/var/run/qubes-service qvm-sevice available too late breaks systemd services

[adrelanos]

Qubes OS version

R3.1

Affected TemplateVMs

debian-8 (standalone)

Steps to reproduce the behavior:

Qubes VM Manager -> right click on VM -> services -> enter (without the single quotes) 'netfilter-persistent' -> click on + -> OK

Start VM.

user@sys-vpn:~$ sudo service netfilter-persistent status
● netfilter-persistent.service - netfilter persistent configuration
   Loaded: loaded (/lib/systemd/system/netfilter-persistent.service; enabled)
  Drop-In: /lib/systemd/system/netfilter-persistent.service.d
           └─30_qubes.conf
   Active: inactive (dead)
           start condition failed at Wed 2016-05-11 23:45:35 CEST; 25s ago
           ConditionPathExists=/var/run/qubes-service/netfilter-persistent was not met

May 11 23:45:35 localhost systemd[1]: Started netfilter persistent configuration.

user@sys-vpn:~$ ls /var/run/qubes-service/netfilter-persistent
/var/run/qubes-service/netfilter-persistent

Expected behavior:

/var/run/qubes-service files should be readable before netfilter-persistent (or any other) systemd service starts.

Actual behavior:

/var/run/qubes-service is available too late.

General notes:

This breaks VPN-Firewall. (A project maintained by me that could theoretically in future provide a bulletproof sys-vpn implementation, that (in development branch) would also defeat fixed shared VPN/Tor server leak bug (adrelanos/vpn-firewall#12) and solve #1941.

Related issues:

#1941

[marmarek]

Take a look at attached PR. Does it fix the problem for you (you can check for that service only)?

[adrelanos]

This was quick. Awesome. Works for me.

(I will be shipping a separate drop-in file as workaround for vpn-firewall until this ends up in stable. Should not matter.)

[marmarek]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.17-1.fc21 has been pushed to the r3.1 testing repository for the Fedora fc21 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.17-1.fc22 has been pushed to the r3.1 testing repository for the Fedora fc22 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.17-1.fc23 has been pushed to the r3.1 testing repository for the Fedora fc23 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb8u1 has been pushed to the r3.1 testing repository for the Debian jessie template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing jessie-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb9u1 has been pushed to the r3.1 testing repository for the Debian stretch template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb7u1 has been pushed to the r3.1 testing repository for the Debian wheezy template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing wheezy-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package qubes-upgrade-vm-3.1-1.fc21 has been pushed to the r3.1 stable repository for the Fedora fc21 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package qubes-upgrade-vm-3.1-1.fc22 has been pushed to the r3.1 stable repository for the Fedora fc22 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package qubes-upgrade-vm-3.1-1.fc23 has been pushed to the r3.1 stable repository for the Fedora fc23 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb8u1 has been pushed to the r3.1 stable repository for the Debian jessie template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb9u1 has been pushed to the r3.1 stable repository for the Debian stretch template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[marmarek]

Automated announcement from builder-github

The package qubes-core-agent_3.1.17-1+deb7u1 has been pushed to the r3.1 stable repository for the Debian wheezy template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update