JoinsNamespaceOf not working until reboot

[ian-kelling]

systemd version the issue has been seen with

246.6-2~bpo10+1

Used distribution

Debian 10 + backports

Linux kernel version used (uname -a)

5.8.0-0.bpo.2-amd64

CPU architecture issue was seen on

amd64

Expected behaviour you didn't see

The service's process having the same network namespace

Unexpected behaviour you saw

It has its own new namespace.

Steps to reproduce the problem

# this unit was enabled and running on startup:
cat /etc/systemd/system/mailnn.service 
[Unit]
Description=Network Namespace for mailvpn.service
After=syslog.target network-online.target
Wants=network-online.target

[Service]
Type=simple
PrivateNetwork=true
ExecStart=/bin/sleep infinity

[Install]
WantedBy=multi-user.target

systemctl start mailnn
systemctl enable mailnn

cat >/etc/systemd/system/exim4.service.d/nn.conf
[Unit]
JoinsNamespaceOf=mailnn.service

[Service]
PrivateNetwork=true
EOF
systemctl daemon-reload
systemctl restart exim4
systemctl status exim4
# copy a pid of exim4 daemon, replace PID in the following command
ls -la /proc/PID/ns/net
systemctl status mailnn
# copy a pid of mailnn
ls -la /proc/PID/ns/net

Result: different network namespaces, also both different from the default namespace. Then, reboot with mailnn and exim4 enabled. Check which network namespace mailnn and exim4 are in, they are the same as they should have been before reboot.

[ian-kelling]

I installed systemd 241-7~deb10u4 from debian main, rebooted, and this failed to reproduce. So, as far as I can tell, this is a regression.

[ian-kelling]

Note, I'm missing a <<EOF and a PS1 to indicate the end of the file in the original repro steps, but I think you get the point. I can't edit the bug from a browser running a nonfree javascript program that github tries to load and I'm not going to do it.

[yuwata]

I guess this is caused by c413bb2 (cherry-picked to v246-stable by 8019995). We need to backport f5fa352 to v246-stable.

C.f. #17313 and #17351.

cc @keszybz.

[poettering]

OK, let's close this here, given we only track issues in master here. Please file an issue on the stable repo asking for a backport.