Odd behavior after accidental shutdown from within chroot container

louigi600 · 04-07-2016, 02:16 AM

I'm experiencing a really wired thing on a server where I run several chroot containers.
On one of them I issued accidentally a

Code:

shutdown -h now

which made the entire server shutdown, but that's not the odd thing !
What's puzzling me is that, on that one container where I ran the accidental shutdown, upon taking down sshd within it, all the sshd daemons go down (in the other containers and on the server itself).
The other containers don't do that and after recreating the damaged container it's working normally again.

The sshd for each container, and for the server itself, are all bound to separate IP address and the /var/run/sshd.pid in each container has the correct pid in it (including the container that misbehaved). The init script for sshd (/etc/init.d/sshd) are all identical.
In fact the chroot containers are all created as a minimal subset of the host OS itself and since the issue I've removed init and shutdown from the containers (that had crept in dew to dependencies requiring stuff from upstart package).

Has anyone got any idea why it was happening ?

louigi600 · 04-14-2016, 07:27 AM

I got it: RHEL 6 sshd script arbitrarily kills all sshd if it's asked to stop sshd daemon when system is going into runlevel 0 or 6.
Running the "shutdown" from within the container will put in it's utmp runlevel 0 or 6 (depending on whether you halt or reboot) which will then never get updated in the container .... hence the sshd script will always determine that the system is going down and thus kill all sshd .... having proc bind mounted lets the container kill all the other sshd.

Code:

stop()
{
        echo -n $"Stopping $prog: "
        killproc -p $PID_FILE $SSHD
        RETVAL=$?
        # if we are in halt or reboot runlevel kill all running sessions
        # so the TCP connections are closed cleanly
        if [ "x$runlevel" = x0 -o "x$runlevel" = x6 ] ; then
            trap '' TERM
            killall $prog 2>/dev/null
            trap TERM
        fi
        [ $RETVAL -eq 0 ] && rm -f $lockfile
        echo
}

and "strace runlevel" reveals :

Code:

open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = 3

I should be able to give myself good reputation for answering my own difficult questions !