@juliank - note I wasn't so much talking about 'blame' as much as understanding, so I apologize if it came across that way. Since I wasn't able to reproduce, I was trying to reason through my thoughts to help the discussion go further since I'm not able to diagnose it myself.
In a nutshell, I have concerns that the ufw service has a side effect that somewhere else in the system is dependent on. That other part of the system should be setup to work without ufw in the mix. I'm also concerned that users might face issues if ufw is purged or if other similarly configured software is installed (eg, firewalld).
With that in mind, it seems odd that a service that does nearly nothing by default would affect the system by having a Before/Wants on network-pre.target.
It also seems odd that going from very little dependencies (DefaultDependencies=no) to have only those for 'basic system initialization' would be a problem since those are not related to networking, etc. Eg, in today's autopkgtest jammy instance that I created with `autopkgtest-buildvm-ubuntu-cloud -r jammy` and rebooting with the proposed -3 of ufw installed:
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu Jammy Jellyfish (development branch)
Release: 22.04
Codename: jammy
Seeing what depends on ufw, there is very little:
$ systemctl list-dependencies ufw.service --reverse
ufw.service
● └─multi-user.target
● └─graphical.target
I can also say that nothing in this VM depends on network-pre other than ufw:
$ systemctl list-dependencies --reverse network-pre.target
network-pre.target
● └─ufw.service
and that there is not much depending on network.target:
$ systemctl list-dependencies --reverse network.target
network.target
○ ├─netplan-ovs-cleanup.service
● └─systemd-networkd.service
Rebooting with ufw -2 installed, all of the above is the same except ufw's dependencies are nearly nothing:
$ systemctl list-dependencies ufw.service
ufw.service
● └─system.slice
This autopkgtest VM doesn't have cloud-init installed (which is consistent with why I'm not seeing it in here like I am not in Debian) and I don't know what cloud-init config to provide to provide any additional diagnosis. I can say that if I install cloud-init, it add a dependency on on network-pre.target (still with -2 of ufw):
@juliank - note I wasn't so much talking about 'blame' as much as understanding, so I apologize if it came across that way. Since I wasn't able to reproduce, I was trying to reason through my thoughts to help the discussion go further since I'm not able to diagnose it myself.
In a nutshell, I have concerns that the ufw service has a side effect that somewhere else in the system is dependent on. That other part of the system should be setup to work without ufw in the mix. I'm also concerned that users might face issues if ufw is purged or if other similarly configured software is installed (eg, firewalld).
With that in mind, it seems odd that a service that does nearly nothing by default would affect the system by having a Before/Wants on network-pre.target.
It also seems odd that going from very little dependencies (DefaultDepende ncies=no) to have only those for 'basic system initialization' would be a problem since those are not related to networking, etc. Eg, in today's autopkgtest jammy instance that I created with `autopkgtest- buildvm- ubuntu- cloud -r jammy` and rebooting with the proposed -3 of ufw installed:
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu Jammy Jellyfish (development branch)
Release: 22.04
Codename: jammy
$ cat /proc/version_ signature 19.19-generic 5.13.14
Ubuntu 5.13.0-
$ systemctl list-dependencies ufw.service pre.target .mount setup.service static- nodes.service service read-write. service start.service sys-fs- binfmt_ misc.automount fuse-connection s.mount config. mount debug.mount tracing. mount ask-password- console. path binfmt. service boot-system- token.service journal- flush.service journald. service machine- id-commit. service modules- load.service pstore. service random- seed.service sysctl. service sysusers. service timesyncd. service tmpfiles- setup-dev. service tmpfiles- setup.service udev-trigger. service udevd.service update- utmp.service fsck-root. service remount- fs.service target
ufw.service
● ├─system.slice
● ├─network-
● └─sysinit.target
● ├─apparmor.service
● ├─dev-hugepages
● ├─dev-mqueue.mount
● ├─keyboard-
● ├─kmod-
● ├─multipathd.
● ├─plymouth-
○ ├─plymouth-
● ├─proc-
● ├─setvtrgb.service
● ├─sys-fs-
● ├─sys-kernel-
● ├─sys-kernel-
● ├─sys-kernel-
● ├─systemd-
○ ├─systemd-
○ ├─systemd-
● ├─systemd-
● ├─systemd-
○ ├─systemd-
● ├─systemd-
○ ├─systemd-
● ├─systemd-
● ├─systemd-
● ├─systemd-
● ├─systemd-
● ├─systemd-
● ├─systemd-
● ├─systemd-
● ├─systemd-
● ├─systemd-
● ├─cryptsetup.target
● ├─local-fs.target
● │ ├─-.mount
● │ ├─boot-efi.mount
○ │ ├─systemd-
● │ └─systemd-
● ├─swap.target
● └─veritysetup.
Seeing what depends on ufw, there is very little:
$ systemctl list-dependencies ufw.service --reverse
ufw.service
● └─multi-user.target
● └─graphical.target
I can also say that nothing in this VM depends on network-pre other than ufw:
$ systemctl list-dependencies --reverse network-pre.target
network-pre.target
● └─ufw.service
and that there is not much depending on network.target: ovs-cleanup. service networkd. service
$ systemctl list-dependencies --reverse network.target
network.target
○ ├─netplan-
● └─systemd-
Rebooting with ufw -2 installed, all of the above is the same except ufw's dependencies are nearly nothing:
$ systemctl list-dependencies ufw.service
ufw.service
● └─system.slice
This autopkgtest VM doesn't have cloud-init installed (which is consistent with why I'm not seeing it in here like I am not in Debian) and I don't know what cloud-init config to provide to provide any additional diagnosis. I can say that if I install cloud-init, it add a dependency on on network-pre.target (still with -2 of ufw):
$ systemctl list-dependencies network-pre.target --reverse init-local. service
network-pre.target
○ └─cloud-
It has: systemd/ system/ cloud-init- local.service cies=no pre.target kvp_daemon. service remount- fs.service NetworkManager. service network- pre.target shutdown. target sysinit. target shutdown. target or=/var/ lib/cloud
$ cat /usr/lib/
[Unit]
Description=Initial cloud-init job (pre-networking)
DefaultDependen
Wants=network-
After=hv_
After=systemd-
Before=
Before=
Before=
Before=
Conflicts=
RequiresMountsF
[Service] /usr/bin/ cloud-init init --local /bin/touch /run/cloud- init/network- config- ready
Type=oneshot
ExecStart=
ExecStart=
RemainAfterExit=yes
TimeoutSec=0
# Output needs to appear in instance console output journal+ console
StandardOutput=
[Install] cloud-init. target
WantedBy=
I notice that it has a `Before= sysinit. target` and DefaultDependen cies=no.
Is cloud-init in our infrastructure configured to run ufw?