Devuan bug report logs - #883
/usr/lib/rsyslog/rsyslog-rotate: Questionable use of invoke-rc.d

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.devuan.org (full text, mbox, reply):

Package: rsyslog
Version: 8.2302.0-1+deb12u1devuan1

/usr/lib/rsyslog/rsyslog-rotate uses invoke-rc.d to notify rsyslog to
reopen logs but it doesn't work when using
policy-rcd-declarative-deny-all so shouldn't the logrotate
configuration snippet use rather 'service' ?

Regards,
Opty

Message #8 received at 883@bugs.devuan.org (full text, mbox, reply):

Control: tags -1 moreinfo

On Tue, Apr 01, 2025 at 02:44:45PM +0200, Opty wrote:
> Package: rsyslog
> Version: 8.2302.0-1+deb12u1devuan1
> 
> /usr/lib/rsyslog/rsyslog-rotate uses invoke-rc.d to notify rsyslog to
> reopen logs but it doesn't work when using
> policy-rcd-declarative-deny-all so shouldn't the logrotate
> configuration snippet use rather 'service' ?

Possibly, although all the other logrotate fragments I can find use invoke-rc.d.

Why do you have policy-rcd-declarative-deny-all installed anyway? I suppose the
rationale goes that if you deny starting services in the first place, you don't
need to rotate the logs because they will be empty/unchanged.

Mark

Message #15 received at 883@bugs.devuan.org (full text, mbox, reply):

On Tue, Apr 1, 2025 at 6:41 PM Mark Hindley <mark@hindley.org.uk> wrote:
> Why do you have policy-rcd-declarative-deny-all installed anyway? I suppose the
> rationale goes that if you deny starting services in the first place, you don't
> need to rotate the logs because they will be empty/unchanged.

Please see #881 or should I copy the story here as well?

Regards,
Opty

Message #20 received at 883@bugs.devuan.org (full text, mbox, reply):

Control: forcemerge 881 -1

On Wed, Apr 02, 2025 at 01:58:20PM +0200, Opty wrote:
> Please see #881 or should I copy the story here as well?

No. Really these are all the same issue. I will merge them for now while we look
at the detail.

Mark

Message #33 received at 881-done@bugs.devuan.org (full text, mbox, reply):

Opty,

Thanks,

On Thu, Apr 03, 2025 at 01:16:40PM +0200, Opty wrote:
> > That isn't conventional Debian practice.
> 
> I could continue using the policy layer unmodified, selectively allow
> what I need (extra work) and keep denied the rest
> 
> -or-
> 
> modify invoke-rc.d or rather policy-rc.d to check
> $DPKG_MAINTSCRIPT_NAME (to detect preinst, postinst, prerm or postrm
> script), crosscheck $DPKG_MAINTSCRIPT_PACKAGE vs. $INITSCRIPTID
> (substring of each other) to allow calling other scripts and
> eventually do nothing, maybe ask the administrator.
> 
> Both seem unintentional error- or side-effect-prone.
> 
> I could also just modify invoke-rc.d to skip the querypolicy call in
> case of K link.

I find it hard to see an actionable bug here. I think invoke-rc.d and
policy-rcd-declarative* are behaving as advertised. Your requirements appear
different to what policy-rcd-declarative-deny-all provides. So, as Simon
suggested, you need to write your own policy script to meet your requirements.

Therefore I will close this.

If you think I have missed something, please feel free to reopen.

Thanks

Mark

Send a report that this bug log contains spam.