Doc update

[mainvoid]

System information

Type	Version/Name
Distribution Name	Debian
Distribution Version	Stretch
Linux Kernel
Architecture	amd64
ZFS Version
SPL Version

Describe the problem you're observing

I followed the guid to put Debian Stretch root on ZFS (and rsyncing an existing install to the newly created pool). I however also run Plex on this system and decided I'd like a /var/lib dataset. I could have just done a /var/lib/plexmediaserver one, but went with the flow.

So, I copy and pasted one of the commands to create a dataset under /var and went on my merry way. Until I then started having issues with apt and dpkg refusing to upgrade or install packages. Problem shows itself as dpkg being able to create a temporary directory, unpack the deb file into it and subsequently failing to execute preinst scripts etc.

What had happened was, the rpool/var/lib dataset had noexec set on it.

Most of /var has little to no need for exec, but /var/lib/dpkg does, which in my case means I had to run "zfs set exec=on rpool/var/lib" to rectify my error.

May I suggest that a line is added where /var/lib or /var/lib/dpkg is added as a dataset, with exec=on? It may prevent future headaches for others, possibly with a note on why it is there.

Describe how to reproduce the problem

Create a dataset for /var/lib with noexec set.

Include any warning/errors/backtraces from the system logs

[gmelikov]

It inherited this property from zfs create -o canmount=off -o setuid=off -o exec=off rpool/var dataset.

I added comment about this case.

[Asuranceturix]

There is a related error that took me a while to figure: Postfix operates in chroot mode (/var/spool/postfix) by default in Debian. Since the parent is marked noexec, it fails to load dynamic libraries and fails with the dreaded postfix/smtp[pid]: fatal: unknown service: smtp/tcp error. I read a lot of pages that blamed this error on an incorrectly configured chroot, missing /etc/services and such, but the daemon start scripts in Debian do set up the chroot environment correctly; in the end it was the noexec flag. I would suggest a comment in the wiki page because it is a very important piece of software.

[gmelikov]

@Asuranceturix I've updated the instruction, thanks for the case.