Re: [PATCH] sshd-regen-keys: fix race condition

[Baurzhan Ismagulov <ibr@radix50.net>]

Hello Quirin,

On Thu, Mar 12, 2020 at 05:48:37PM +0100, Q. Gylstorff wrote:
> Systemd waits with starting service until a oneshot is finished this leads
> to a race condition if you try to restart a service in a oneshot.
> 
> "Behavior of oneshot is similar to simple; however, the service manager will consider
> the unit started after the main process exits. It will then start follow-up units.
> RemainAfterExit= is particularly useful for this type of service.  Type=oneshot is the
> implied default if neither Type= nor ExecStart= are specified."[1]
> 
> [1]: man systemd.service

Could you please help me understand the race you are facing? I've gone through
a couple of scenarios and couldn't identify one.


Apart from that, systemctl(1) says for enable:

"Note that this does not have the effect of also starting any of the units
being enabled. If this is desired, combine this command with the --now switch,
or invoke start with appropriate arguments later."

Similarly, for disable:

"Note that this command does not implicitly stop the units that are being
disabled. If this is desired, either combine this command with the --now
switch, or invoke the stop command with appropriate arguments later."

Considering the following scenario:

1. systemd starts ssh. It reads e.g. one key file but not others.

2. systemd starts sshd-regen-keys.sh. It disables ssh but doesn't stop it, then
   removes the keys.

3. sshd continues reading the other keys.

Is it possible that sshd finds inconsistent set of keys or doesn't find the
other keys? Shouldn't we specify --now for both enable and disable?


With kind regards,
Baurzhan.