2

Despite having a Requires= on a mount unit (run-netns-vpn.mount) systemd will start my service before the unit is active!?

[Unit]
Description=Sets up networking in VPN namespace
Requires=run-netns-vpn.mount
After=run-netns-vpn.mount

[Service]
Type=oneshot
WorkingDirectory=/usr/namespaces
ExecStart=/usr/namespaces/vpn-network-setup.sh

[Install]
WantedBy=multi-user.target

This is the status of the service depending on run-netns-vpn.mount:

vpn-ns-setup.service - Sets up networking in VPN namespace
   Loaded: loaded (/lib/systemd/system/vpn-ns-setup.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sun 2018-10-07 16:36:34 BST; 2min 46s ago
  Process: 762 ExecStart=/usr/namespaces/vpn-network-setup.sh (code=exited, status=1/FAILURE)
 Main PID: 762 (code=exited, status=1/FAILURE)

Oct 07 16:36:34 mediabox vpn-network-setup.sh[762]: + ip netns exec vpn ip rule add from 10.200.1.2 table 200
Oct 07 16:36:34 mediabox vpn-network-setup.sh[762]: Cannot open network namespace "vpn": No such file or directory
Oct 07 16:36:34 mediabox systemd[1]: vpn-ns-setup.service: Main process exited, code=exited, status=1/FAILURE
Oct 07 16:36:34 mediabox systemd[1]: vpn-ns-setup.service: Failed with result 'exit-code'.
Oct 07 16:36:34 mediabox systemd[1]: Failed to start Sets up networking in VPN namespace.

This is the status of run-netns-vpn.mount

● run-netns-vpn.mount - /run/netns/vpn
   Loaded: loaded
   Active: active (mounted) since Sun 2018-10-07 16:36:47 BST; 3min 52s ago
    Where: /run/netns/vpn
     What: nsfs

The service was started at 16:36:34 while the mount was loaded at 16:36:47. I would expect a) the service to wait for the mount b) to fail if it can't start.

For reference:

Linux mediabox 4.15.0-36-generic #39-Ubuntu SMP Mon Sep 24 16:19:09 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Why is this happening?

  • What is the output of systemctl cat run-netns-vpn.mount? Just mounting the nsfs filesystem to track network namespaces is not necessarily the same thing as actually creating the network namespace name "vpn": at least on Debian 9, the command ip netns add vpn will both create the namespace and mount the nsfs filesystem at the same time, so it's possible you don't need a dedicated mount unit for that. Just make sure /run/netns exists before running ip netns add! – telcoM Oct 7 '18 at 16:36
  • The output is No files found for run-netns-vpn.mount. I didn't create a mount file manually. The mount appears when the nfs is created using ip netns add vpn as part of a custom openvpn service (using --up). Unfortunately that service shows up as running a few seconds before actually making the tunnel and executing other scripts, so using Requires= on that doesn't work. – Panayiotis Oct 7 '18 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.