Bug 531390

Summary:	net-firewall/iptables: circular dependencies in systemd restore service units
Product:	Gentoo Linux	Reporter:	mike <mike>
Component:	Current packages	Assignee:	Gentoo's Team for Core System packages <base-system>
Status:	CONFIRMED ---
Severity:	normal	CC:	alexander, jstein, systemd
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description mike@marineau.org 2014-12-02 01:16:45 UTC

The systemd iptables-restore.service and ip6tables-restore.service units have 'WantedBy=basic.target' as well as 'Before=basic.target'. Between the ordering implied by WantedBy=basic.target and basic.target being the default dependency of all service units this creates a dependency loop. The iptables rules shouldn't be loaded before basic.target anyway since it needs things like a working filesystem. The usual multi-user.target is more appropriate. Also recent versions of systemd introduced a network-pre.target specifically for firewalls. So the two units should probably look something more like this:

> [Unit]
> Description=Restore iptables firewall rules
> Conflicts=iptables-store.service shutdown.target
> Wants=network.target network-pre.target
> Before=network.target network-pre.target
>
> [Service]
> Type=oneshot
> ExecStart=/sbin/iptables-restore /var/lib/iptables/rules-save
> 
> [Install]
> WantedBy=multi-user.target

Comment 1 Michał Górny archtester

2014-12-02 10:16:11 UTC

Looks fine to me. Could some other team member ACK and commit it? It's my unit, so no need for another ACK from maintainer.

Comment 2 Matthias Maier gentoo-dev

2014-12-02 20:56:15 UTC

Looks fine for me, too.

the Wants=network.target shouldn't be strictly necessary (however, Wants=network-pre.target is).