REVISED: postfix/mimedefang socket
Richard Laager <[email protected]> Mon, 23 Jul 2018 03:31:06 -0500
| Newsgroups | gmane.mail.mimedefang |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------F6AAA411974D33DFBE03DDAC
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
I have attached updated systemd service files, with the PID file
directly in /run, which I have tested with 2.84. This change also
requires specifying a lock file in $SPOOLDIR.
If you prefer a diff rather than new files, I also attached a diff
against 2.84.
This includes and builds upon my last changes:
On 12/09/2017 05:45 PM, Richard Laager wrote:
> I ran into a problem with my systemd units for MIMEDefang. There is a
> race condition between mimedefang-multiplexor creating the socket and
> mimedefang trying to access it. If the multiplexor doesn't create the
> socket in time, mimedefang fails on startup.
>
> This is happening because Type=simple services are assumed to be running
> immediately. This is documented in systemd.service(5), which says, "In
> this mode, if the process offers functionality to other processes on the
> system, its communication channels should be installed before the daemon
> is started up (e.g. sockets set up by systemd, via socket activation),
> as systemd will immediately proceed starting follow-up units."
>
> I have attached updated versions to correct this. These change to
> Type=forking and drop the -D flag. With the change to Type=forking, I
> have also brought back pid files. Since systemd requires the pid file
> path to be hardcoded (as the argument to PIDFile), I put it in /run
> rather than the $SPOOLDIR (which the administrator can change).
This part no longer applies, as of MIMEDefang 2.83, because it writes
the PID files as root:
> It can't
> be directly in /run, as the daemon writes the pidfile after dropping
> privileges, so we have to create a /run/mimedefang subdirectory owned by
> $MX_USER. This requires some indirection, as $MX_USER can also be
> customized by the administrator. I only create this directory for
> mimedefang-multiplexor.service (and not mimedefang.service), as
> mimedefang.service is already ordered after mimedefang-multiplexor.service.
--
Richard
--------------F6AAA411974D33DFBE03DDAC
Content-Type: text/plain; charset=UTF-8;
name="mimedefang.service"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="mimedefang.service"
W1VuaXRdCkRlc2NyaXB0aW9uPU1JTUVEZWZhbmcgRS1tYWlsIEZpbHRlcgpEb2N1bWVudGF0
aW9uPW1hbjptaW1lZGVmYW5nKDgpCkJlZm9yZT1tdWx0aS11c2VyLnRhcmdldApCZWZvcmU9
cG9zdGZpeC5zZXJ2aWNlCkJlZm9yZT1zZW5kbWFpbC5zZXJ2aWNlCkFmdGVyPXJlbW90ZS1m
cy50YXJnZXQKQWZ0ZXI9c3lzdGVtZC1qb3VybmFsZC1kZXYtbG9nLnNvY2tldApCaW5kc1Rv
PW1pbWVkZWZhbmctbXVsdGlwbGV4b3Iuc2VydmljZQpBZnRlcj1taW1lZGVmYW5nLW11bHRp
cGxleG9yLnNlcnZpY2UKUHJvcGFnYXRlc1JlbG9hZFRvPW1pbWVkZWZhbmctbXVsdGlwbGV4
b3Iuc2VydmljZQoKW1NlcnZpY2VdClR5cGU9Zm9ya2luZwpQSURGaWxlPS9ydW4vbWltZWRl
ZmFuZy5waWQKUmVzdGFydD1vbi1mYWlsdXJlClRpbWVvdXRTdG9wU2VjPTMwcwojIExDX0FM
TD1DIG1heSBub3QgYmUgbmVjZXNzYXJ5IGZvciBtaW1lZGVmYW5nLCBidXQgaXQgaXMgZm9y
CiMgbWltZWRlZmFuZy1tdWx0aXBsZXhvciwgc28gdXBzdHJlYW0gcHJlZmVycyBpdCBoZXJl
IGFsc28gdG8gYmUgY29uc2lzdGVudC4KRW52aXJvbm1lbnQ9TENfQUxMPUMgTVhfU09DS0VU
PS92YXIvc3Bvb2wvTUlNRURlZmFuZy9taW1lZGVmYW5nLW11bHRpcGxleG9yLnNvY2sgTVhf
VVNFUj1kZWZhbmcgU1BPT0xESVI9L3Zhci9zcG9vbC9NSU1FRGVmYW5nIFNPQ0tFVD0vdmFy
L3Nwb29sL01JTUVEZWZhbmcvbWltZWRlZmFuZy5zb2NrCkVudmlyb25tZW50RmlsZT0tL2V0
Yy9kZWZhdWx0L21pbWVkZWZhbmcKRXhlY1N0YXJ0UHJlPS9iaW4vcm0gLWYgJFNPQ0tFVApF
eGVjU3RhcnQ9L2Jpbi9zaCAtYyAnZXhlYyAvdXNyL2Jpbi9taW1lZGVmYW5nIFwKICAgIGBb
IC1uICIkTE9PUEJBQ0tfUkVTRVJWRURfQ09OTkVDVElPTlMiIF0gJiYgZWNobyAiLVIgJExP
T1BCQUNLX1JFU0VSVkVEX0NPTk5FQ1RJT05TImAgXAogICAgLW0gJE1YX1NPQ0tFVCBcCiAg
ICAteiAkU1BPT0xESVIgXAogICAgLW8gJFNQT09MRElSL21pbWVkZWZhbmcubG9jayBcCiAg
ICBgWyAtbiAiJE1YX1VTRVIiIF0gJiYgZWNobyAiLVUgJE1YX1VTRVIiYCBcCiAgICBgWyAt
biAiJFNZU0xPR19GQUNJTElUWSIgXSAmJiBlY2hvICItUyAkU1lTTE9HX0ZBQ0lMSVRZImAg
XAogICAgYFsgIiRNWF9SRUxBWV9DSEVDSyIgPSAieWVzIiBdICYmIGVjaG8gIi1yImAgXAog
ICAgYFsgIiRNWF9IRUxPX0NIRUNLIiA9ICJ5ZXMiIF0gJiYgZWNobyAiLUgiYCBcCiAgICBg
WyAiJE1YX1NFTkRFUl9DSEVDSyIgPSAieWVzIiBdICYmIGVjaG8gIi1zImAgXAogICAgYFsg
IiRNWF9SRUNJUElFTlRfQ0hFQ0siID0gInllcyIgXSAmJiBlY2hvICItdCJgIFwKICAgIGBb
ICIkS0VFUF9GQUlMRURfRElSRUNUT1JJRVMiID0gInllcyIgXSAmJiBlY2hvICItayJgIFwK
ICAgIGBbICIkTURfRVhUUkEiICE9ICIiIF0gJiYgZWNobyAkTURfRVhUUkFgIFwKICAgIGBb
ICIkTURfU0tJUF9CQURfUkNQVFMiID0gInllcyIgXSAmJiBlY2hvICItTiJgIFwKICAgICJg
WyAtbiAiJFhfU0NBTk5FRF9CWSIgXSAmJiBcCiAgICAgICggWyAiJFhfU0NBTk5FRF9CWSIg
PSAiLSIgXSAmJiBcCiAgICAgICAgZWNobyAiLVgiIHx8IGVjaG8gIi14JFhfU0NBTk5FRF9C
WSIgKWAiIFwKICAgIGBbICIkTURfQUxMT1dfR1JPVVBfQUNDRVNTIiA9ICJ5ZXMiIF0gJiYg
ZWNobyAiLUciYCBcCiAgICBgWyAiJEFMTE9XX05FV19DT05ORUNUSU9OU19UT19RVUVVRSIg
PSAieWVzIiBdICYmIGVjaG8gIi1xImAgXAogICAgLXAgJFNPQ0tFVCAtUCAvcnVuL21pbWVk
ZWZhbmcucGlkJwpFeGVjU3RvcFBvc3Q9L2Jpbi9ybSAtZiAkU09DS0VUCiMgTWFrZSB0aGlz
IHNlcnZpY2UgZWxpZ2libGUgZm9yIGEgcmVsb2FkLCBzbyB3ZSBjYW4gcHJvcGFnYXRlIGl0
IHRvCiMgbWltZWRlZmFuZy1tdWx0aXBsZXhvci5zZXJ2aWNlLgpFeGVjUmVsb2FkPS9iaW4v
dHJ1ZQoKW0luc3RhbGxdCldhbnRlZEJ5PW11bHRpLXVzZXIudGFyZ2V0Cg==
--------------F6AAA411974D33DFBE03DDAC
Content-Type: text/plain; charset=UTF-8;
name="mimedefang-multiplexor.service"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="mimedefang-multiplexor.service"
W1VuaXRdCkRlc2NyaXB0aW9uPU1JTUVEZWZhbmcgRS1tYWlsIEZpbHRlciAoTXVsdGlwbGV4
b3IpCkRvY3VtZW50YXRpb249bWFuOm1pbWVkZWZhbmctbXVsdGlwbGV4b3IoOCkKQWZ0ZXI9
cmVtb3RlLWZzLnRhcmdldApBZnRlcj1zeXN0ZW1kLWpvdXJuYWxkLWRldi1sb2cuc29ja2V0
ClBhcnRPZj1taW1lZGVmYW5nLnNlcnZpY2UKCltTZXJ2aWNlXQpUeXBlPWZvcmtpbmcKUElE
RmlsZT0vcnVuL21pbWVkZWZhbmctbXVsdGlwbGV4b3IucGlkClJlc3RhcnQ9b24tZmFpbHVy
ZQpUaW1lb3V0U3RvcFNlYz0zMHMKS2lsbE1vZGU9bWl4ZWQKIyBMb2NhbGUgc2hvdWxkIGJl
IHNldCB0byAiQyIgZm9yIGdlbmVyYXRpbmcgdmFsaWQgZGF0ZSBoZWFkZXJzCkVudmlyb25t
ZW50PUxDX0FMTD1DIE1YX0JVU1k9NjAwIE1YX0xPRz15ZXMgTVhfTUFYSU1VTT0xMCBNWF9N
SU5JTVVNPTIgTVhfU09DS0VUPS92YXIvc3Bvb2wvTUlNRURlZmFuZy9taW1lZGVmYW5nLW11
bHRpcGxleG9yLnNvY2sgTVhfVVNFUj1kZWZhbmcgU1BPT0xESVI9L3Zhci9zcG9vbC9NSU1F
RGVmYW5nCkVudmlyb25tZW50RmlsZT0tL2V0Yy9kZWZhdWx0L21pbWVkZWZhbmcKRXhlY1N0
YXJ0UHJlPS9iaW4vcm0gLWYgJE1YX1NPQ0tFVApFeGVjU3RhcnQ9L2Jpbi9zaCAtYyAnSE9N
RT0ke1NQT09MRElSfSBcCiAgICBleGVjIC91c3IvYmluL21pbWVkZWZhbmctbXVsdGlwbGV4
b3IgXAogICAgYFsgIiRNWF9FTUJFRF9QRVJMIiA9ICJ5ZXMiIF0gJiYgZWNobyAiLUUiYCBc
CiAgICAteiAkU1BPT0xESVIgXAogICAgLW8gJFNQT09MRElSL21pbWVkZWZhbmctbXVsdGlw
bGV4b3IubG9jayBcCiAgICBgWyAtbiAiJEZJTFRFUiIgXSAmJiBlY2hvICItZiAkRklMVEVS
ImAgXAogICAgYFsgLW4gIiRTWVNMT0dfRkFDSUxJVFkiIF0gJiYgZWNobyAiLVMgJFNZU0xP
R19GQUNJTElUWSJgIFwKICAgIGBbIC1uICIkU1VCRklMVEVSIiBdICYmIGVjaG8gIi1GICRT
VUJGSUxURVIiYCBcCiAgICBgWyAtbiAiJE1YX01JTklNVU0iIF0gJiYgZWNobyAiLW0gJE1Y
X01JTklNVU0iYCBcCiAgICBgWyAtbiAiJE1YX01BWElNVU0iIF0gJiYgZWNobyAiLXggJE1Y
X01BWElNVU0iYCBcCiAgICBgWyAtbiAiJE1YX01BUF9TT0NLRVQiIF0gJiYgZWNobyAiLU4g
JE1YX01BUF9TT0NLRVQiYCBcCiAgICBgWyAtbiAiJE1YX0xPR19TTEFWRV9TVEFUVVNfSU5U
RVJWQUwiIF0gJiYgZWNobyAiLUwgJE1YX0xPR19TTEFWRV9TVEFUVVNfSU5URVJWQUwiYCBc
CiAgICBgWyAtbiAiJE1YX1VTRVIiIF0gJiYgZWNobyAiLVUgJE1YX1VTRVIiYCBcCiAgICBg
WyAtbiAiJE1YX0lETEUiIF0gJiYgZWNobyAiLWkgJE1YX0lETEUiYCBcCiAgICBgWyAtbiAi
JE1YX0JVU1kiIF0gJiYgZWNobyAiLWIgJE1YX0JVU1kiYCBcCiAgICBgWyAtbiAiJE1YX1JF
UVVFU1RTIiBdICYmIGVjaG8gIi1yICRNWF9SRVFVRVNUUyJgIFwKICAgIGBbIC1uICIkTVhf
U0xBVkVfREVMQVkiIF0gJiYgZWNobyAiLXcgJE1YX1NMQVZFX0RFTEFZImAgXAogICAgYFsg
LW4gIiRNWF9NSU5fU0xBVkVfREVMQVkiIF0gJiYgZWNobyAiLVcgJE1YX01JTl9TTEFWRV9E
RUxBWSJgIFwKICAgIGBbIC1uICIkTVhfTUFYX1JTUyIgXSAmJiBlY2hvICItUiAkTVhfTUFY
X1JTUyJgIFwKICAgIGBbIC1uICIkTVhfTUFYX0FTIiBdICYmIGVjaG8gIi1NICRNWF9NQVhf
QVMiYCBcCiAgICBgWyAiJE1YX0xPRyIgPSAieWVzIiBdICYmIGVjaG8gIi1sImAgXAogICAg
YFsgIiRNWF9TVEFUUyIgPSAieWVzIiBdICYmIGVjaG8gIi10IC92YXIvbG9nL21pbWVkZWZh
bmcvc3RhdHMiYCBcCiAgICBgWyAiJE1YX1NUQVRTIiA9ICJ5ZXMiIC1hICIkTVhfRkxVU0hf
U1RBVFMiID0gInllcyIgXSAmJiBlY2hvICItdSJgIFwKICAgIGBbICIkTVhfU1RBVFNfU1lT
TE9HIiA9ICJ5ZXMiIF0gJiYgZWNobyAiLVQiYCBcCiAgICBgWyAiJE1EX0FMTE9XX0dST1VQ
X0FDQ0VTUyIgPSAieWVzIiBdICYmIGVjaG8gIi1HImAgXAogICAgYFsgIiRNWF9TVEFUVVNf
VVBEQVRFUyIgPSAieWVzIiBdICYmIGVjaG8gIi1aImAgXAogICAgYFsgLW4gIiRNWF9RVUVV
RV9TSVpFIiBdICYmIGVjaG8gIi1xICRNWF9RVUVVRV9TSVpFImAgXAogICAgYFsgLW4gIiRN
WF9RVUVVRV9USU1FT1VUIiBdICYmIGVjaG8gIi1RICRNWF9RVUVVRV9USU1FT1VUImAgXAog
ICAgYFsgLW4gIiRNWF9OT1RJRklFUiIgXSAmJiBlY2hvICItTyAkTVhfTk9USUZJRVIiYCBc
CiAgICBgWyAtbiAiJE1YX1JFQ0lQT0tfUEVSRE9NQUlOX0xJTUlUIiBdICYmIGVjaG8gIi15
ICRNWF9SRUNJUE9LX1BFUkRPTUFJTl9MSU1JVCJgIFwKICAgIC1zICRNWF9TT0NLRVQgLXAg
L3J1bi9taW1lZGVmYW5nLW11bHRpcGxleG9yLnBpZCcKRXhlY1N0b3BQb3N0PS9iaW4vcm0g
LWYgJE1YX1NPQ0tFVApFeGVjUmVsb2FkPS9iaW4va2lsbCAtSU5UICRNQUlOUElECg==
--------------F6AAA411974D33DFBE03DDAC
Content-Type: text/x-patch;
name="mimedefang-systemd.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="mimedefang-systemd.patch"
diff -urN mimedefang-2.84-orig/systemd-units/mimedefang-multiplexor.service mimedefang-2.84/systemd-units/mimedefang-multiplexor.service
--- mimedefang-2.84-orig/systemd-units/mimedefang-multiplexor.service 2017-10-05 08:21:26.000000000 -0500
+++ mimedefang-2.84/systemd-units/mimedefang-multiplexor.service 2018-07-22 05:43:16.691486469 -0500
@@ -6,19 +6,20 @@
PartOf=mimedefang.service
[Service]
-Type=simple
+Type=forking
+PIDFile=/run/mimedefang-multiplexor.pid
Restart=on-failure
TimeoutStopSec=30s
KillMode=mixed
# Locale should be set to "C" for generating valid date headers
-Environment=LC_ALL=C MX_BUSY=600 MX_LOG=yes MX_MAXIMUM=10 MX_MINIMUM=2 MX_SOCKET=/var/spool/MIMEDefang/mimedefang-multiplexor.sock MX_USER=defang
+Environment=LC_ALL=C MX_BUSY=600 MX_LOG=yes MX_MAXIMUM=10 MX_MINIMUM=2 MX_SOCKET=/var/spool/MIMEDefang/mimedefang-multiplexor.sock MX_USER=defang SPOOLDIR=/var/spool/MIMEDefang
EnvironmentFile=-/etc/default/mimedefang
-# This can be removed with MIMEDefang 2.82, but is required for older versions:
-# SuccessExitStatus=1
-ExecStart=/bin/sh -c 'HOME=${SPOOLDIR:=/var/spool/MIMEDefang} \
- exec /usr/bin/mimedefang-multiplexor -D \
+ExecStartPre=/bin/rm -f $MX_SOCKET
+ExecStart=/bin/sh -c 'HOME=${SPOOLDIR} \
+ exec /usr/bin/mimedefang-multiplexor \
`[ "$MX_EMBED_PERL" = "yes" ] && echo "-E"` \
- `[ -n "$SPOOLDIR" ] && echo "-z $SPOOLDIR"` \
+ -z $SPOOLDIR \
+ -o $SPOOLDIR/mimedefang-multiplexor.lock \
`[ -n "$FILTER" ] && echo "-f $FILTER"` \
`[ -n "$SYSLOG_FACILITY" ] && echo "-S $SYSLOG_FACILITY"` \
`[ -n "$SUBFILTER" ] && echo "-F $SUBFILTER"` \
@@ -44,7 +45,6 @@
`[ -n "$MX_QUEUE_TIMEOUT" ] && echo "-Q $MX_QUEUE_TIMEOUT"` \
`[ -n "$MX_NOTIFIER" ] && echo "-O $MX_NOTIFIER"` \
`[ -n "$MX_RECIPOK_PERDOMAIN_LIMIT" ] && echo "-y $MX_RECIPOK_PERDOMAIN_LIMIT"` \
- -s $MX_SOCKET'
-ExecStartPre=/bin/rm -f $MX_SOCKET
+ -s $MX_SOCKET -p /run/mimedefang-multiplexor.pid'
ExecStopPost=/bin/rm -f $MX_SOCKET
ExecReload=/bin/kill -INT $MAINPID
diff -urN mimedefang-2.84-orig/systemd-units/mimedefang.service mimedefang-2.84/systemd-units/mimedefang.service
--- mimedefang-2.84-orig/systemd-units/mimedefang.service 2017-10-05 08:19:33.000000000 -0500
+++ mimedefang-2.84/systemd-units/mimedefang.service 2018-07-22 05:43:15.467469243 -0500
@@ -11,18 +11,20 @@
PropagatesReloadTo=mimedefang-multiplexor.service
[Service]
-Type=simple
+Type=forking
+PIDFile=/run/mimedefang.pid
Restart=on-failure
TimeoutStopSec=30s
# LC_ALL=C may not be necessary for mimedefang, but it is for
# mimedefang-multiplexor, so upstream prefers it here also to be consistent.
-Environment=LC_ALL=C MX_SOCKET=/var/spool/MIMEDefang/mimedefang-multiplexor.sock MX_USER=defang SOCKET=/var/spool/MIMEDefang/mimedefang.sock
+Environment=LC_ALL=C MX_SOCKET=/var/spool/MIMEDefang/mimedefang-multiplexor.sock MX_USER=defang SPOOLDIR=/var/spool/MIMEDefang SOCKET=/var/spool/MIMEDefang/mimedefang.sock
EnvironmentFile=-/etc/default/mimedefang
ExecStartPre=/bin/rm -f $SOCKET
-ExecStart=/bin/sh -c 'exec /usr/bin/mimedefang -D \
+ExecStart=/bin/sh -c 'exec /usr/bin/mimedefang \
`[ -n "$LOOPBACK_RESERVED_CONNECTIONS" ] && echo "-R $LOOPBACK_RESERVED_CONNECTIONS"` \
-m $MX_SOCKET \
- `[ -n "$SPOOLDIR" ] && echo "-z $SPOOLDIR"` \
+ -z $SPOOLDIR \
+ -o $SPOOLDIR/mimedefang.lock \
`[ -n "$MX_USER" ] && echo "-U $MX_USER"` \
`[ -n "$SYSLOG_FACILITY" ] && echo "-S $SYSLOG_FACILITY"` \
`[ "$MX_RELAY_CHECK" = "yes" ] && echo "-r"` \
@@ -37,7 +39,7 @@
echo "-X" || echo "-x$X_SCANNED_BY" )`" \
`[ "$MD_ALLOW_GROUP_ACCESS" = "yes" ] && echo "-G"` \
`[ "$ALLOW_NEW_CONNECTIONS_TO_QUEUE" = "yes" ] && echo "-q"` \
- -p $SOCKET'
+ -p $SOCKET -P /run/mimedefang.pid'
ExecStopPost=/bin/rm -f $SOCKET
# Make this service eligible for a reload, so we can propagate it to
# mimedefang-multiplexor.service.
--------------F6AAA411974D33DFBE03DDAC
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KTk9URTogSWYg
dGhlcmUgaXMgYSBkaXNjbGFpbWVyIG9yIG90aGVyIGxlZ2FsIGJvaWxlcnBsYXRlIGluIHRoZSBh
Ym92ZQptZXNzYWdlLCBpdCBpcyBOVUxMIEFORCBWT0lELiAgWW91IG1heSBpZ25vcmUgaXQuCgpW
aXNpdCBodHRwOi8vd3d3Lm1pbWVkZWZhbmcub3JnIGFuZCBodHRwOi8vd3d3LnJvYXJpbmdwZW5n
dWluLmNvbQpNSU1FRGVmYW5nIG1haWxpbmcgbGlzdCBNSU1FRGVmYW5nQGxpc3RzLnJvYXJpbmdw
ZW5ndWluLmNvbQpodHRwOi8vbGlzdHMucm9hcmluZ3Blbmd1aW4uY29tL21haWxtYW4vbGlzdGlu
Zm8vbWltZWRlZmFuZwo=
--------------F6AAA411974D33DFBE03DDAC--