Enabling these options when not running as root requires a user
namespace, so implicitly enable PrivateUsers=.
This has a side effect as it changes which users are visible to the unit.
However until now these options did not work at all for user units, and
in practice just a handful of user units in Fedora, Debian and Ubuntu
mistakenly used them (and they have been all fixed since).
This fixes the long-standing confusing issue that the user and system
units take the same options but the behaviour is wildly (and sometimes
silently) different depending on which is which, with user units
requiring manually specifiying PrivateUsers= in order for sandboxing
options to actually work and not be silently ignored.
Confexts should not contain code, so mount confexts with noexec.
We cannot mount invidial extensions as noexec, as the overlay ignores
it and bypasses it, we need to use the flag on the whole overlay for
it to be effective.
But given there are legacy scripts still shipped in /etc, allow to
override it with --noexec=false.
When a unit is upheld and fails, and there are no state changes in
the upholder, it will not be retried, which is against what the
documentation suggests.
Requeue when the job finishes. Same for the other two queues.
My original assumption in 61961e693d was wrong, since we do reset
/dev/console during reexec (see make_console_stdio()), so the test was
quite racy. Let's replace it with something, hopefully, more reliable.
Follow-up to 61961e693d.
Without enabling itx, there's no symlink to the org.freedesktop.resolve1
dbus service, so there exists a tiny window in which the sequence of
`systemctl start` and `systemctl service-log-level` commands might fail:
[ 1127.615151] H systemd[1]: Started Network Name Resolution.
[ 1127.617768] H testsuite-75.sh[34]: + systemctl service-log-level systemd-resolved.service debug
[ 1127.621251] H dbus-daemon[54]: [system] Activating via systemd: service name='org.freedesktop.resolve1' unit='dbus-org.freedesktop.resolve1.service' requested by ':1.24' (uid=0 pid=119 comm="systemctl service-log-level systemd-resolved>
[ 1127.621336] H systemd[1]: dbus-org.freedesktop.resolve1.service: Failed to load configuration: No such file or directory
[ 1127.621364] H systemd[1]: dbus-org.freedesktop.resolve1.service: Trying to enqueue job dbus-org.freedesktop.resolve1.service/start/replace
[ 1127.621395] H systemd[1]: D-Bus activation failed for dbus-org.freedesktop.resolve1.service: Unit dbus-org.freedesktop.resolve1.service not found.
[ 1127.621965] H dbus-daemon[54]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.resolve1.service': Unit dbus-org.freedesktop.resolve1.service not found.
[ 1127.622046] H systemd[1]: systemd-resolved.service: D-Bus name org.freedesktop.resolve1 now owned by :1.25
[ 1127.622130] H systemctl[119]: Failed to set log level of org.freedesktop.resolve1 to debug: Unit dbus-org.freedesktop.resolve1.service not found.
Spotted in a couple of recent Ubuntu CI runs.
Luca Boccassi
Frantisek Sumsal
Yu Watanabe
Nick Rosbrook
OMOJOLA JOSHUA DAMILOLA
Lennart Poettering
David Tardon
Zbigniew Jędrzejewski-Szmek
maanyagoenka
Franck Bui
Dmitry V. Levin