Your message dated Wed, 18 Jan 2017 19:54:08 +0100
with message-id <[email protected]>
and subject line Re: mpd: On i686, RestrictNamespaces=yes in Systemd unit does
not allow mpd to open sockets
has caused the Debian Bug report #849817,
regarding Please make systemd fail to accept RestrictAddressFamilies on 32-bit
arches
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
849817: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=849817
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: mpd
Version: 0.19.21-1
Severity: important
Hi!
After upgrading an i686 machine running mpd from Jessie to Stretch,
I noticed mpd won't start -- exiting with return code 1 early at
startup:
| Dec 30 10:16:52 jukebox systemd[1]: [/lib/systemd/system/mpd.service:25]
Unknown lvalue 'RestrictNamespaces' in section 'Service'
| Dec 30 10:16:54 jukebox systemd[1]: Started Music Player Daemon.
| Dec 30 10:16:55 jukebox mpd[4936]: config_file: loading file /etc/mpd.conf
| Dec 30 10:16:55 jukebox systemd[1]: mpd.service: Main process exited,
code=exited, status=1/FAILURE
| Dec 30 10:16:55 jukebox systemd[1]: mpd.service: Unit entered failed state.
| Dec 30 10:16:55 jukebox systemd[1]: mpd.service: Failed with result
'exit-code'.
Running
/usr/bin/mpd --no-daemon -v /etc/mpd.conf
by hand as root worked OK, so I've changed the ExecStart parameted in
the Systemd unit to
/usr/bin/strace -o /tmp/mpd.log -f /usr/bin/mpd --no-daemon -v $MPDCONF
commented out all the system protection options, then started to
uncomment them one by one -- attempting to start the unit each time
(with proper invocations of `systemctl daemon-reload` in between).
Finally this spotted the problem which is the
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
option. With it being commented out, mpd starts OK.
Analyzing the strace output for relevant problems brought up several
attempts at opening sockets -- of types AF_UNIX and AF_INET.
Several of such failed attempts apparently get ignored by mpd, but the
last one actually makes it exit (silently for whatever reason) but with
the result code of 1.
The last lines of the strace's output are:
| 4938 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = -1 EPROTONOSUPPORT
(Protocol not supported)
| 4938 exit_group(1) = ?
| 4938 +++ exited with 1 +++
and the result of grepping it for EPROTONOSUPPORT is:
| 4743 socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = -1
EPROTONOSUPPORT (Protocol not supported)
| 4743 socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = -1
EPROTONOSUPPORT (Protocol not supported)
| 4743 socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = -1
EPROTONOSUPPORT (Protocol not supported)
| 4743 socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = -1
EPROTONOSUPPORT (Protocol not supported)
| 4743 socket(AF_INET, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) =
-1 EPROTONOSUPPORT (Protocol not supported)
| 4743 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = -1 EPROTONOSUPPORT
(Protocol not supported)
As to the essense of this but, it rather appears to affect Systemd v232
(as shipped by Stretch) specifically on i686 systems [1].
That bug's thread mentions [2], so I've added the unstable repository
and attempted to install systemd from there via
apt install -t unstable systemd
but it told me the package I have installed is already the newest
version, and its changelog has the following snippet:
----------------8<----------------
systemd (232-2) unstable; urgency=medium
* Drop RestrictAddressFamilies from service files.
RestrictAddressFamilies= is broken on 32bit architectures and causes
various services to fail with a timeout, including
systemd-udevd.service.
While this might actually be a libseccomp issue, remove this option for
now until a proper solution is found. (Closes: #843160)
-- Michael Biebl <[email protected]> Sat, 05 Nov 2016 22:43:27 +0100
----------------8<----------------
So it appears you'd better comment that option as well for now of ship
a dedicated unit files specifically for i686 systems if this is
possible.
OTOH, upstream appears to have some developments on [1], so maybe asking
systemd maintainers on whether it's possible to integrate some upstream
fix for this seccomp issue is worthwhile.
Thanks!
1. https://github.com/systemd/systemd/issues/4575
2. https://bugs.debian.org/843160
-- System Information:
Debian Release: stretch/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: i386 (i686)
Kernel: Linux 4.8.0-2-686-pae (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages mpd depends on:
ii adduser 3.115
ii init-system-helpers 1.46
ii libadplug-2.2.1-0v5 2.2.1+dfsg3-0.3
ii libao4 1.2.2-1
ii libasound2 1.1.2-1
ii libaudiofile1 0.3.6-3
ii libavahi-client3 0.6.32-1
ii libavahi-common3 0.6.32-1
ii libavcodec57 7:3.2.2-1
ii libavformat57 7:3.2.2-1
ii libavutil55 7:3.2.2-1
ii libbz2-1.0 1.0.6-8
ii libc6 2.24-8
ii libcdio-cdda1 0.83-4.2+b1
ii libcdio-paranoia1 0.83-4.2+b1
ii libcdio13 0.83-4.2+b1
ii libcurl3-gnutls 7.51.0-1
ii libdbus-1-3 1.10.14-1
ii libexpat1 2.2.0-1
ii libfaad2 2.8.0~cvs20161113-1
ii libflac8 1.3.1-4
ii libfluidsynth1 1.1.6-4
ii libgcc1 1:6.2.1-5
ii libglib2.0-0 2.50.2-2
ii libgme0 0.6.0-4
ii libicu57 57.1-5
ii libid3tag0 0.15.1b-12
ii libiso9660-8 0.83-4.2+b1
ii libjack0 [libjack-0.125] 1:0.125.0-2
ii libmad0 0.15.1b-8
ii libmikmod3 3.3.10-1
ii libmms0 0.6.4-2
ii libmodplug1 1:0.8.8.5-3
ii libmp3lame0 1:3.99.5-dmo2
ii libmpcdec6 2:0.1~r495-1
ii libmpdclient2 2.9-1
ii libmpg123-0 1.23.8-1
ii libnfs8 1.11.0-2
ii libogg0 1.3.2-1
ii libopenal1 1:1.17.2-4
ii libopus0 1.1.3-1
ii libpulse0 9.0-5
ii libroar2 1.0~beta11-8
ii libsamplerate0 0.1.8-8
ii libshout3 2.3.1-3
ii libsidplayfp4 1.8.7-1
ii libsmbclient 2:4.5.2+dfsg-2
ii libsndfile1 1.0.27-1
ii libsoxr0 0.1.2-1
ii libsqlite3-0 3.15.2-1
ii libstdc++6 6.2.1-5
ii libsystemd0 232-8
ii libupnp6 1:1.6.19+git20160116-1.2
ii libvorbis0a 1.3.5-3
ii libvorbisenc2 1.3.5-3
ii libvorbisfile3 1.3.5-3
ii libwavpack1 4.80.0-1
ii libwildmidi2 0.4.0-2
ii libwrap0 7.6.q-25
ii libyajl2 2.1.0-2
ii libzzip-0-13 0.13.62-3
ii lsb-base 9.20161125
ii zlib1g 1:1.2.8.dfsg-4
mpd recommends no packages.
Versions of packages mpd suggests:
pn avahi-daemon <none>
pn icecast2 <none>
ii mpc [mpd-client] 0.28-1
ii ncmpc [mpd-client] 0.25-0.1
pn pulseaudio <none>
-- Configuration Files:
/etc/default/mpd changed:
MPDCONF=/etc/mpd.conf
/etc/mpd.conf [Errno 13] Permission denied: '/etc/mpd.conf'
-- no debconf information
--- End Message ---
--- Begin Message ---
Version: 232-11
This should be sufficiently addressed by
> systemd (232-11) unstable; urgency=medium
>
> [ Martin Pitt ]
> * Fix RestrictAddressFamilies=
> Backport upstream fix for setting up seccomp filters to fix
> RestrictAddressFamilies= on non-amd64 architectures. Drop the hack from
> debian/rules to remove this property from unit files.
> See #843160
--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?
signature.asc
Description: OpenPGP digital signature
--- End Message ---
