From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp2 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms11 with LMTPS id aw5cIa0m419/FgAA0tVLHw (envelope-from ) for ; Wed, 23 Dec 2020 11:14:53 +0000 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp2 with LMTPS id 2BjFHK0m41/gOAAAB5/wlQ (envelope-from ) for ; Wed, 23 Dec 2020 11:14:53 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 4FF2F9402A8 for ; Wed, 23 Dec 2020 11:14:52 +0000 (UTC) Received: from localhost ([::1]:50244 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ks26U-0008K0-7T for larch@yhetil.org; Wed, 23 Dec 2020 06:14:50 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:54396) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ks26G-0008If-M8 for help-guix@gnu.org; Wed, 23 Dec 2020 06:14:36 -0500 Received: from uggla.sjd.se ([2001:9b1:8633::107]:43156) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ks268-0002F0-0V for help-guix@gnu.org; Wed, 23 Dec 2020 06:14:36 -0500 DKIM-Signature: v=1; a=ed25519-sha256; q=dns/txt; c=relaxed/relaxed; d=josefsson.org; s=ed20b09; h=Content-Type:MIME-Version:Message-ID:Date: Subject:To:From:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=iSjHauGktkxfPM0xsqqFvIF0X8AzQrxI0mc7KnTUxnE=; b=4usYu99q+gA62XgL4fIWYpYcM0 b878NxLdP/SXYcAEXhxhX8XhQxf/GJlcAYhysRjeZUKTs5DVBYY0NphjWlAg==; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=josefsson.org; s=rsa20b09; h=Content-Type:MIME-Version:Message-ID:Date: Subject:To:From:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=iSjHauGktkxfPM0xsqqFvIF0X8AzQrxI0mc7KnTUxnE=; b=A+GlZsh6KlsC2ZaJnZT2H53STO G7zPT06LnCqrzqVqMg/KiyRTFHSeGzm24ZqRDHvnlnMSJoM7d6b5t3b0nuN+pljcMvqROh2VbW3ht kRkDKEDnCeg94H2P326+3wDhp/ocECuwX147qSEwyC6MY85kVb86F1MQCzFuvzstcTkW/6vAkHmOx I0YdEaq27OHyfDtrRurjyqxdPbp93dj0YSqSPhjgsstERiom3fRe0oZAvgoo1LRJh1mQMBz5/1+Rx qLApbUMnn7yXbYYmEgtPx++faz7nivTUpzwhcjdlrjFUST0AVL8hM4bHj4+yMTc5RFOEpp8eDvvOp BIQ/O23MvjMjrUPIQmLUh6Zl9Qh1RChFi6uV9SjsQFMBLJaC3quZbZO7uReVCrf296C+upsbIyCcH lQBmeTtTisVcsrZ3QdMaRkhM9MdKjObsB4oTeLUBYHPLK; Received: from 31-208-42-58.cust.bredband2.com ([31.208.42.58]:58778 helo=latte) by uggla.sjd.se with esmtpsa (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1ks260-0007xj-N2 for help-guix@gnu.org; Wed, 23 Dec 2020 11:14:20 +0000 X-Hashcash: 1:22:201223:help-guix@gnu.org::fVPZiK+mQwMavjiL:8VSg To: help-guix@gnu.org Subject: Ideas for unattened-upgrades 1) auto service restarts, 2) reboot when needed OpenPGP: id=B1D2BD1375BECB784CF4F8C4D73CF638C53C06BE; url=https://josefsson.org/key-20190320.txt Date: Wed, 23 Dec 2020 12:14:20 +0100 Message-ID: <87o8iksrjn.fsf@latte.josefsson.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" X-uggla-rspamd: -- Score: -2.7 Action: no action Symbol: ARC_NA(0.00) Symbol: RCVD_VIA_SMTP_AUTH(0.00) Symbol: FROM_HAS_DN(0.00) Symbol: TO_MATCH_ENVRCPT_ALL(0.00) Symbol: R_MISSING_CHARSET(2.50) Symbol: MIME_GOOD(-0.20) Symbol: TO_DN_NONE(0.00) Symbol: RCPT_COUNT_ONE(0.00) Symbol: RCVD_COUNT_ONE(0.00) Symbol: SIGNED_PGP(-2.00) Symbol: FROM_EQ_ENVFROM(0.00) Symbol: MIME_TRACE(0.00) Symbol: ASN(0.00) Symbol: RCVD_TLS_ALL(0.00) Symbol: BAYES_HAM(-3.00) Message-ID: 87o8iksrjn.fsf@latte.josefsson.org Received-SPF: pass client-ip=2001:9b1:8633::107; envelope-from=simon@josefsson.org; helo=uggla.sjd.se X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: help-guix@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: help-guix-bounces+larch=yhetil.org@gnu.org Sender: "Help-Guix" Reply-to: Simon Josefsson From: Simon Josefsson via X-Migadu-Flow: FLOW_IN X-Migadu-Spam-Score: -2.42 Authentication-Results: aspmx1.migadu.com; dkim=fail (headers eddsa verify failed) header.d=josefsson.org header.s=ed20b09 header.b=4usYu99q; dkim=fail (headers rsa verify failed) header.d=josefsson.org header.s=rsa20b09 header.b=A+GlZsh6; dmarc=pass (policy=none) header.from=gnu.org; spf=pass (aspmx1.migadu.com: domain of help-guix-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=help-guix-bounces@gnu.org X-Migadu-Queue-Id: 4FF2F9402A8 X-Spam-Score: -2.42 X-Migadu-Scanner: scn1.migadu.com X-TUID: /RByiNSxjGkW --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Thank you for unattended-upgrades! Something like it has been my main concern preventing deploying Guix on Internet-facing production machines. After using it for a while two things strikes me as useful improvements: 1) Automatically restarting all services. I manually specified mcron, ntpd and ssh-daemon as the services to restart, but this is not user friendly. I just noticed I forgot syslogd, nscd, guix-daemon and a bunch of others. Two ideas for improvements, mostly intended as food for discussion: 1.a) Have an option that run 'herd restart X' for all of the running services, probably except for some well-known system services that do not have running processes related to them anyway. I experimented with restarting all services mentioned by 'herd status', but some do not like to be restarted (maybe this is a separate issue?): root@hamster ~# herd restart device-mapping-/dev/md1 Service device-mapping-/dev/md1 has been stopped. Service device-mapping-/dev/md1 could not be started. root@hamster ~# herd start device-mapping-/dev/md1 Service device-mapping-/dev/md1 could not be started. herd: failed to start service device-mapping-/dev/md1 root@hamster ~#=20 The device was still present and the filesystem on it was mounted. Further experimentation suggests the following should be excluded: device-mapping* file-system* root*. However, restarting some of others (including 'udev' and 'urandom-seed') restarts almost everything else so it is a bit wasteful. What do you think of this approach? It would be a loop doing 'herd restart X' on the service mentioned by 'herd status' except for some well-known services. Naturally, this should not be the default for now, but require a new unattended-upgrades variable, e.g. 'services-restart-all' set to true. 1.b) Look at te running processes on the system, and figure out which services started each, and restart each such service. I don't know if this is easily done. 2) Some upgrades requires a reboot for the effects to take place. At least this appears to includes the kernel and the transitive closure of all libraries and binaries involved in shepherd (pid 1). Libc upgrades are probably possible to handle in user-space (except for sheperd) but I believe other distributions reboot the machine on libc upgrades too. Unattended-upgrades could be extended with a list of packages that it should trigger a reboot for when they are upgraded. Probably this should also not be the default for now, but require another variable, e.g., 'reboot-when-needed' set to true. Btw, Happy holidays! /Simon --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEARYIAB0WIQSjzJyHC50xCrrUzy9RcisI/kdFogUCX+MmjAAKCRBRcisI/kdF opMgAQCO2YZVprXGQBlSCvdpYQq0rXTONoGHWsLgBR6XS//dkQEA4KPk4vRVFyof 6aFQMbjAWs5y78F92fmQcBQsnBc3ngI= =hsSC -----END PGP SIGNATURE----- --=-=-=--