Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Eliminate race condition with qubes-setup-dnat-to-ns

Browse Source 
qubes-setup-dnat-to-ns is called multiple times during boot.  Of particular interest are the two invocations done by:

1. `/usr/lib/qubes/init/network-proxy.setup.sh` (`qubes-network.service`)
2. `/usr/lib/qubes/init/misc-post.sh` (`qubes-misc-post.service`)

These can, and do often, run in parallel.  Often enough that the `PR-QBS` `nat` chain can end up with eight rules instead of four, or (worse) zero rules.

This commit represents the proper boot ordering of these services, where the post startup *must* happen after Qubes has already started its iptables, firewall, network setup and netwatcher.

This eliminates the race.
This commit is contained in:
Rudd-O 2016-10-12 15:19:46 +00:00 committed by GitHub
parent dd30d91375
commit b7d8d66bb1
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
vm-systemd/qubes-misc-post.service
View File

@ -1,6 +1,6 @@
[Unit] [Unit]
Description=Qubes misc post-boot actions Description=Qubes misc post-boot actions
After=network-pre.target qubes-dvm.service qubes-mount-dirs.service After=network-pre.target qubes-dvm.service qubes-mount-dirs.service qubes-network.service qubes-firewall.service qubes-netwatcher.service
[Service] [Service]
Type=oneshot Type=oneshot