Be able to give lock to son processes detached by systemctl

[alexAubin]

Problem

Following the changes in the lock system in Moulinette, it was noticed that it causes an issue for services that need to run yunohost command. Basically this kind of situation :

PID     PPID
  5     N/A     yunohost service foo start
  6      5      '-- systemctl foo start

 10     1       ./foo_start.sh
 11     10      '-- yunohost app foo setting bar -v meh

Process 10 is detached from process 6, therefore the lock taken by 5 cannot be used by 11...

This kind of situation happens at least in three different context :

• Firewall reload at the end of postinstall
• Firewall reload at any time from the yunohost admin
• All (?) apps of Internet Cube (e.g. here)

Solution

The proposed solution is that, everytime we have to restart a service which needs to be able to run yunohost commands, we launch the service/systemctl command in background, get the PID of the command launched by systemctl (using systemctl show), and add a lock for it to be able to run yunohost commands. For this, we need YunoHost/moulinette#154

A flag is set in services.yml (need_lock: true) to define which services need the lock.

With this design, only the process currently having the lock (A) gives the lock to another process (B). A waits for B to ends its execution, hence there's no issue for concurrence since only one of these is active at a time. There's no possibility for a process C to grab the lock as long as A has it (except of course if C decide to mess with the lock file).

How to test

Run the following :

yunohost service stop yunohost-firewall --debug
yunohost service start yunohost-firewall --debug

A debug message should say that a lock was added for a given PID (except if the service is already stopped/started)

Validation

• Principle agreement 1/2 : ljf
• Quick review 1/1 : ljf
• Simple test 0/1 :
• Deep review 0/1? :

[zamentur]

Principle agreement & quick review