From 566436f1c67ef2e31a178d4b73d222f92d5e44f0 Mon Sep 17 00:00:00 2001 From: Ivan Kruglov Date: Thu, 3 Sep 2026 10:09:32 -0700 Subject: [PATCH] core: don't exit 0 when a failure action has nothing to propagate FailureAction=exit propagates the exit status of the unit's main process. When there is none, emergency_action() left m->return_value at its initial 0, so the manager exited 0 for a unit that failed. Whoever supervises it, e.g. a container manager, then can't tell this apart from an orderly shutdown. There is no status to propagate whenever the unit type has no notion of a main process (only .service has), or the unit failed before any of its processes ran, say because its cgroup couldn't be created. StartLimitAction= and JobTimeoutAction= never have one at all. Fixes: https://github.com/systemd/systemd/issues/43645 --- src/core/emergency-action.c | 9 +++++++++ src/core/emergency-action.h | 3 ++- src/core/job.c | 2 +- src/core/unit.c | 4 ++-- 4 files changed, 14 insertions(+), 4 deletions(-) diff --git a/src/core/emergency-action.c b/src/core/emergency-action.c index 181da27f7a..8f0dc422ad 100644 --- a/src/core/emergency-action.c +++ b/src/core/emergency-action.c @@ -4,6 +4,7 @@ #include "ansi-color.h" #include "emergency-action.h" +#include "exit-status.h" #include "manager.h" #include "reboot-util.h" #include "special.h" @@ -154,6 +155,10 @@ void emergency_action( if (exit_status >= 0) m->return_value = exit_status; + else if (FLAGS_SET(flags, EMERGENCY_ACTION_IS_FAILURE) && m->return_value == EXIT_SUCCESS) + /* Nothing to propagate, but we act on a failure: don't report success. An exit + * status set explicitly via SetExitCode() stays. */ + m->return_value = EXIT_EXCEPTION; if (MANAGER_IS_USER(m) || detect_container() > 0) { log_and_status(m, action, flags, "Exiting", reason); @@ -173,6 +178,10 @@ void emergency_action( if (exit_status >= 0) m->return_value = exit_status; + else if (FLAGS_SET(flags, EMERGENCY_ACTION_IS_FAILURE) && m->return_value == EXIT_SUCCESS) + /* Nothing to propagate, but we act on a failure: don't report success. An exit + * status set explicitly via SetExitCode() stays. */ + m->return_value = EXIT_EXCEPTION; if (MANAGER_IS_USER(m) || detect_container() > 0) { log_and_status(m, action, flags, "Exiting immediately", reason); diff --git a/src/core/emergency-action.h b/src/core/emergency-action.h index 17f306507f..3d9029414b 100644 --- a/src/core/emergency-action.h +++ b/src/core/emergency-action.h @@ -29,7 +29,8 @@ typedef enum EmergencyActionFlags { EMERGENCY_ACTION_IS_WATCHDOG = 1 << 0, /* this action triggered by a watchdog or other kind of timeout */ EMERGENCY_ACTION_WARN = 1 << 1, /* log at LOG_WARNING + write to system console */ EMERGENCY_ACTION_SLEEP_5S = 1 << 2, /* wait 5s before executing action; only honoured together with EMERGENCY_ACTION_WARN */ - _EMERGENCY_ACTION_FLAGS_MAX = (1 << 3) - 1, + EMERGENCY_ACTION_IS_FAILURE = 1 << 3, /* this action is triggered by a failure, hence must not make us exit 0 */ + _EMERGENCY_ACTION_FLAGS_MAX = (1 << 4) - 1, } EmergencyActionFlags; void emergency_action( diff --git a/src/core/job.c b/src/core/job.c index 2388d1de95..70e14b517f 100644 --- a/src/core/job.c +++ b/src/core/job.c @@ -1141,7 +1141,7 @@ static int job_dispatch_timer(sd_event_source *s, uint64_t monotonic, void *user emergency_action( u->manager, u->job_timeout_action, - EMERGENCY_ACTION_IS_WATCHDOG|EMERGENCY_ACTION_WARN|EMERGENCY_ACTION_SLEEP_5S, + EMERGENCY_ACTION_IS_WATCHDOG|EMERGENCY_ACTION_WARN|EMERGENCY_ACTION_SLEEP_5S|EMERGENCY_ACTION_IS_FAILURE, u->job_timeout_reboot_arg, /* exit_status= */ -1, "job timed out"); diff --git a/src/core/unit.c b/src/core/unit.c index 44d5c8dea9..28a4af186b 100644 --- a/src/core/unit.c +++ b/src/core/unit.c @@ -1888,7 +1888,7 @@ int unit_test_start_limit(Unit *u) { emergency_action( u->manager, u->start_limit_action, - EMERGENCY_ACTION_IS_WATCHDOG|EMERGENCY_ACTION_WARN|EMERGENCY_ACTION_SLEEP_5S, + EMERGENCY_ACTION_IS_WATCHDOG|EMERGENCY_ACTION_WARN|EMERGENCY_ACTION_SLEEP_5S|EMERGENCY_ACTION_IS_FAILURE, u->reboot_arg, /* exit_status= */ -1, reason); @@ -2844,7 +2844,7 @@ void unit_notify(Unit *u, UnitActiveState os, UnitActiveState ns, bool reload_su if (os != UNIT_FAILED && ns == UNIT_FAILED) { reason = strjoina("unit ", u->id, " failed"); - emergency_action(m, u->failure_action, EMERGENCY_ACTION_WARN|EMERGENCY_ACTION_SLEEP_5S, u->reboot_arg, unit_failure_action_exit_status(u), reason); + emergency_action(m, u->failure_action, EMERGENCY_ACTION_WARN|EMERGENCY_ACTION_SLEEP_5S|EMERGENCY_ACTION_IS_FAILURE, u->reboot_arg, unit_failure_action_exit_status(u), reason); } else if (!UNIT_IS_INACTIVE_OR_FAILED(os) && ns == UNIT_INACTIVE) { reason = strjoina("unit ", u->id, " succeeded"); emergency_action(m, u->success_action, /* flags= */ 0, u->reboot_arg, unit_success_action_exit_status(u), reason);