Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 673794 - sys-apps/systemd systemctl deamon-reexec fails in a PID namespace
Summary: sys-apps/systemd systemctl deamon-reexec fails in a PID namespace
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo systemd Team
Keywords: InVCS
Depends on:
Reported: 2018-12-27 06:50 UTC by Mike Gilbert
Modified: 2023-12-05 23:37 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Mike Gilbert gentoo-dev 2018-12-27 06:50:17 UTC
sys-apps/systemd runs "systemctl daemon-reexec" in pkg_postinst to re-execute the running system manager.

With FEATURES="pid-sandbox" enabled, this command fails:

 * Reexecuting system manager ...
Failed to connect to bus: No data available
Comment 1 Zac Medico gentoo-dev 2018-12-27 20:52:39 UTC
For FEATURES=cgroup we have a list of phases that we could also apply to FEATURES=pid-sandbox:

_phases_without_cgroup = ('preinst', 'postinst', 'prerm', 'postrm', 'config')

It's arguable that pid-sandbox is more useful for src_* phases where rogue processes are more common, though it's certainly possible for pkg_* phases to create such processes.
Comment 2 Mike Gilbert gentoo-dev 2018-12-30 20:59:07 UTC
For debugging systemd, running the following command has the same result:

unshare -f -p --mount-proc systemctl daemon-reexec
Comment 3 Zac Medico gentoo-dev 2019-01-07 09:37:06 UTC
It #gentoo-portage it was said that systemctl fails to detect systemd as PID 1 (since over the socket PID 1 on host appears to it as PID 0 so its PID > 0 check fails).
Comment 4 Mike Gilbert gentoo-dev 2019-01-07 16:02:43 UTC
There's a more in-depth discussion on the upstream issue (see also).
Comment 5 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2019-01-07 16:10:58 UTC
For the record, I think the solution from #c1 is good -- at least as an interim solution.  I suppose tasks done in postinst may intentionally leave processes running, e.g. as a result of restarting something and we don't want to kill those blindly.
Comment 7 Larry the Git Cow gentoo-dev 2019-01-09 04:08:57 UTC
The bug has been referenced in the following commit(s):

commit bbfc36befdeed60f29c17d80d7766fd0da402d61
Author:     Zac Medico <>
AuthorDate: 2019-01-08 04:45:52 +0000
Commit:     Zac Medico <>
CommitDate: 2019-01-08 09:12:11 +0000

    pid-sandbox: whitelist selected pkg_* phases (bug 673794)
    Whitelist the same phases that are whitelisted for FEATURES=cgroup,
    since pid-sandbox is less valuable and is likely to have unintended
    consenquences during these phases.
    Reviewed-by: Michał Górny <>
    Signed-off-by: Zac Medico <>

 lib/_emerge/   | 9 ++++++---
 lib/portage/package/ebuild/ | 8 ++++++--
 2 files changed, 12 insertions(+), 5 deletions(-)
Comment 8 Zac Medico gentoo-dev 2019-01-11 22:53:40 UTC
The bug has been referenced in the following commit(s):

commit 74047b184430a9d5a9e1862c75da8ae1ff60f7bf
Author:     Zac Medico <>
AuthorDate: 2019-01-10 20:51:45 -0800
Commit:     Zac Medico <>
CommitDate: 2019-01-10 20:56:31 -0800

    sys-apps/portage: version bump to 2.3.55
     #673794 pid-sandbox: whitelist selected pkg_* phases
    Package-Manager: Portage-2.3.55, Repoman-2.3.12
    Signed-off-by: Zac Medico <>

 sys-apps/portage/Manifest              |   1 +
 sys-apps/portage/portage-2.3.55.ebuild | 271 +++++++++++++++++++++++++++++++++
 2 files changed, 272 insertions(+)