAT_OFF;
 
         if (parameter) {
+                /* <argv[4]> is correct, as dispatch_verb() shifts arguments by one for the verb. */
                 r = json_parse_with_source(parameter, "<argv[4]>", 0, &jp, &line, &column);
                 if (r < 0)
                         return log_error_errno(r, "Failed to parse parameters at <argv[4]>:%u:%u: %m", line, column);

test/units/testsuite-82.sh

@@ -3,6 +3,9 @@
 set -ex
 set -o pipefail
 
+# shellcheck source=test/units/util.sh
+. "$(dirname "$0")"/util.sh
+
 at_exit() {
     # Since the soft-reboot drops the enqueued end.service, we won't shutdown
     # the test VM if the test fails and have to wait for the watchdog to kill
@@ -39,6 +42,10 @@ if [ -f /run/testsuite82.touch3 ]; then
     test "$(systemctl show -P ActiveState testsuite-82-nosurvive-sigterm.service)" != "active"
     test "$(systemctl show -P ActiveState testsuite-82-nosurvive.service)" != "active"
 
+    # Check journals
+    journalctl -o short-monotonic --no-hostname --grep '(will soft-reboot|KILL|corrupt)'
+    assert_eq "$(journalctl -q -o short-monotonic -u systemd-journald.service --grep 'corrupt')" ""
+
     # All succeeded, exit cleanly now
 
 elif [ -f /run/testsuite82.touch2 ]; then

units/systemd-journald.service.in

@@ -15,6 +15,11 @@ Requires=systemd-journald.socket
 After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket syslog.socket
 Before=sysinit.target
 
+# To avoid journald SIGKILLed during soft-reboot and corrupting journals.
+# See https://github.com/systemd/systemd/issues/30195
+Before=soft-reboot.target
+Conflicts=soft-reboot.target
+
 # Mount and swap units need the journal socket units. If they were removed by
 # an isolate request the mount and swap units would be removed too, hence let's
 # exclude systemd-journald and its sockets from isolate requests.

units/systemd-journald@.service.in

@@ -13,6 +13,11 @@ Documentation=man:systemd-journald.service(8) man:journald.conf(5)
 Requires=systemd-journald@%i.socket systemd-journald-varlink@%i.socket
 After=systemd-journald@%i.socket systemd-journald-varlink@%i.socket
 
+# To avoid journald SIGKILLed during soft-reboot and corrupting journals.
+# See https://github.com/systemd/systemd/issues/30195
+Before=soft-reboot.target
+Conflicts=soft-reboot.target
+
 [Service]
 CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE
 DevicePolicy=closed