Re: [gentoo-dev] eselect init

[Michał Górny]

On Sun, 26 May 2013 11:55:24 +0200
Luca Barbato <lu_zero@g.o> wrote:

> On 5/26/13 8:43 AM, Michał Górny wrote:
> > On Sat, 25 May 2013 11:54:48 +0200
> > Luca Barbato <lu_zero@g.o> wrote:
> >
> >> - /sbin/init (or whatever linux currently calls by default with top
> >> priority) should be either a symlink to the actual implementation or a
> >> wrapper such as our gcc one. I like better the latter since it is
> >> overall safer. The former might or might work since linux has some
> >> fallback capabilities but hadn't been tested.
> >
> > Increased complexity is never safer. And a wrapper means the additional
> > complexity gets there every boot. And considering how the discussion
> > goes, the wrapper will grow openrc-size in a few months...
>
> Openrc is small, but the wrapper really needs to know which is which and
> worst case switch inittab.

Switch inittab? Now you added really dangerous behavior to the wrapper
code. I can hardly even express this in words.

You are telling me that a wrapper, a thing that gets executed *every*
boot needs to do some random magic to know which init system was in use
and which one is supposed to be in use, and then conditionally move
around configuration files necessary for it to run. This is just
*INSANE*.

Did anyone notice already that moving stuff around actually requires
rootfs mounted R/W? Which means the wrapper needs to repeat a fair bit
of init/RC work.

And what will happen if moving the files fail? What if half of
configuration belongs to old init, and half to new? And it all happens
automagically on boot, on an incomplete system without any console
started, without Internet connection established and without any
serious mean of help.

> > Symlinks are simple. They're filesystem feature, they're handled
> > by kernel. The worst thing that could happen is symlink target
> > disappearing -- but then it's:
> >
> > a) our responsibility to make sure to call eselect-init (if applies)
> > when uninstalling an init system,
> >
> > b) something that would fail anyway if user did that by hand.
> >
> > Linux fallback mechanism is *good enough*. You may think that fallback
> > to sysvinit is good but it's not. *If* I have my system set up to boot
> > X, at some point the config for Y will get seriously outdated.
>
> Have you tested it? Do you know what is the reaction of do_exec on a
> dangling symlink?

And did you? You keep repeating this and jumping straight to developing
work-arounds without even waiting for an answer. And I think William
has already spoken that the code supports it.

In any case, I've just tested it. Replaced /sbin/init with a dangling
symlink, rebooted with init=/sbin/init and the kernel ran /bin/sh
as a fallback.

> > I use systemd for a few months now, and last time I checked openrc
> > boots somehow. But considering the general complexity of it, I wouldn't
> > be much surprised if it failed in funny ways (like not being able to
> > handle automounts properly), caused cruft on the filesystem or even
> > caused *damage*.
>
> openrc is *simpler* much *simpler* than systemd, stop with that.

OpenRC relies on a few layers of various tools plus a lot of init
scripts written by different people. Those init scripts include tasks
such as parsing configuration files (well, more of grepping them)
and manipulating runtime files. The complexity of OpenRC is the sum
of all that.

To make this point cleaner to you: what if the fallback ran systemd
instead? As in, init gets broken somehow and kernel falls back to
starting systemd on your unprepared OpenRC system. Is this a behavior
you'd like?

What I'm telling is: if user uses A as init system (and wanted to switch
to B), last thing he'd expect is C being started. Configuration for
OpenRC may be long unmaintained, may start services which are not
supposed to be started anymore and so on.

> > And since you've been failing long at keeping init.d scripts simple
> > and reasonable, the damage potential is not something purely
> > theoretical.
>
> wc -l is a good answer to your concern. Some scripts have to be
> simplified, that's a given (e.g. Fabio pointed the lvm one can be
> improved a lot) but it isn't the case for most of them.

We're not talking about percentages here. A *single* fragile script is
enough to cause trouble. Ten good ones won't revert it.

> > Pointless and overcomplex. If an init system actually fails to work
> > when /sbin/init doesn't point to it, it is seriously broken by design.
> > And because of that breakage, we keep stuff like 'telinit' or 'reboot'
> > intact, and because of it systemd has 'pass-through' mode when linked
> > to /sbin/init.
>
> Check your facts, systemd either understands a flavour of inittab or the
> other or none at all.

What are you talking about now? I was just saying that *if* you
link /sbin/init to systemd, and you're running sysvinit, 'init foo'
will be passed through to telinit.

But now I see that I was wrong and it actually happened when
'systemctl' was symlinked to 'init'. Nevermind then.

In any case, keeping all the tools like 'telinit' should be *enough* to
keep the current init running and rebooting.

> > Which means the kernel fallback will be dangerously active
> > as I explained before. Just don't do it.
>
> It is not dangerous beside for those that have an inittab with rm -fR /

n/c

-- 
Best regards,
Michał Górny