From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from tb-mx0.topicbox.com (localhost.local [127.0.0.1]) by tb-mx0.topicbox.com (Postfix) with ESMTP id 1A948207FBF0 for ; Fri, 26 Jul 2024 10:05:29 -0400 (EDT) (envelope-from peter.tribble@gmail.com) Received: from tb-mx0.topicbox.com (localhost [127.0.0.1]) by tb-mx0.topicbox.com (Authentication Milter) with ESMTP id 26A9C1D2D11; Fri, 26 Jul 2024 10:05:29 -0400 ARC-Seal: i=1; a=rsa-sha256; cv=none; d=topicbox.com; s=arcseal; t= 1722002729; b=yzNA+GlrXrYOVsu/9ZgBsKR2INuqagA3w5+GEBaGXJBzxXvEuW RqpM2aL4oqRCe78vIWYQ/L++s5p4NnhvHV05drU7UCKzpLFZtq6tkyoaCkpYzSKX JcY75DHEpesvASz4TjkjUNBc07d1x79qPQak1vhNcQCD2OD1hBgwclalwWXXO/cV wnPz214Yr7bPGrC4OlQKM5rGYVIDVVlTXo3L97p4cO94/K+SupIJ/R+BoDbUSVUe vUWNZmNT0dRo143h2nmOXwE9+XlekCJ7R/mkktSpgta/vsNW2vdi/ZaJ6db6CI9R wswoFL6Zayzbn3X5BXkl75BonhKllAgtmynA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= topicbox.com; h=mime-version:references:in-reply-to:from:date :message-id:subject:to:content-type; s=arcseal; t=1722002729; bh=5S+nJY1OjhP7sa6fzJM+lhyVISXjYqhYbqAJBmH7KUk=; b=iBHbKbr08+LO X/QA9HDsZ0ts+IUGYRmn5RnVaUb5sE8LFm7J//Iwv4xe1+npamIEm4B1ev1VZmvj GoidV4y3i4edj2nZz93vY+yt6npm3Qp812l+CopbGlD7WLJP2M3XJD0HjuUCi6vG AbJw+pHTGWyevV9C6UxjCkz7b9e+X68kad+wb/Ovo2J/Xs48ZRnDCxY71Clc+i4X d6vbwTT5XjpqHGSaSfqKPi4Dz0bGok2SfkOdru/45OjNWTEYWucQtO/9iphbMvCs QfnCmjyPASjmB2fRCEDuIX89ppLAzImtOUGrPBK7zqjnJhIuEZJ0SItbR3ak0xZv hTLrETnULA== ARC-Authentication-Results: i=1; tb-mx0.topicbox.com; arc=none (no signatures found); bimi=skipped (DMARC Policy is not at enforcement); dkim=pass (2048-bit rsa key sha256) header.d=gmail.com header.i=@gmail.com header.b=YFXKfC7H header.a=rsa-sha256 header.s=20230601 x-bits=2048; dmarc=pass policy.published-domain-policy=none policy.published-subdomain-policy=quarantine policy.applied-disposition=none policy.evaluated-disposition=none (p=none,sp=quarantine,d=none,d.eval=none) policy.policy-from=p header.from=gmail.com; iprev=pass smtp.remote-ip=209.85.160.44 (mail-oa1-f44.google.com); spf=pass smtp.mailfrom=peter.tribble@gmail.com smtp.helo=mail-oa1-f44.google.com; x-aligned-from=pass (Address match); x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=m5WyDl+7; x-me-sender=none; x-ptr=pass smtp.helo=mail-oa1-f44.google.com policy.ptr=mail-oa1-f44.google.com; x-return-mx=pass header.domain=gmail.com policy.is_org=yes (MX Records found: alt2.gmail-smtp-in.l.google.com,alt1.gmail-smtp-in.l.google.com,gmail-smtp-in.l.google.com,alt3.gmail-smtp-in.l.google.com,alt4.gmail-smtp-in.l.google.com); x-return-mx=pass smtp.domain=gmail.com policy.is_org=yes (MX Records found: alt2.gmail-smtp-in.l.google.com,alt1.gmail-smtp-in.l.google.com,gmail-smtp-in.l.google.com,alt3.gmail-smtp-in.l.google.com,alt4.gmail-smtp-in.l.google.com); x-tls=pass smtp.version=TLSv1.2 smtp.cipher=ECDHE-RSA-AES256-GCM-SHA384 smtp.bits=256/256; x-vs=clean score=-51 state=0 Authentication-Results: tb-mx0.topicbox.com; arc=none (no signatures found); bimi=skipped (DMARC Policy is not at enforcement); dkim=pass (2048-bit rsa key sha256) header.d=gmail.com header.i=@gmail.com header.b=YFXKfC7H header.a=rsa-sha256 header.s=20230601 x-bits=2048; dmarc=pass policy.published-domain-policy=none policy.published-subdomain-policy=quarantine policy.applied-disposition=none policy.evaluated-disposition=none (p=none,sp=quarantine,d=none,d.eval=none) policy.policy-from=p header.from=gmail.com; iprev=pass smtp.remote-ip=209.85.160.44 (mail-oa1-f44.google.com); spf=pass smtp.mailfrom=peter.tribble@gmail.com smtp.helo=mail-oa1-f44.google.com; x-aligned-from=pass (Address match); x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=m5WyDl+7; x-me-sender=none; x-ptr=pass smtp.helo=mail-oa1-f44.google.com policy.ptr=mail-oa1-f44.google.com; x-return-mx=pass header.domain=gmail.com policy.is_org=yes (MX Records found: alt2.gmail-smtp-in.l.google.com,alt1.gmail-smtp-in.l.google.com,gmail-smtp-in.l.google.com,alt3.gmail-smtp-in.l.google.com,alt4.gmail-smtp-in.l.google.com); x-return-mx=pass smtp.domain=gmail.com policy.is_org=yes (MX Records found: alt2.gmail-smtp-in.l.google.com,alt1.gmail-smtp-in.l.google.com,gmail-smtp-in.l.google.com,alt3.gmail-smtp-in.l.google.com,alt4.gmail-smtp-in.l.google.com); x-tls=pass smtp.version=TLSv1.2 smtp.cipher=ECDHE-RSA-AES256-GCM-SHA384 smtp.bits=256/256; x-vs=clean score=-51 state=0 X-ME-VSCause: gggruggvucftvghtrhhoucdtuddrgeeftddrieehgdejgecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpggftfghnshhusghstghrihgsvgdpuffr tefokffrpgfnqfghnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnth hsucdlqddutddtmdenogfuuhhsphgvtghtffhomhgrihhnucdlgeelmdenucfjughrpegg fhgjhfffkffuvfgtsegrtderredttdejnecuhfhrohhmpefrvghtvghrucfvrhhisggslh gvuceophgvthgvrhdrthhrihgssghlvgesghhmrghilhdrtghomheqnecuggftrfgrthht vghrnhepteduheevfeejheeuheelfeeliefffeevfeejhfeitefffedvkeeiveeugedtud elnecuffhomhgrihhnpehilhhluhhmohhsrdhorhhgpdhpvghtvghrthhrihgssghlvgdr tghordhukhdpsghlohhgshhpohhtrdgtohhmnecukfhppedvtdelrdekhedrudeitddrge egnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepvddtledrkeeh rdduiedtrdeggedphhgvlhhopehmrghilhdqohgruddqfheggedrghhoohhglhgvrdgtoh hmpdhmrghilhhfrhhomhepoehpvghtvghrrdhtrhhisggslhgvsehgmhgrihhlrdgtohhm qedpnhgspghrtghpthhtohepuddprhgtphhtthhopeeouggvvhgvlhhophgvrheslhhish htshdrihhllhhumhhoshdrohhrgheq X-ME-VSScore: -51 X-ME-VSCategory: clean Received-SPF: pass (gmail.com ... _spf.google.com: Sender is authorized to use 'peter.tribble@gmail.com' in 'mfrom' identity (mechanism 'include:_netblocks.google.com' matched)) receiver=tb-mx0.topicbox.com; identity=mailfrom; envelope-from="peter.tribble@gmail.com"; helo=mail-oa1-f44.google.com; client-ip=209.85.160.44 Received: from mail-oa1-f44.google.com (mail-oa1-f44.google.com [209.85.160.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by tb-mx0.topicbox.com (Postfix) with ESMTPS for ; Fri, 26 Jul 2024 10:05:28 -0400 (EDT) (envelope-from peter.tribble@gmail.com) Received: by mail-oa1-f44.google.com with SMTP id 586e51a60fabf-260f1664fdfso779406fac.1 for ; Fri, 26 Jul 2024 07:05:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1722002728; x=1722607528; darn=lists.illumos.org; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :from:to:cc:subject:date:message-id:reply-to; bh=5S+nJY1OjhP7sa6fzJM+lhyVISXjYqhYbqAJBmH7KUk=; b=YFXKfC7HNhVRHqmENfYeHKX3Yo1SWormIusta3zAAh65YI+bnP+dE5qsWGpoku1NKV QsfHrfX0HYDGDG683U4Hohp2DJhIdd1z/NwoaOYdgvUOIX0FsAeZzLksPmmAnkC3zV4L 6uPsfH9UBKRAUa42MzHsr9REeRLWSHZQt0AK/2FlwQ8hT6c5VZ1L/emp/WD7ZgRx4P14 AuxMn//xmLAgxdzyZdsl2FHDwFj/H58CEM42zbHMHrOPeg5JlhoyKgpRaZ3f4Rs+n4kL itQsiJZ3N7f9Dy4hBjEFHJ9FlDkG9R4Z9dzTMbMCzFI0t4KPtLt4RX4OHBh3wbbYgB9F ytDA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1722002728; x=1722607528; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=5S+nJY1OjhP7sa6fzJM+lhyVISXjYqhYbqAJBmH7KUk=; b=m5WyDl+78HqXe6/rKINv+Hu7KFy0Es3s5FT614TcjzaUKf8MB/0kfHz8YTTEzSJpY/ Dp6BsMJSOPivaCCknvPkhSuGpngAigw7TRATmUkoJpRrQp6g5pKYABhCk1tXodmcHHN1 DySXffXB3K2nB+GbgOwzBmFxg4R5kSCK+rHjzxzWIsx386Rcwz5eCewLZ6Nu4loQNrXp YFOXG5xAvY9eC0E0R/hdmvZ1Z0W74QHFFkJ8IJIqPSS3fWpVnjJLG4z1NM7hVUqvHxuQ z9fRvwzdotquiwcavdkfqgwXLPjCR1pY2TObG9Z8KpZCteyjkQdTeVdi4/TLdRCvWzlE quUg== X-Gm-Message-State: AOJu0YyR2S+GEk9bUP3tdQsqoat/SL2B2kC9we1FTdO1dZrrV4gkcJM0 IrQsK8kghsBuS4IhdgOvcD31XTxr2RTNZ/39EFbO6UrvPJA1fJQ/hMVVLLMh/InVTVviXlkOEN1 LtOn7J2HtV1xB7D/esjFT4EKgFGWd21w= X-Google-Smtp-Source: AGHT+IF8vU0LyyQsv27Znr43PgZ250nnsD0NBVmrOhC5SxoojvixbcE4Qo6oPijEYhSBoCe+5lpfSJDoY0dY/uqUam0= X-Received: by 2002:a05:6870:d1c9:b0:261:39d:afa1 with SMTP id 586e51a60fabf-266cc36dd63mr6055226fac.22.1722002727696; Fri, 26 Jul 2024 07:05:27 -0700 (PDT) MIME-Version: 1.0 References: <20240726082032.GA10040@reaper.citrus-it.net> In-Reply-To: From: Peter Tribble Date: Fri, 26 Jul 2024 15:05:15 +0100 Message-ID: Subject: Re: [developer] Review - 15665 svc:/network/loopback exits successfully even if it fails To: illumos-developer Content-Type: multipart/alternative; boundary="000000000000e2ffca061e270034" Topicbox-Policy-Reasoning: allow: sender is a member Topicbox-Message-UUID: 203a352c-4b58-11ef-bbb6-acab068c7b06 --000000000000e2ffca061e270034 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Jul 26, 2024 at 2:41=E2=80=AFPM Toomas Soome via illumos-developer = < developer@lists.illumos.org> wrote: > > > On 26. Jul 2024, at 15:44, Peter Tribble wrote: > > On Fri, Jul 26, 2024 at 9:21=E2=80=AFAM Andy Fiddaman > wrote: > >> Please can you review the following change? >> >> 15665 svc:/network/loopback exits successfully even if it fails >> https://www.illumos.org/issues/15665 >> https://code.illumos.org/c/illumos-gate/+/3610 >> > > When this first came up I expressed my belief that making this change is > the wrong > thing to do, and I'll express it again. > > If this service fails, I think the best thing to do is drive on so that > the system can come > up as far as possible to maximise the chance that the system comes up far > enough for > an administrator to be able to get in and fix it. Not putting the service > into maintenance > is a feature, not a bug. > > (If it fails, then there's something deeper wrong with the system, and > those fundamental > causes should be dealt with.) > > I think generally it would be wrong for a single voice to veto any change= , > which means I > would generally be uncomfortable sticking a -1 on it, but if this does ge= t > into the gate > it will be reverted in Tribblix. > > > hm, ok, you mean that service startup error in case of network/loopback > will block too many other services? but then again, if there is an error, > those depending services are also not functional, aren't they? Otherwise > those depending services should not depend on network/loopback ;) > Well yes, the whole thing gets completely blocked. If it's a cloud or remote server, it won't boot, and if you don't have console access (which isn't universal) then the system is a total loss. One of the issues is that SMF doesn't have a very rich vocabulary for service states or dependencies - it's very much black and white. And this is a case where you would normally want loopback to be up (I think many users and applications make unstated assumptions here, although actually quite a lot is completely unaffected if the loopback isn't up), and you definitely want it up *before* the other applications - and generally for loopback it's the ordering that's important. So when everything is working the dependency is correct. When something goes wrong, though, in many cases what you want is to carry on, so that as much as possible works and you get a chance to fix it. So what I see missing here is some way of exposing that the service has an error, without bluntly dropping it into maintenance and killing all the dependent services with it. --=20 -Peter Tribble http://www.petertribble.co.uk/ - http://ptribble.blogspot.com/ --000000000000e2ffca061e270034 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Jul 26, 2024 at 2:41=E2=80=AF= PM Toomas Soome via illumos-developer <developer@lists.illumos.org> wrote:


O= n 26. Jul 2024, at 15:44, Peter Tribble <peter.tribble@gmail.com> wrote:
<= br>
=
On Fri, Jul 26, 2024 at 9:21=E2=80=AFAM Andy Fid= daman <illumos= @fiddaman.net> wrote:
Please can you review the following= change?

=C2=A0 =C2=A0 15665 svc:/network/loopback exits successfully even if it fai= ls
=C2=A0 =C2=A0 https://www.illumos.org/issues/15665
=C2=A0 =C2=A0 https://code.illumos.org/c/illumos-gate/= +/3610

When this first ca= me up I expressed my belief that making this change is the wrong
t= hing to do, and I'll express it again.

If this service fai= ls, I think the best thing to do is drive on so that the system can comeup as far as possible to maximise the chance that the system comes u= p far enough for
an administrator to be able to get in and fix it.= Not putting the service into maintenance
is a feature, not a bug.=

(If it fails, then there's something deeper wrong with th= e system, and those fundamental
causes should be dealt with.)
<= br>I think generally it would be wrong for a single voice to veto any= change, which means I
would generally be uncomfortable sticking a= -1 on it, but if this does get into the gate
it will be reverted = in Tribblix.


hm, ok, y= ou mean that service startup error in case of network/loopback will block t= oo many other services? but then again, if there is an error, those dependi= ng services are also not functional, aren't they? Otherwise those depen= ding services should not depend on network/loopback ;)

Well yes, the whole thing gets completely blocked. = If it's a cloud or remote server,
it won't boot, and if you don&= #39;t have console access (which isn't universal) then the
system is a total loss.

One of the issues is that SMF d= oesn't have a very rich vocabulary for service states
or = dependencies - it's very much black and white. And this is a case where= you would
normally want loopback to be up (I think many user= s and applications make unstated
assumptions here, although actually qui= te a lot is completely unaffected if the loopback
isn't up), and you= definitely want it up *before* the other applications - and generally for<= br>
loopback it's the ordering that's important. So when = everything is working the dependency
is correct.

When something goes wrong, though, in many cases what you want is to = carry on, so
that as much as possible works and you get a cha= nce to fix it. So what I see missing
here is some way of expo= sing that the service has an error, without bluntly dropping it into
maintenance and killing all the dependent services with it.

=
--
-Peter Tribble
http://www.petertribble.co.uk/ -= http://ptribbl= e.blogspot.com/
--000000000000e2ffca061e270034--