It seems this broke with commit 527b7a42 ("util: rework cunescape(), improve error handling"). As load-fragment.c does not pass the UNESCAPE_RELAX flag to cunescape(), the code now errors out in the attempt of unescaping the quoted perl regexp '\w+@\K[\d.]+', which it didn't before. As this is clearly a regression from an older version of systemd, I guess the best we can do is to restore the old behavior and gracefully handles unescaping errors by copying the characters verbatim that cannot be unescaped.

Lennart, any reason why you omitted this flag for that specific use case?

My proposed fix would be:

diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c
index c95c110..df5fe6f 100644
--- a/src/core/load-fragment.c
+++ b/src/core/load-fragment.c
@@ -610,7 +610,7 @@ int config_parse_exec(
                         else
                                 skip = strneq(word, "\\;", MAX(l, 1U));
 
-                        r = cunescape_length(word + skip, l - skip, 0, &c);
+                        r = cunescape_length(word + skip, l - skip, UNESCAPE_RELAX, &c);
                         if (r < 0) {
                                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to unescape command line, ignoring: %s", rvalue);
                                 r = 0;

Created attachment 116206 [details] [review]
test case patch

This should really get committed with a corresponding test case. This patch adds the gist of the two downstream bug reports.

This is now fixed upstream with 22874a348f. I also added the test case from Martin as separate commit on top.

Even with this patch applied, I still get failures when trying to start sudo.service.

Without the patch, I got:

Mai 30 15:06:24 pluto systemd[1]: [/lib/systemd/system/sudo.service:7] Failed to unescape command line, ignoring: /usr/bin/find /var/lib/sudo -exec /usr/bin/touch -d @0 '{}' \073
Mai 30 15:06:24 pluto systemd[1]: sudo.service: Service lacks both ExecStart= and ExecStop= setting. Refusing.

Now I get:
# systemctl status sudo.service
● sudo.service - Provide limited super user privileges to specific users
   Loaded: loaded (/lib/systemd/system/sudo.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Di 2015-06-02 22:42:28 CEST; 30min ago
  Process: 743 ExecStart=/usr/bin/find /var/lib/sudo -exec /usr/bin/touch -d @0 {} \073 (code=exited, status=1/FAILURE)
 Main PID: 743 (code=exited, status=1/FAILURE)

Jun 02 22:42:28 pluto systemd[1]: Starting Provide limited super user privileges to specific users...
Jun 02 22:42:28 pluto systemd[1]: sudo.service: Main process exited, code=exited, status=1/FAILURE
Jun 02 22:42:28 pluto systemd[1]: Failed to start Provide limited super user privileges to specific users.
Jun 02 22:42:28 pluto systemd[1]: sudo.service: Unit entered failed state.
Jun 02 22:42:28 pluto systemd[1]: sudo.service: Failed with result 'exit-code'.
Jun 02 22:42:28 pluto find[743]: /usr/bin/find: Fehlendes Argument für "-exec".

So it still behaves differently then in v215.
This is the comment from sudo.service

# \073 is ';' which needs to be part of the find parameters
ExecStart=/usr/bin/find /var/lib/sudo -exec /usr/bin/touch -d @0 '{}' \073


Looks like systemd v215 did turn \073 into \; ?

Could you try this patch?

  https://github.com/zonque/systemd/commit/19c9c4173.patch

I opened a pull request here:

  https://github.com/systemd/systemd/pull/51


Thanks for reporting this!

Works fine now, thanks!