Refuse to start with chroot set in a systemd env

Closes #4848

diff --git a/docs/markdown/authoritative/settings.md b/docs/markdown/authoritative/settings.md
index bf5bef67d68b41b5a765ca023d601e9dd278e8ab..c49f1ab9d077556c52e51029e9f5a273a9bf2063 100644 (file)
--- a/docs/markdown/authoritative/settings.md
+++ b/docs/markdown/authoritative/settings.md
@@ -142,6 +142,9 @@ When setting `chroot`, all other paths in the config (except for
 [`config-dir`](#config-dir) and [`module-dir`](#module-dir)) set in the configuration
 are relative to the new root.
 
+When running on a system where systemd manages services, `chroot` does not work out of the box, as PowerDNS cannot use the `NOTIFY_SOCKET`.
+Either don't `chroot` on these systems or set the 'Type' of the this service to 'simple' instead of 'notify' (refer to the systemd documentation on how to modify unit-files)
+
 ## `config-dir`
 * Path
 

diff --git a/docs/markdown/recursor/settings.md b/docs/markdown/recursor/settings.md
index 95f4b57aa598f8883c330ad77eabc58825ea62f3..5e242458f014624015c7f4723deeb3ed86512578 100644 (file)
--- a/docs/markdown/recursor/settings.md
+++ b/docs/markdown/recursor/settings.md
@@ -129,6 +129,9 @@ in the configuration are relative to the new root.
 When using `chroot` and the API ([`webserver`](#webserver)), [`api-readonly`](#api-readonly)
 must be set and [`api-config-dir`](#api-config-dir) unset.
 
+When running on a system where systemd manages services, `chroot` does not work out of the box, as PowerDNS cannot use the `NOTIFY_SOCKET`.
+Either do not `chroot` on these systems or set the 'Type' of this service to 'simple' instead of 'notify' (refer to the systemd documentation on how to modify unit-files)
+
 ## `client-tcp-timeout`
 * Integer
 * Default: 2

diff --git a/pdns/common_startup.cc b/pdns/common_startup.cc
index 66f06fcdcb25bbbf71f476a37e202104cdb5dae6..13b7860ff727dff424c8ddca9487d238e33ab0e6 100644 (file)
--- a/pdns/common_startup.cc
+++ b/pdns/common_startup.cc
@@ -498,6 +498,14 @@ void mainthread()
    stubParseResolveConf();
 
    if(!::arg()["chroot"].empty()) {
+#ifdef HAVE_SYSTEMD
+     char *ns;
+     ns = getenv("NOTIFY_SOCKET");
+     if (ns != nullptr) {
+       L<<Logger::Error<<"Unable to chroot when running from systemd. Please disable chroot= or set the 'Type' for this service to 'simple'"<<endl;
+       exit(1);
+     }
+#endif
      triggerLoadOfLibraries();
      if(::arg().mustDo("master") || ::arg().mustDo("slave"))
         gethostbyname("a.root-servers.net"); // this forces all lookup libraries to be loaded

diff --git a/pdns/pdns_recursor.cc b/pdns/pdns_recursor.cc
index 16c11466733ad0669b10c54379d5585a9428fb16..8e774d303e076f7c2198d22ada532db7b3b463e4 100644 (file)
--- a/pdns/pdns_recursor.cc
+++ b/pdns/pdns_recursor.cc
@@ -2819,6 +2819,14 @@ int serviceMain(int argc, char*argv[])
   Utility::dropGroupPrivs(newuid, newgid);
 
   if (!::arg()["chroot"].empty()) {
+#ifdef HAVE_SYSTEMD
+     char *ns;
+     ns = getenv("NOTIFY_SOCKET");
+     if (ns != nullptr) {
+       L<<Logger::Error<<"Unable to chroot when running from systemd. Please disable chroot= or set the 'Type' for this service to 'simple'"<<endl;
+       exit(1);
+     }
+#endif
     if (chroot(::arg()["chroot"].c_str())<0 || chdir("/") < 0) {
       L<<Logger::Error<<"Unable to chroot to '"+::arg()["chroot"]+"': "<<strerror (errno)<<", exiting"<<endl;
       exit(1);