Bug 57773 - systemd needs a sockets-pre.target
systemd needs a sockets-pre.target
Status: RESOLVED FIXED
Product: systemd
Classification: Unclassified
Component: general
unspecified
Other Linux (All)
: medium normal
Assigned To: systemd-bugs
systemd-bugs
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-12-01 13:54 UTC by John
Modified: 2013-02-14 16:40 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments
proposed ufw.service (351 bytes, text/plain)
2013-01-22 19:30 UTC, John
Details

Note You need to log in before you can comment on or make changes to this bug.
Description John 2012-12-01 13:54:44 UTC
A firewall.target that generically defines the myriad firewalls one can run on Linux is a needed addition to systemd.  Currently, there is no good way to have a service start AFTER the firewall.

For example, pgl-cli (http://sourceforge.net/projects/peerguardian) needs to start after the firewall is up.  A proper pgl-cli.service would look like this:

[Unit]
Description=PeerGuardian Linux - an IP Blocker
Requires=firewall.target
After=network.target firewall.target

[Service]
BusName=org.netfilter.pgl
ExecStart=/usr/bin/pglcmd start
ExecStop=/usr/bin/pglcmd stop
PIDFile=/run/pgld.pid

[Install]
WantedBy=multi-user.target
Comment 1 Lennart Poettering 2013-01-15 00:49:17 UTC
Hmm, the firewall actually needs to be initialized before we set up the various .socket units, so that there is no time window where the socket is bound but the firewall not yet up. Currently there is no nice way to order a service before all sockets are up. I have now added to the TODO list that we should introduce "sockets-pre.target" which would be sorted before all socket units, and before which the fw would then have to sort itself.

That also means that any firewall setup needs to happen as part of early boot.

sockets-pre.target would be ordered before basic.target, normal services are ordered after basic.target. That means all normal services would then be run with firewall up. sockets-pre.target would hence be a more generic firewall.target the way you requested it.
Comment 2 Lennart Poettering 2013-01-15 01:34:22 UTC
Actually thinking about, "sysinit.target" which is run before all sockets already does the job of a "sockets-pre.target" just fine, so don't really need the latter.

hence: please make your fw services an early-boot service, and order it before sysinit.target, and you can be sure that it will be up before any system sockets or bound or any normal services are run.
Comment 3 John 2013-01-20 15:14:55 UTC
(In reply to comment #2)
> Actually thinking about, "sysinit.target" which is run before all sockets
> already does the job of a "sockets-pre.target" just fine, so don't really
> need the latter.
> 
> hence: please make your fw services an early-boot service, and order it
> before sysinit.target, and you can be sure that it will be up before any
> system sockets or bound or any normal services are run.

Thanks for the suggestion.  Just to be sure I have it correct, is this the correct syntax for /usr/lib/systemd/system/ufw.service?

[Unit]
Description=CLI Netfilter Manager

[Service]
Type=oneshot
ExecStart=/usr/lib/ufw/ufw-init start
ExecStop=/usr/lib/ufw/ufw-init stop
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
Before=sysinit.target
Comment 4 Pierre Buard 2013-01-20 16:41:37 UTC
Before= is a [Unit] section setting. See 'man systemd.unit' for more information.
Comment 5 John 2013-01-20 17:33:19 UTC
Thank you for the reference to the manpage.
Comment 6 John 2013-01-22 15:21:41 UTC
Actually, this does NOT work. Here is a clean startup:

% status ufw
ufw.service - CLI Netfilter Manager
Loaded: loaded (/usr/lib/systemd/system/ufw.service; enabled)
Active: inactive (dead)

Jan 22 09:14:18 reborn ufw-init[183]: WARNING: The state match is obsolete. Use conntrack instead.
Jan 22 09:14:18 reborn ufw-init[183]: WARNING: The state match is obsolete. Use conntrack instead.
Jan 22 09:14:19 reborn ufw-init[183]: WARNING: The state match is obsolete. Use conntrack instead.
Jan 22 09:14:19 reborn systemd[1]: Started CLI Netfilter Manager.
Jan 22 10:08:33 reborn systemd[1]: Stopping CLI Netfilter Manager...
Jan 22 10:08:33 reborn systemd[1]: Stopped CLI Netfilter Manager.
Jan 22 10:12:09 reborn systemd[1]: Stopped CLI Netfilter Manager.
Jan 22 10:12:15 reborn systemd[1]: Starting CLI Netfilter Manager...
Jan 22 10:12:16 reborn systemd[1]: Started CLI Netfilter Manager.
Jan 22 10:14:28 reborn systemd[1]: Job ufw.service/stop deleted to break ordering cycle starting with sysinit.target/stop
Comment 7 John 2013-01-22 19:30:39 UTC
Created attachment 73472 [details]
proposed ufw.service
Comment 8 Lennart Poettering 2013-01-23 01:15:07 UTC
DefaultDependencies=no is essential for early-boot services. (Which the attached file already uses correctly). In that file you do want to use "Conflicts=shutdown.target" and "Before=shutdown.target" btw, so that the thing gets shutdown at boot.  

The attached units looks pretty good otherwise.
Comment 9 Lennart Poettering 2013-01-23 01:15:51 UTC
Is it the attached unit file that doesn't work btw? Or is everything solved now? It's a bit unclear here...
Comment 10 Pierre Buard 2013-02-14 16:40:54 UTC
The attachment of comment #7 works wonderfully. Prior to that, the service was failing due the missing "DefaultDependencies=no" entry required when using "Before=sysinit.target".

I didn't find the absence of shutdown.target detrimental so far, but I'll add them just to be safe and submit the complete service file to the ufw project.

Thank you for the valuable input.