Debian Bug report logs - #495257
dbus should not lose connection on restart

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Sam Morris <sam@robots.org.uk>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: dbus: System bus must not be restarted during package upgrades

Date: Fri, 15 Aug 2008 18:59:55 +0100

Package: dbus
Version: 1.2.1-3
Severity: serious

Yesterday I upgraded my system and during the process the system dbus
daemon was restarted. This caused a variety of interesting and amusing
things to happen to my system, including gnome-power-manager dieing,
network-manager dieing, the gnome panel dieing, and rhythmbox freezing
up and chewing 100% of the CPU.

The bugs I filed upstream are:

http://bugzilla.gnome.org/show_bug.cgi?id=547932
http://bugzilla.gnome.org/show_bug.cgi?id=547850
http://bugzilla.gnome.org/show_bug.cgi?id=547851
http://bugzilla.gnome.org/show_bug.cgi?id=547849

In the last of these, the NetworkManager developers were quite clear
that distributions must *not* restart the dbus system bus, ever:

"Distros should not be restarting the bus on upgrade of the dbus package.  NM
supports bus reconnections when it's been kicked off because of doing something
bad, but does not support bus reconnections if dbus itself goes away."

and

"the user wouldn't need to scratch his/her head if the distro did not restart
the dbus service on a package upgrade.  the bus is _not_ meant to be restarted
on-the-fly.  this is also the view of upstream dbus maintainers and has always
been the view of upstream dbus maintainers.  there are way too many pieces here
on the bus that NM talks to, and the code for doing state resynchronization
after a bus restart would be hugely prohibitive when the bus should just not be
restarted in the first place."

A dbus developer also cited a mailing list thread
<http://mail.gnome.org/archives/networkmanager-list/2005-March/msg00022.html>
where it was stated,

"I don't think we should really try to support this.  Restarting D-BUS
should be viewed like trying to live-restart a new kernel.  There's so
many complicated issues in it, and it'll be a rarely-tested code path.
Right now it's a bug that the Fedora D-BUS and NetworkManager RPM
scripts restart after a package upgrade."

Given the amount of crashes, freezes and general random weird behaviour
that occurs when the system dbus daemon is restarted, it is clear that
dbus clients simply can not handle the daemon being restarted. Since the
upstreams of both dbus clients, and of dbus itself, say that this should
not be done, and are not interested in accepting patches to make things
work, we really shouldn't be doing it.

-- System Information:
Debian Release: lenny/sid
  APT prefers testing
  APT policy: (530, 'testing'), (520, 'unstable'), (510, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.26-1-686 (SMP w/1 CPU core)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages dbus depends on:
ii  adduser                       3.108      add and remove users and groups
ii  debianutils                   2.30       Miscellaneous utilities specific t
ii  libc6                         2.7-13     GNU C Library: Shared libraries
ii  libdbus-1-3                   1.2.1-3    simple interprocess messaging syst
ii  libexpat1                     2.0.1-4    XML parsing C library - runtime li
ii  libselinux1                   2.0.65-2   SELinux shared libraries
ii  lsb-base                      3.2-19     Linux Standard Base 3.2 init scrip

Versions of packages dbus recommends:
ii  dbus-x11                      1.2.1-3    simple interprocess messaging syst

dbus suggests no packages.

-- no debconf information

Message #10 received at 495257@bugs.debian.org (full text, mbox, reply):

From: Tyson Clugg <tclugg@umd.com.au>

To: 495257@bugs.debian.org

Subject: Re: Bug#495257: dbus: System bus must not be restarted during package upgrades

Date: Tue, 19 Aug 2008 15:13:14 +1000

First up, I'm not a DBus daemon developer.

I disagree that the DBus daemon should never be restarted because the
NetworkManager developers say so.  This is a step towards the "dark
side" - rebooting your box after performing an upgrade is the M$ way of
doing things.  Solid engineering can prevent this.

I have no idea if the following is possible, but it may be a good start
to solving the DBus upgrade/restart puzzle:

1. Start new DBus daemon on a new socket:
     /var/run/dbus/system_bus_socket.new

2. Connect to the old socket and start proxying messages between the 2
daemons.

3. Move the new socket over the top of the old socket:

mv /var/run/dbus/system_bus_socket.new /var/run/dbus/system_bus_socket

4. Send message to the old daemon to force disconnection of all clients
which should reconnect to the new daemon, once all clients disconnected
then the old daemon shuts down.

Comments?

-- 
Regards

Tyson Clugg
Programmer
=============================================================
Unique Micro Design Pty Ltd.........engineering ICT solutions
Wellington Road Business Park
200 Wellington Road
Clayton, VIC 3168, Australia

PO Box 4297, Mulgrave, VIC 3170, Australia

+61-3-9582-7095   tclugg@umd.com.au   DIRECT

+61-3-9582-7070   Sales@umd.com.au
+61-3-9582-7060   Service@umd.com.au
+61-3-9582-7050   Support@umd.com.au
+61-3-9582-7010   Accounts@umd.com.au
+61-3-9582-7000   Reception@umd.com.au

+61-3-9582-7001   Fax - Sales and office
+61-3-9582-7069   Fax - Service
===========================================================
www.umd.com.au            UMD Web Address
www.umd.com.au/rfid/        UMD and RFID
www.umd.com.au/gprs        UMD and GPRS
www.umd.com.au/solutions/    UMD Solution Sourcing
www.cardgate.net        UMD E-Commerce Division
=========================================================== 

Message #15 received at 495257@bugs.debian.org (full text, mbox, reply):

From: dantti85-pk@yahoo.com.br

To: 495257@bugs.debian.org

Subject: More info

Date: Tue, 19 Aug 2008 09:50:16 -0700 (PDT)

[Message part 1 (text/plain, inline)]

Hi,
I'm a packagekit and kpackagekit developer. (www.packagekit.org)
i was going to contact dbus packgers people but i found a bug that
has what i need.

i'll try to explain why not restart Dbus:

* Fist of all dbus should be treated like a kernel? sould stupid?
but you can't (ok i know there are ways to do it) upgrade your kernel
and don't do a restart.

* gdm > 2.22 or greater will kill you login session.

* policykit a program that is getting wide used, creates a session
every time you login on kdm or gdm, if you restart Dbus it will never come back.

* and in our case we use dbus to have a very good design in security and
transparency for the user and a developer application.
how it works? well if you don't know packagekit has a wide range of backends
so you will be able to manage software the same way (in the user poit of view)
on ANY distro. Fedora 9 already uses it. ALL the comunication between 
packagekit and the user interface is made using DBUS.
So if you restart DBUS the ui is not able to respond to the current request
and the user got's confused.
AND in the most common case doing a system update using packagekit ui
will end up with a ui stuck and it never concludes the updates...

If the user kills the updates ui, he will never be able again to 
install/remove ANY packages WHY? because polkit the program that
gives him the right to do admin tasks was killed by a restart.

Please don't think that only m$ should do restart, on m$98
if you hold the shift (not sure if this was the key) the os
did not restart completely.

if restarting is a m$ thing why should you restart a running program??
tell it to re read it's config file (i also think it's unecessary).

So please consider not doing this restart anymore. you will be crashing
too many things, it's like to unplug a pendrive while it's copying...

the application don't know what to do and some of then could do nothing!

Ah i remember more one problem:
IF dbus is not able to start again due this update a kde user will not be able
to use shortcuts, nor see popups messages... it all Depends on DBUS.
and to finish my huge email :)

Dbus was made for desktop users (freedesktop.org), so you can't have
a power user to be able to start dbus by hand cause it failed to start...

please add my email if this is not automatic,
and please don't see this like an angry or ofence email.
It's just that there are a bounch of projects that rely on Dbus
and doing so is breaking everything.

cheers,
Daniel.



      Novos endereços, o Yahoo! que você conhece. Crie um email novo com a sua cara @ymail.com ou @rocketmail.com.
http://br.new.mail.yahoo.com/addresses

[Message part 2 (text/html, inline)]

Message #20 received at 495257@bugs.debian.org (full text, mbox, reply):

From: Daniel Nicoletti <daniel_nic85@yahoo.com.br>

To: 495257@bugs.debian.org

Subject: Res: More info

Date: Tue, 19 Aug 2008 09:58:49 -0700 (PDT)

[Message part 1 (text/plain, inline)]

Also adding to the above description (Tyson Clugg) i really don't
think that will be possible, if we are in the middle of an upgrade
(packagekit talking) it will be somehow confusing for the 
service applications.



      Novos endereços, o Yahoo! que você conhece. Crie um email novo com a sua cara @ymail.com ou @rocketmail.com.
http://br.new.mail.yahoo.com/addresses

[Message part 2 (text/html, inline)]

Message #25 received at 495257@bugs.debian.org (full text, mbox, reply):

From: Michael Biebl <biebl@debian.org>

To: Sam Morris <sam@robots.org.uk>

Cc: 495257-submitter@bugs.debian.org, 495257@bugs.debian.org

Subject: Re: [Pkg-utopia-maintainers] Bug#495257: dbus: System bus must not be restarted during package upgrades

Date: Fri, 22 Aug 2008 22:11:24 +0200

[Message part 1 (text/plain, inline)]

Sam Morris wrote:
> On Tue, 19 Aug 2008 15:13:14 +1000, Tyson Clugg wrote:
> 

> 
> Given the current release situation, I think we should just not restart 
> the bus for now.
> 

As much as I disagree with upstream, that dbus should never be restarted
(I find the argument bogus, that a dbus restart is equivalent to a
kernel live-restart), I agree with Sam, that given the current
situation, and the many breakages a dbus restart produces, we would do
our users a favor if we didn't restart dbus in lenny.

The problem is, that the dbus package in etch uses the default
dh_installinit behaviour, meaning that dbus will be stopped by the old
prerm script. So we can't avoid a dbus restart anyway for the
etch->lenny upgrade. We can only plan ahead for a lenny->lenny+1 upgrade.

Michael

-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

[signature.asc (application/pgp-signature, attachment)]

Message #33 received at 495257@bugs.debian.org (full text, mbox, reply):

From: Tyson Clugg <tclugg@umd.com.au>

To: Michael Biebl <biebl@debian.org>, 495257@bugs.debian.org

Subject: Re: Bug#495257: [Pkg-utopia-maintainers] Bug#495257: dbus: System bus must not be restarted during package upgrades

Date: Sun, 24 Aug 2008 23:19:51 +0000

On Fri, 2008-08-22 at 22:11 +0200, Michael Biebl wrote:
> Sam Morris wrote:
> > On Tue, 19 Aug 2008 15:13:14 +1000, Tyson Clugg wrote:
> > 
> 
> > 
> > Given the current release situation, I think we should just not restart 
> > the bus for now.
> > 
...snip.

That statement should not have been attributed to me, I didn't write it
(nor do I agree with it).  And once again, I'm not a DBus daemon
developer, just another DBus client developer.

Regards,
Tyson Clugg.

Message #38 received at 495257@bugs.debian.org (full text, mbox, reply):

From: Tyson Clugg <tclugg@umd.com.au>

To: Michael Biebl <biebl@debian.org>, 495257-quiet@bugs.debian.org

Cc: Sam Morris <sam@robots.org.uk>, 495257-submitter@bugs.debian.org, 495257@bugs.debian.org

Subject: Re: Bug#495257: [Pkg-utopia-maintainers] Bug#495257: dbus: System bus must not be restarted during package upgrades

Date: Sun, 24 Aug 2008 23:57:04 +0000

On Fri, 2008-08-22 at 22:11 +0200, Michael Biebl wrote:
...
> As much as I disagree with upstream, that dbus should never be restarted
> (I find the argument bogus, that a dbus restart is equivalent to a
> kernel live-restart), I agree with Sam, that given the current
> situation, and the many breakages a dbus restart produces, we would do
> our users a favor if we didn't restart dbus in lenny.
> 
> The problem is, that the dbus package in etch uses the default
> dh_installinit behaviour, meaning that dbus will be stopped by the old
> prerm script. So we can't avoid a dbus restart anyway for the
> etch->lenny upgrade. We can only plan ahead for a lenny->lenny+1 upgrade.

Michael, does the following fit with what you said?

1. The next release of DBus should not restart the service upon package
upgrade - this is what many of the DBus client developers are calling
for.

2. Any client packages that depend on DBus not restarting should bump
their version number and conflict with DBus>=1.3.

3. New behaviour (ie: clean restart behaviour) can be implemented in
DBus 1.3, when individual packages implement whatever API is created for
clean restart then they can remove the conflict.

Regards,
Tyson Clugg.

Message #51 received at 495257@bugs.debian.org (full text, mbox, reply):

From: Matthew Johnson <mjj29@debian.org>

To: 495257@bugs.debian.org

Subject: Possible upgrade solution

Date: Sat, 30 Aug 2008 12:26:12 +0100

[Message part 1 (text/plain, inline)]

I've just asked upstream to comment on this issue.

In the mean time, would this be a possible solution:

can the postinst of the new package force a restart of all the services
(possibly including gdm et al to restart user sessions) which depend on
the system bus?

It's a bit ugly, but a. if this is an etch->lenny upgrade they will
probably all be restarted anyway and b. it's still better than an actual
reboot.

We could have one of those debconf questions like libc6 has.

Matt

--
Matthew Johnson

[signature.asc (application/pgp-signature, inline)]

Message #56 received at 495257@bugs.debian.org (full text, mbox, reply):

From: Sjoerd Simons <sjoerd@luon.net>

To: Sam Morris <sam@robots.org.uk>, 495257@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: [Pkg-utopia-maintainers] Bug#495257: dbus: System bus must not be restarted during package upgrades

Date: Sat, 30 Aug 2008 14:27:13 +0100

retitle 495257 dbus should not use connection on restart
severity 495257 important
thanks,

On Fri, Aug 15, 2008 at 06:59:55PM +0100, Sam Morris wrote:
> Package: dbus
> Version: 1.2.1-3
> Severity: serious
> 
> Yesterday I upgraded my system and during the process the system dbus
> daemon was restarted. This caused a variety of interesting and amusing
> things to happen to my system, including gnome-power-manager dieing,
> network-manager dieing, the gnome panel dieing, and rhythmbox freezing
> up and chewing 100% of the CPU.
> 
> The bugs I filed upstream are:
> 
> http://bugzilla.gnome.org/show_bug.cgi?id=547932
> http://bugzilla.gnome.org/show_bug.cgi?id=547850
> http://bugzilla.gnome.org/show_bug.cgi?id=547851
> http://bugzilla.gnome.org/show_bug.cgi?id=547849
> 
> In the last of these, the NetworkManager developers were quite clear
> that distributions must *not* restart the dbus system bus, ever:
> 
> "Distros should not be restarting the bus on upgrade of the dbus package.  NM
> supports bus reconnections when it's been kicked off because of doing
> something bad, but does not support bus reconnections if dbus itself goes
> away."

> and
> 
> "the user wouldn't need to scratch his/her head if the distro did not restart
> the dbus service on a package upgrade.  the bus is _not_ meant to be
> restarted on-the-fly.  this is also the view of upstream dbus maintainers and
> has always been the view of upstream dbus maintainers.  there are way too
> many pieces here on the bus that NM talks to, and the code for doing state
> resynchronization after a bus restart would be hugely prohibitive when the
> bus should just not be restarted in the first place."
> 
> A dbus developer also cited a mailing list thread
> <http://mail.gnome.org/archives/networkmanager-list/2005-March/msg00022.html>
> where it was stated,
> 
> "I don't think we should really try to support this.  Restarting D-BUS
> should be viewed like trying to live-restart a new kernel.  There's so
> many complicated issues in it, and it'll be a rarely-tested code path.
> Right now it's a bug that the Fedora D-BUS and NetworkManager RPM
> scripts restart after a package upgrade."
> 
> Given the amount of crashes, freezes and general random weird behaviour
> that occurs when the system dbus daemon is restarted, it is clear that
> dbus clients simply can not handle the daemon being restarted. Since the
> upstreams of both dbus clients, and of dbus itself, say that this should
> not be done, and are not interested in accepting patches to make things
> work, we really shouldn't be doing it.

The only reason why D-Bus restarts in a stable debian version, is security
updates. Where it does not make sense to wait imho. Also for something like
network-manager, we restart that on dbus upgrade, so the user-experience should
just be a network reconnection (if he's on wireless), which is what it nicely
does on my system.

I do regard programs not coping gracefully with a dbus-daemon crash or restart
as being buggy and fixed several of them over the years. For most things it's
not that hard to fix.

If you want a real solution, then dbus should support restarting/reloading
itself in place like init does. If you want to claim that d-bus should be
treated like the kernel, please make it part of the kernel :)

Also like michiel said further on in the thread, upgrades from etch to lenny
will always restart dbus. So for etch->lenny we can't fix this anyway.
Hopefully for lenny+1 there will be a better solution.

  Sjoerd
-- 
Reality is just a crutch for people who can't handle science fiction.

Message #65 received at 495257@bugs.debian.org (full text, mbox, reply):

From: "Colin Walters" <walters@verbum.org>

To: 495257@bugs.debian.org

Date: Sat, 30 Aug 2008 11:25:56 -0400

For etch->lenny, if you really care, you could have an out of band
(i.e. out-of-dpkg) preupgrade process which deletes the old dbus'
package prerm script.

Now long term, there are multiple cases, as I argued here:
http://mail.gnome.org/archives/networkmanager-list/2005-March/msg00033.html

To sum that up, for security updates on servers, two things to keep in
mind.  First, probably the vast majority of servers today, DBus isn't
even on the radar because it doesn't expose a network-accessible
threat surface.  Second, I bet a ksplice-style approach
(http://web.mit.edu/ksplice/) would not be that hard to apply to DBus.
 We aren't generally changing the internal data structures much
anymore.

For the desktop use case, remember that most packages aren't being
restarted.  In particular, the X server and everything that depends on
it is not being restarted.  Solving *that* is fairly hard and requires
vendor and upstream desktop integration work which I hope can occur in
the context of PackageKit.

In fact in general, installing a package is not the same as upgrading.
 Think about libc6.  Its horrible postinst question is a symptom of
this same issue.

Is this bug release critical?  I don't think so.  On the server you
can just not restart the system bus and no one will care.  On the
desktop for major version upgrades, no one is going to care if they
have to reboot once, because you already had to to get those new X
server drivers.

Message #70 received at 495257@bugs.debian.org (full text, mbox, reply):

From: Sam Morris <sam@red-redemption.com>

To: 495257@bugs.debian.org

Subject: Re: dbus should not use connection on restart

Date: Wed, 29 Oct 2008 11:50:10 +0000

Comments from the gnome-power-manager developers:
        
        No session application is expected to survive a bus restart.
        Your distro is broken wanting to restart it on upgrade. The
        upstream project maintainers do not want the system bus
        restarted on upgrade. Closing, sorry.

So we can't prevent etch's dbus package from stopping dbus when it's
prerm is run, fine... it's probably not a good idea to do that anyway.
But can we fix the lenny postinst while we still have a chance?

We can do what Ubuntu does, and display a notification area icon saying
"please log out and in again when you have a chance". Comments?

-- 
Sam Morris <sam@red-redemption.com>
Red Redemption

Message #75 received at 495257@bugs.debian.org (full text, mbox, reply):

From: Sam Morris <sam@robots.org.uk>

To: 495257@bugs.debian.org

Subject: Re: dbus should not use connection on restart

Date: Wed, 29 Oct 2008 11:53:40 +0000

> We can do what Ubuntu does, and display a notification area icon saying
> "please log out and in again when you have a chance". Comments?

Whoops, I mean restart. :)

-- 
Sam Morris <sam@robots.org.uk>

Message #80 received at 495257@bugs.debian.org (full text, mbox, reply):

From: Sam Morris <sam@robots.org.uk>

To: 495257@bugs.debian.org

Subject: Yet more casualties on dbus upgrades

Date: Thu, 09 Jul 2009 13:42:53 +0100

Today's upgrade resulted in the following additional casualties.

      * nautilus dies
      * gnome-power-manager dies
      * the panel dies

-- 
Sam Morris <sam@robots.org.uk>

Message #87 received at 495257@bugs.debian.org (full text, mbox, reply):

From: Sam Morris <sam@robots.org.uk>

To: 495257@bugs.debian.org

Subject: Yet more casualties on dbus upgrades

Date: Thu, 09 Jul 2009 13:45:19 +0100

Today's upgrade resulted in the following additional casualties.

      * nautilus dies
      * gnome-power-manager dies
      * gnome-panel dies
      * nm-applet disappears but remains running
      * evolution stops responding to external events (e.g., clicking
        mailto: links in browser)
      * the panel loses the ability to shut down/restart the system: the
        menu option disappears
      * gnome-keyring dies

-- 
Sam Morris <sam@robots.org.uk>

Message #92 received at 495257@bugs.debian.org (full text, mbox, reply):

From: Sam Morris <sam@robots.org.uk>

To: 495257@bugs.debian.org

Subject: Re: dbus should not lose connection on restart

Date: Sun, 25 Oct 2009 18:54:47 +0000

[Message part 1 (text/plain, inline)]

tag 495257 + security
thanks

In
<http://www.mail-archive.com/polkit-devel@lists.freedesktop.org/msg00148.html> David Zeuthen claims that restarting the system dbus daemon introduces a security hole. No details, but it's something to do with policykit and unique names. Hopefully someone who understands policykit better than me can comment.

-- 
Sam Morris
https://robots.org.uk/

PGP key id 1024D/5EA01078
3412 EA18 1277 354B 991B  C869 B219 7FDB 5EA0 1078

[signature.asc (application/pgp-signature, inline)]

Message #99 received at 495257-done@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: 495257-done@bugs.debian.org

Cc: Sam Morris <sam@robots.org.uk>

Subject: Re: Bug #495257: dbus should not lose connection on restart

Date: Thu, 20 Oct 2011 10:01:25 +0100

Version: 1.2.24-2

> We can do what Ubuntu does, and display a notification area icon saying
> "please log out and in again when you have a chance".

This has been done since squeeze, solving the symptoms as initially reported.

If anyone wants to argue that security updates to the system dbus-daemon
should not require a reboot (probably by re-exec-in-place like init does),
I think that's a job for a new bug number.

    S

Send a report that this bug log contains spam.