External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-11-10 07:20:02 +00:00
Code Issues Packages Projects Releases Wiki Activity
087a619877
libvirt/src/virtd.service.in

28 lines
634 B
SYSTEMD
Raw Normal View History

systemd: Introduce common templates We already use templating to generate sockets, which are all based off libvirtd's. Push the idea further, and extend it to cover services as well. This is more challenging, as the various modular daemons each have their own needs in terms of what system services needs to be available before they can be started, which other components of libvirt they depend on, and so on. In order to make this sort of per-service tweaks possible, we introduce a Python script that can merge two systemd units together. The script is aware of the semantics of systemd's unit definition format, so it can intelligently merge sections together. This generic systemd unit merging mechanism will also supersede the extremely ad-hoc @deps@ variable, which is currently used in a single scenario. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2023-09-19 17:28:55 +00:00
[Unit]
Description=@name@ daemon
systemd: Replace Requires with BindTo+After for main socket This is the strongest relationship that can be declared between two units, and causes the service to be terminated immediately if its main socket disappears. This is the behavior we want. Note that we don't do the same for the read-only/admin sockets, because those are not as critical for the core functionality of services as the main socket it. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2023-09-25 15:09:37 +00:00
BindsTo=@service@.socket
systemd: Downgrade read-only/admin sockets to Wants Only the main socket is actually necessary for the service to be usable. In the past, we've had security issues that could be exploited via access to the read-only socket, so a security-minded administrator might consider disabling all optional sockets. This change makes such a setup possible. Note that the services will still try to activate all their sockets on startup, even if they have been disabled. To make sure that the optional sockets are never started, they will have to be masked. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2023-09-27 13:44:34 +00:00
Wants=@service@-ro.socket
Wants=@service@-admin.socket
systemd: Replace Requires with BindTo+After for main socket This is the strongest relationship that can be declared between two units, and causes the service to be terminated immediately if its main socket disappears. This is the behavior we want. Note that we don't do the same for the read-only/admin sockets, because those are not as critical for the core functionality of services as the main socket it. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2023-09-25 15:09:37 +00:00
After=@service@.socket
systemd: Make modular daemons conflict with libvirtd We want to make sure that, at any given time, we have either the modular daemons or the monolithic one running, never both. In order to achieve that, make every single modular unit conflict with the corresponding libvirtd unit. We set both Conflicts=libvirtd.unit and After=libvirtd.unit: this tells systemd that, whenever virtfood.unit and libvirtd.unit are part of the same transaction, the former should win out. Thanks to this, if both the modular daemons and the monolithic one have been enabled because of outdated automation or a simple mistake of the administrator, the request to start libvirtd at boot will be ignored and the result will be a regular modular deployment. If the request to start libvirtd is made when the modular daemons are already running, we have no way to prevent systemd from complying with that request; however, thanks to the way the conflict relationship has been declared, they will be shut down cleanly before libvirtd is started. From the user's point of view, the transition from modular to monolithic will be completely transparent: it's basically the same scenario as a regular package upgrade, just with an extra twist. Note that, while switching from modular to monolithic at runtime happens automatically, going back requires manual intervention, i.e. starting all the necessary sockets one by one. That's okay: the goal here is to prevent misconfiguration and force of habit to accidentally disrupt a working setup, not to encourage the scenario. In a correctly configured and managed host, it should never occur. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2023-09-25 15:24:10 +00:00
Conflicts=libvirtd.service
After=libvirtd.service
systemd: Introduce common templates We already use templating to generate sockets, which are all based off libvirtd's. Push the idea further, and extend it to cover services as well. This is more challenging, as the various modular daemons each have their own needs in terms of what system services needs to be available before they can be started, which other components of libvirt they depend on, and so on. In order to make this sort of per-service tweaks possible, we introduce a Python script that can merge two systemd units together. The script is aware of the semantics of systemd's unit definition format, so it can intelligently merge sections together. This generic systemd unit merging mechanism will also supersede the extremely ad-hoc @deps@ variable, which is currently used in a single scenario. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2023-09-19 17:28:55 +00:00
After=network.target
After=dbus.service
After=apparmor.service
Documentation=man:@service@(8)
Documentation=https://libvirt.org
[Service]
Type=notify
Environment=@SERVICE@_ARGS="--timeout 120"
EnvironmentFile=-@initconfdir@/@service@
ExecStart=@sbindir@/@service@ $@SERVICE@_ARGS
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
[Install]
WantedBy=multi-user.target
Also=@service@.socket
Also=@service@-ro.socket
Also=@service@-admin.socket
Reference in New Issue Copy Permalink