Haveged service not started in debian-9 template

[marmarek]

Qubes OS version (e.g., R3.1):

R3.2

Affected TemplateVMs (e.g., fedora-23, if applicable):

debian-9

---

Expected behavior:

Haveged service installed and running by default.

Actual behavior:

Haveged service installed but not running.

Steps to reproduce the behavior:

1. Start a VM based on debian-9 template
2. Check if service is running: systemctl status haveged

Collected data:

● haveged.service - Entropy daemon using the HAVEGE algorithm
   Loaded: loaded (/lib/systemd/system/haveged.service; enabled; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:haveged(8)
           http://www.issihosts.com/haveged/
root@test-inst-backend:~# cat /lib/systemd/system/haveged.service
[Unit]
Description=Entropy daemon using the HAVEGE algorithm
Documentation=man:haveged(8) http://www.issihosts.com/haveged/
DefaultDependencies=no
ConditionVirtualization=!container
After=systemd-random-seed.service
Before=sysinit.target shutdown.target systemd-journald.service

[Service]
EnvironmentFile=-/etc/default/haveged
ExecStart=/usr/sbin/haveged --Foreground --verbose=1 $DAEMON_ARGS
SuccessExitStatus=143
SecureBits=noroot-locked
NoNewPrivileges=yes
CapabilityBoundingSet=CAP_SYS_ADMIN
PrivateTmp=yes
PrivateDevices=yes
PrivateNetwork=yes
ProtectSystem=full
ProtectHome=yes

[Install]
WantedBy=default.target
root@test-inst-backend:~# ls -l /etc/systemd/system/default.target.wants/
total 0
lrwxrwxrwx 1 root root 35 Jan 12 07:03 haveged.service -> /lib/systemd/system/haveged.service
lrwxrwxrwx 1 root root 53 Jan 12 07:09 systemd-readahead-collect.service -> /lib/systemd/system/systemd-readahead-collect.service
lrwxrwxrwx 1 root root 52 Jan 12 07:09 systemd-readahead-replay.service -> /lib/systemd/system/systemd-readahead-replay.service
root@test-inst-backend:~# ls -l /etc/systemd/system/default.target
lrwxrwxrwx 1 root root 37 Jan 12 07:09 /etc/systemd/system/default.target -> /lib/systemd/system/multi-user.target
root@test-inst-backend:~# ls -l /etc/systemd/system/multi-user.target.wants/
total 0
lrwxrwxrwx 1 root root 31 Jan 12 06:45 atd.service -> /lib/systemd/system/atd.service
lrwxrwxrwx 1 root root 32 Jan 12 06:33 cron.service -> /lib/systemd/system/cron.service
lrwxrwxrwx 1 root root 40 Jan 12 07:09 cups-browsed.service -> /lib/systemd/system/cups-browsed.service
lrwxrwxrwx 1 root root 40 Jan 12 07:02 ModemManager.service -> /lib/systemd/system/ModemManager.service
lrwxrwxrwx 1 root root 38 May 12 01:19 networking.service -> /lib/systemd/system/networking.service
lrwxrwxrwx 1 root root 42 Jan 12 07:09 NetworkManager.service -> /lib/systemd/system/NetworkManager.service
lrwxrwxrwx 1 root root 36 Jan 12 07:09 pppd-dns.service -> /lib/systemd/system/pppd-dns.service
lrwxrwxrwx 1 root root 37 Jan 12 07:09 qubes-dvm.service -> /lib/systemd/system/qubes-dvm.service
lrwxrwxrwx 1 root root 42 Jan 12 07:09 qubes-firewall.service -> /lib/systemd/system/qubes-firewall.service
lrwxrwxrwx 1 root root 43 Jan 12 07:09 qubes-gui-agent.service -> /lib/systemd/system/qubes-gui-agent.service
lrwxrwxrwx 1 root root 48 Jan 12 07:09 qubes-meminfo-writer.service -> /lib/systemd/system/qubes-meminfo-writer.service
lrwxrwxrwx 1 root root 43 Jan 12 07:09 qubes-misc-post.service -> /lib/systemd/system/qubes-misc-post.service
lrwxrwxrwx 1 root root 44 Jan 12 07:09 qubes-mount-dirs.service -> /lib/systemd/system/qubes-mount-dirs.service
lrwxrwxrwx 1 root root 44 Jan 12 07:09 qubes-netwatcher.service -> /lib/systemd/system/qubes-netwatcher.service
lrwxrwxrwx 1 root root 41 Jan 12 07:09 qubes-network.service -> /lib/systemd/system/qubes-network.service
lrwxrwxrwx 1 root root 46 Jan 12 07:09 qubes-qrexec-agent.service -> /lib/systemd/system/qubes-qrexec-agent.service
lrwxrwxrwx 1 root root 44 Jan 12 07:09 qubes-update-check.timer -> /lib/systemd/system/qubes-update-check.timer
lrwxrwxrwx 1 root root 47 Jan 12 07:09 qubes-updates-proxy.service -> /lib/systemd/system/qubes-updates-proxy.service
lrwxrwxrwx 1 root root 36 Jan 12 06:29 remote-fs.target -> /lib/systemd/system/remote-fs.target
lrwxrwxrwx 1 root root 35 Jan 12 06:34 rsyslog.service -> /lib/systemd/system/rsyslog.service
lrwxrwxrwx 1 root root 32 Jan 12 07:09 sudo.service -> /lib/systemd/system/sudo.service
lrwxrwxrwx 1 root root 44 Jan 12 07:09 systemd-networkd.service -> /lib/systemd/system/systemd-networkd.service
lrwxrwxrwx 1 root root 44 Jan 12 07:09 systemd-resolved.service -> /lib/systemd/system/systemd-resolved.service
lrwxrwxrwx 1 root root 31 May 12 01:31 tor.service -> /lib/systemd/system/tor.service
lrwxrwxrwx 1 root root 42 Jan 12 07:09 wpa_supplicant.service -> /lib/systemd/system/wpa_supplicant.service

Probably the reason is usage of default.target.wants instead of multi-user.target.wants.

[unman]

@marmarek It's not just the use of default.target. The Debian config also has PrivateTmp=1
Both of those need to be changed in template.

[unman]

@marmarek It's not just the use of default.target. The Debian config also has PrivateTmp=1
Both of those need to be changed in template.

[marmarek]

What is wrong with PrivateTmp=1?

[marmarek]

What is wrong with PrivateTmp=1?

[unman]

Nothing, but I think the effect of the Debian ordering means that haveged is started early. While this seems to work in the Template, it doesn't work in the VMs based on it.
To retain PrivateTmp it's necessary to push the start later - removing sysinit from the BEFORE line would do, I think, and also taking out DefaultDependencies=no

[unman]

Nothing, but I think the effect of the Debian ordering means that haveged is started early. While this seems to work in the Template, it doesn't work in the VMs based on it.
To retain PrivateTmp it's necessary to push the start later - removing sysinit from the BEFORE line would do, I think, and also taking out DefaultDependencies=no

[marmarek]

I still can't see why PrivateTmp can't work on early started service in TemplateBasedVM. Some implicit ordering?

[marmarek]

I still can't see why PrivateTmp can't work on early started service in TemplateBasedVM. Some implicit ordering?

[unman]

No idea - it looks to me as if it won't start in a template based VM before basic.target, although it will in Template. The dependency list doesn't seem to help much.

[unman]

No idea - it looks to me as if it won't start in a template based VM before basic.target, although it will in Template. The dependency list doesn't seem to help much.

[marmarek]

systemd-analyze?

Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

[marmarek]

systemd-analyze?

Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

[unman]

I've tried it and produced numerous pretty plots. None of them get to the heart of the issue, at least for me. Also significant that haveged can starts earlier in a template that in a template based VM. I'll keep poking about, and let you know conclusions.

[unman]

I've tried it and produced numerous pretty plots. None of them get to the heart of the issue, at least for me. Also significant that haveged can starts earlier in a template that in a template based VM. I'll keep poking about, and let you know conclusions.

[unman]

Question - how late in the boot can haveged start and still be useful?

[unman]

Question - how late in the boot can haveged start and still be useful?

[marmarek]

Since we do provide initial random seed from dom0, it may be late.

[marmarek]

Since we do provide initial random seed from dom0, it may be late.

[unman]

OK- then

DefaultDependencies=no
ConditionVirtualization=!container
After=apparmor.service systemd-random-seed.service systemd-tmpfiles-setup.service

and

[Install]
WantedBy=multi-user.target

seems to work fine, and retains PrivateTmp
I'll check if this is needed in xenial too and then put in a PR

[unman]

OK- then

DefaultDependencies=no
ConditionVirtualization=!container
After=apparmor.service systemd-random-seed.service systemd-tmpfiles-setup.service

and

[Install]
WantedBy=multi-user.target

seems to work fine, and retains PrivateTmp
I'll check if this is needed in xenial too and then put in a PR

[marmarek]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.15-1.fc23 has been pushed to the r3.2 testing repository for the Fedora fc23 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.15-1.fc23 has been pushed to the r3.2 testing repository for the Fedora fc23 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.15-1.fc24 has been pushed to the r3.2 testing repository for the Fedora fc24 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.15-1.fc24 has been pushed to the r3.2 testing repository for the Fedora fc24 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.15-1.fc25 has been pushed to the r3.2 testing repository for the Fedora fc25 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.15-1.fc25 has been pushed to the r3.2 testing repository for the Fedora fc25 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.15-1.fc23 has been pushed to the r3.2 stable repository for the Fedora fc23 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.15-1.fc23 has been pushed to the r3.2 stable repository for the Fedora fc23 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.15-1.fc24 has been pushed to the r3.2 stable repository for the Fedora fc24 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.15-1.fc24 has been pushed to the r3.2 stable repository for the Fedora fc24 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.15-1.fc25 has been pushed to the r3.2 stable repository for the Fedora fc25 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.15-1.fc25 has been pushed to the r3.2 stable repository for the Fedora fc25 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_3.2.15-1+deb8u1 has been pushed to the r3.2 testing repository for the Debian jessie template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing jessie-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_3.2.15-1+deb8u1 has been pushed to the r3.2 testing repository for the Debian jessie template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing jessie-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_3.2.15-1+deb9u1 has been pushed to the r3.2 testing repository for the Debian stretch template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_3.2.15-1+deb9u1 has been pushed to the r3.2 testing repository for the Debian stretch template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update