journald: harden against forward clock jumps before unclean shutdown

Try harder to inherit the sequence number and ID from the old journal
file before rotating it away.

This helps the libsystemd journal file selection code make better decisions
even in the face of massive incorrect forward clock jumps prior to an
unclean shutdown.

diff --git a/src/journal/managed-journal-file.c b/src/journal/managed-journal-file.c
index c8522126f3732556bb6a6c2ec1b10eb74e3da42b..6164361d751666b660b8a6c2ab53e580772e7726 100644 (file)
--- a/src/journal/managed-journal-file.c
+++ b/src/journal/managed-journal-file.c
@@ -510,6 +510,7 @@ int managed_journal_file_open_reliably(
                 ManagedJournalFile *template,
                 ManagedJournalFile **ret) {
 
+        _cleanup_(managed_journal_file_closep) ManagedJournalFile *old_file = NULL;
         int r;
 
         r = managed_journal_file_open(-1, fname, open_flags, file_flags, mode, compress_threshold_bytes, metrics,
@@ -538,6 +539,19 @@ int managed_journal_file_open_reliably(
         /* The file is corrupted. Rotate it away and try it again (but only once) */
         log_warning_errno(r, "File %s corrupted or uncleanly shut down, renaming and replacing.", fname);
 
+        if (!template) {
+                /* The file is corrupted and no template is specified. Try opening it read-only as the
+                 * template before rotating to inherit its sequence number and ID. */
+                r = managed_journal_file_open(-1, fname,
+                                              (open_flags & ~(O_ACCMODE|O_CREAT|O_EXCL)) | O_RDONLY,
+                                              file_flags, 0, compress_threshold_bytes, NULL,
+                                              mmap_cache, deferred_closes, NULL, &old_file);
+                if (r < 0)
+                        log_debug_errno(r, "Failed to continue sequence from file %s, ignoring: %m", fname);
+                else
+                        template = old_file;
+        }
+
         r = journal_file_dispose(AT_FDCWD, fname);
         if (r < 0)
                 return r;