Bug#1001320: needrestart misdetects socket activated ssh and restarts service instead of socket

Hallo Marc Haber,

08.12.21 13:31 Marc Haber:
> I am running a number of test systems with ssh as socket activated
> service. Sometimes, after an update, I find myself without ssh access to
> those systems (connection refused). After a console login and systemctl
> restart ssh.socket, things are fine again.
> 
> I THINK this might be connected to needrestart. Today, a libc6 update
> marked the running ssh daemon (that I was using for the update) as using
> obsolete libraries, which resulted in the following console output:

To me it looks like a problem in needrestart. The (forked off) sshd process 
handling your client connection belongs to cgroup session-NN.scope, no matter 
if it was started by systemd socket activation or regular sshd.

needrestart (invoked with "-vlp" here) detects a process with outdated libs:

[main] #2111961 uses deleted /lib/x86_64-linux-gnu/libnss_files-2.32.so
[main] #2111961 is a child of #2111904

Then it figures out the binary and the cgroup:

[main] #2111961 exe => /usr/sbin/sshd
[main] trying systemctl status

cgroup detection didn't work, so:

[main] #2111961 running /etc/needrestart/hook.d/10-dpkg
[main] #2111961 package: openssh-server
[main] #2111961 running /etc/needrestart/hook.d/20-rpm
[main] #2111961 running /etc/needrestart/hook.d/90-none

/etc/needrestart/hook.d/10-dpkg also finds /etc/init.d/ssh and we end up with:

Services:
[…]
- spamassassin.service
- ssh
- systemd-journald.service
[…]

Note the missing ".service". Then you have it invoke "systemctl restart 
ssh.service" and voilà.

A workaround might be masking ssh.service.


Grüße
Timo

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE87+TxUS8xnavTxo5VO6rSJSm4+0FAmGwyMoACgkQVO6rSJSm
4+3aWw/+P2WmYFmi0tNznkaiETM/yH4/wbr5csIVHprqVL0Dnnup1RRLHDJs+LJB
43Z9C4FHDGGWk6GhWybr83oHot9gNGWxpsBzbKxn+SnmniI/jEph5utaTSc3Kqmu
8LRsyOvyD92Z+wgSb/vTmEulJFIg9suCqs2bOz7cG6nKWURHXTVbRFCCncb6mAhb
JlOrXfsbjfioBV8mYl5a49zabOlhVA6np4fs08uGdhUS2klERx4DFJHfJwSl8WRc
7MpmeeJoHK41bSJqWadLUJwmWc9pAtRRHIMpBFLGCc93Udwyuv9o6UiP3/74+8Zk
C3DvnZDYGEIDNjN5WAgJGOUku01ORpNRDq7mCETT5HbuWjLZqnWFsvgCcOmDHz2+
FFZEI/S7mHZAbtMAPYf9Kf4xdlSi99zKKwJ6CKxY+krdiSNIFQaLu/4dpAFchDqV
5G2upBKSnNIxgIh3B85zj1GRMOVo+M3Zj1Ci9E0n8XGp8OsP7gmQ9ZnKUH7p/7pm
CgnrVhPcfuQAXsSeqdmKBUUWPbb920AQcoWwgUtm79vTOuRoCVcW/kLuYajUlMPD
b/iSlrU1Z9GdLxc64fnc+i3GHom2xqm3nUQKp0YJ/NbnVT648V5QCBBlixXVF7Qi
ucwi7wuYdmx8VYMeAL54ovnimlBMV4EZlsvmdq2B4f+xdegvlZ0=
=ePBs
-----END PGP SIGNATURE-----