[
https://issues.apache.org/jira/browse/SOLR-18633?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18140782#comment-18140782
]
Eric Pugh commented on SOLR-18633:
----------------------------------
You may want to drop a post to dev@ to get feedback. I've felt like our
service scripts have maybe aged a bit, and kind of need a revamp for modern
best practices. I don't know if this covers what we would WISH we had or not.
> Align solr.service with systemd and FHS standards: use RuntimeDirectory and
> place PID files in /run
> ---------------------------------------------------------------------------------------------------
>
> Key: SOLR-18633
> URL: https://issues.apache.org/jira/browse/SOLR-18633
> Project: Solr
> Issue Type: Improvement
> Components: scripts and tools
> Affects Versions: 10.0, 10.1
> Reporter: Phil Sweeney
> Priority: Minor
>
> h3. Problem
> In modern Linux distributions (such as RHEL 9/10, Amazon Linux 2023, Fedora,
> and Debian 12) with SELinux in enforcing mode, transient process state like
> PID files is required by the Filesystem Hierarchy Standard (FHS 3.0) to
> reside in {{/run}} (a {{tmpfs}} filesystem labeled {{var_run_t}}).
> Currently, {{bin/systemd/solr.service}} and {{install_solr_service.sh}}
> retain legacy init-era defaults:
> * *PID files in data directory*: Solr defaults {{SOLR_PID_DIR}} to
> {{/var/solr}} (or {{$SOLR_VAR_DIR}}). Writing PID files into persistent
> storage directories violates FHS standards and triggers SELinux AVC denials
> on enforcing systems because persistent data directories are not labeled as
> runtime state.
> * *Missing RuntimeDirectory declaration*: The shipped
> {{bin/systemd/solr.service}} unit does not declare {{RuntimeDirectory=solr}}.
> As a result, systemd does not automatically provision and permission
> ({{solr:solr}}) a {{/run/solr}} directory upon service startup.
> * *Missing PIDFile directive*: Without an explicit {{PIDFile=}} directive in
> {{[Service]}}, systemd relies on heuristic process matching for
> {{Type=forking}}, which can lead to supervision issues during restarts.
> h3. Proposed Solution
> 1. *Update bin/systemd/solr.service*:
> Add {{RuntimeDirectory}} and an explicit {{PIDFile}} directive to the unit
> template:
> {code:none}
> [Service]
> Type=forking
> User={{SOLR_USER}}
> Group={{SOLR_USER}}
> RuntimeDirectory={{SOLR_SERVICE}}
> PIDFile=/run/{{SOLR_SERVICE}}/{{SOLR_SERVICE}}-{{SOLR_PORT_LISTEN}}.pid
> Environment=SOLR_INCLUDE=/etc/default/{{SOLR_SERVICE}}.in.sh
> ExecStart={{SOLR_INSTALL_DIR}}/bin/solr start
> ExecStop={{SOLR_INSTALL_DIR}}/bin/solr stop
> Restart=on-failure
> RestartSec=3s
> TimeoutSec=180s
> LimitNOFILE=65000
> LimitNPROC=65000
> {code}
> 2. *Update install_solr_service.sh default for SOLR_PID_DIR*:
> When installing on a systemd-managed host, default {{SOLR_PID_DIR}} to
> {{/run/$SOLR_SERVICE}} in {{/etc/default/solr.in.sh}} instead of
> {{/var/solr}}:
> {code:bash}
> SOLR_PID_DIR="/run/$SOLR_SERVICE"
> {code}
> h3. Benefits
> * *Zero SELinux denials*: Automatically conforms to standard {{var_run_t}}
> file labeling.
> * *Clean reboot lifecycle*: Being backed by {{tmpfs}} guarantees stale
> {{.pid}} files from unexpected host crashes or power loss are cleared
> automatically on reboot.
> * *Native systemd lifecycle*: Systemd handles directory creation, ownership,
> and cleanup automatically on service start and stop.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
