Bug 14401 - 5beta2: Shorewall not started - systemd[1]: Job shorewall.service/start deleted to break ordering cycle starting with mandi.service/start.
Summary: 5beta2: Shorewall not started - systemd[1]: Job shorewall.service/start delet...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: release_blocker major
Target Milestone: Mageia 5
Assignee: Colin Guthrie
QA Contact:
URL:
Whiteboard: 5beta2
Keywords: Triaged
Depends on:
Blocks: 14069
  Show dependency treegraph
 
Reported: 2014-10-28 16:57 CET by claire robinson
Modified: 2015-02-26 12:33 CET (History)
17 users (show)

See Also:
Source RPM: shorewall
CVE:
Status comment:


Attachments
journal-mga5dual32b2.txt (113.82 KB, text/plain)
2014-10-28 17:00 CET, claire robinson
Details
journal-5b1dual64b2.txt (50.32 KB, text/plain)
2014-10-28 17:32 CET, claire robinson
Details
shorewall.txt (2.73 KB, text/plain)
2015-01-12 15:17 CET, claire robinson
Details

Description claire robinson 2014-10-28 16:57:10 CET
Mga5 beta 1 dual dvd build 2 with default 64bit installation.
DATE: Mon Oct 27 21:53:54 CET 2014


Shorewall fails to start, shorewall6 is ok. The journal (attached) shows

systemd[1]: Job shorewall.service/start deleted to break ordering cycle starting with mandi.service/start.

Not noticed i586 install from the same dual dvd.





Reproducible: 

Steps to Reproduce:
claire robinson 2014-10-28 16:58:55 CET

Whiteboard: (none) => 5beta1
CC: (none) => ennael1

Comment 1 claire robinson 2014-10-28 17:00:12 CET
Created attachment 5549 [details]
journal-mga5dual32b2.txt
Comment 2 claire robinson 2014-10-28 17:03:34 CET
Oops wrong log.
Comment 3 claire robinson 2014-10-28 17:30:55 CET
Regrettably I didn't save the 64bit log before moving on. Performed a 64bit installation from classic dvd and shorewall is ok but performed another 64bit installation from the dualdvd and although the error has changed, shorewall again failed to start..

Another app is currently holding xtables lock. Perhaps you want to use -w option.
Error:Cannot to create Mangle chain fooX1373
Unit shorewall.service entered failed state
Comment 4 claire robinson 2014-10-28 17:32:25 CET
Created attachment 5550 [details]
journal-5b1dual64b2.txt

Journal from 2nd dual dvd 64bit install.

Attachment 5549 is obsolete: 0 => 1

Comment 5 claire robinson 2014-10-28 18:43:40 CET
Ironically on a 32bit kde install from i586 classic dvd..

systemd: Found ordering cycle on network-up.service/start
systemd: Breaking ordering cycle by deleting job mandi.service/start
systemd:Job mandi.service/start deleted to break ordering cycle starting with network-up.service/start
Comment 6 Manuel Hiebel 2014-11-01 19:09:30 CET
Oct 28 16:21:35 localhost shorewall[1287]: Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
Oct 28 16:21:36 localhost shorewall6[1288]: Compiling /usr/share/shorewall6/action.Reject for chain Reject...
Oct 28 16:21:36 localhost shorewall6[1288]: Creating ip6tables-restore input...
Oct 28 16:21:36 localhost shorewall6[1288]: Shorewall configuration compiled to /var/lib/shorewall6/.start
Oct 28 16:21:37 localhost shorewall[1287]: ERROR: Cannot Create Mangle chain fooX1373
Oct 28 16:21:37 localhost logger[1698]: ERROR:Shorewall start failed
Oct 28 16:21:37 localhost systemd[1]: shorewall.service: main process exited, code=exited, status=255/n/a
Oct 28 16:21:37 localhost systemd[1]: Failed to start Shorewall IPv4 firewall.
Oct 28 16:21:37 localhost systemd[1]: Unit shorewall.service entered failed state.

CC: (none) => alien, cooker, lmenut, luigiwalser, mageia, mageia, n54, olav, pterjan, thierry.vignaud, tmb
Keywords: (none) => Triaged

Comment 7 Marja Van Waes 2014-12-15 21:11:55 CET
(In reply to claire robinson from comment #5)
> Ironically on a 32bit kde install from i586 classic dvd..
> 
> systemd: Found ordering cycle on network-up.service/start
> systemd: Breaking ordering cycle by deleting job mandi.service/start
> systemd:Job mandi.service/start deleted to break ordering cycle starting
> with network-up.service/start

same with 5beta2 dual iso 32bits XFCE install
so shorewall service is inactive/dead

CC: (none) => marja11
Whiteboard: 5beta1 => 5beta2
Summary: 5beta1: Shorewall not started - systemd[1]: Job shorewall.service/start deleted to break ordering cycle starting with mandi.service/start. => 5beta2: Shorewall not started - systemd[1]: Job shorewall.service/start deleted to break ordering cycle starting with mandi.service/start.

Comment 8 Václav Nováček 2014-12-17 20:30:41 CET
I have similar problem on the same beta 1 x86_64 version.

pro 17 19:52:06 server2 systemd[1]: Found ordering cycle on network.target/start
pro 17 19:52:06 server2 systemd[1]: Breaking ordering cycle by deleting job network-up.service/start
pro 17 19:52:06 server2 systemd[1]: Job network-up.service/start deleted to break ordering cycle starting with network.target/start

Consequently system does not wait to start network (network-up service) and some network daemons (radvd, dhcp, dhcpd6) fails.

How can I find reason of cycle break?

CC: (none) => waclaw66

Comment 9 Václav Nováček 2014-12-17 20:57:49 CET
I find the way to debug systemd - kernel command: systemd.log_level=debug
Results are interrenting...

pro 17 20:49:48 server2 systemd[1]: Trying to enqueue job graphical.target/start/isolate
pro 17 20:49:48 server2 systemd[1]: Found ordering cycle on network.target/start
pro 17 20:49:48 server2 systemd[1]: Found dependency on network-up.service/start
pro 17 20:49:48 server2 systemd[1]: Found dependency on mandi.service/start
pro 17 20:49:48 server2 systemd[1]: Found dependency on shorewall.service/start
pro 17 20:49:48 server2 systemd[1]: Found dependency on network.target/start
pro 17 20:49:48 server2 systemd[1]: Breaking ordering cycle by deleting job network-up.service/start
pro 17 20:49:48 server2 systemd[1]: Job network-up.service/start deleted to break ordering cycle starting with network.target/start

How can I fix it?
Comment 10 AL13N 2014-12-19 19:33:50 CET
@coling: how to find cyclic dependencies for systemd?
Comment 11 Alex Loginov 2015-01-04 21:16:57 CET
Is shorewall-ipv6 installed? Nothing requires shorewall-ipv6, but in my tests shorewall service does not start without shorewall-ipv6 pkg.

CC: (none) => loginov_alex

Comment 12 claire robinson 2015-01-12 15:17:31 CET
Created attachment 5809 [details]
shorewall.txt

Valid after install from 5beta2 livedvd gnome 32 (so probably all).

Shorewall fails, shorewall6 starts, although there is no ipv6 connection. 

Attaching..
# journalctl -b | grep -i shorewall > /home/user/shorewall.txt
claire robinson 2015-01-12 15:17:51 CET

Blocks: (none) => 14069

claire robinson 2015-01-12 15:18:04 CET

Hardware: x86_64 => All

claire robinson 2015-02-05 22:47:21 CET

Priority: Normal => release_blocker

Colin Guthrie 2015-02-05 22:52:54 CET

Assignee: bugsquad => mageia

Colin Guthrie 2015-02-05 22:53:10 CET

Target Milestone: --- => Mageia 5

Comment 13 marc fanjoux 2015-02-25 08:52:28 CET
Mageia5 beta3 live dvd 32bit kde :

in boot.log :
"Ordering cycle found, skipping Shorewall IPv4 firewall"

and shorewall don't start.

CC: (none) => marcounet

Comment 14 Colin Guthrie 2015-02-25 11:52:12 CET
OK, so writing a native systemd unit for mandi seemed to solve this OK.

I also wrote one for the virtualbox guest addons as this was all in the same loop for me.

More native units = finer grained control.

I'll update both packages shortly.
Comment 15 Mageia Robot 2015-02-25 12:05:03 CET
commit 2b9752e8b64e8e3a556e0b2fc78f122578a5c9e1
Author: Colin Guthrie <colin@...>
Date:   Wed Feb 25 10:56:07 2015 +0000

    Replace init script with systemd unit (mga#14401)
---
 Commit Link:
   http://gitweb.mageia.org/software/mandi/commit/?id=2b9752e8b64e8e3a556e0b2fc78f122578a5c9e1
Comment 16 Colin Guthrie 2015-02-25 12:22:00 CET
Should be fixed in latest mandi and virtualbox packages once they hit the mirrors.
Comment 17 claire robinson 2015-02-25 12:27:12 CET
Thanks Col. We should start testing RC isos before long, so can test it then.
Comment 18 Rémi Verschelde 2015-02-26 11:09:28 CET
Fixed in Mageia 5 RC - round 1.

Status: NEW => RESOLVED
CC: (none) => remi
Resolution: (none) => FIXED

Comment 19 marc fanjoux 2015-02-26 12:33:19 CET
Fixed with the new mandi !

Note You need to log in before you can comment on or make changes to this bug.