Phil Sweeney created SOLR-18633:
-----------------------------------
Summary: Align solr.service with systemd and FHS standards: use
RuntimeDirectory and place PID files in /run
Key: SOLR-18633
URL: https://issues.apache.org/jira/browse/SOLR-18633
Project: Solr
Issue Type: Improvement
Components: scripts and tools
Affects Versions: 10.1, 10.0
Reporter: Phil Sweeney
h3. Problem
In modern Linux distributions (such as RHEL 9/10, Amazon Linux 2023, Fedora,
and Debian 12) with SELinux in enforcing mode, transient process state like PID
files is required by the Filesystem Hierarchy Standard (FHS 3.0) to reside in
{{/run}} (a {{tmpfs}} filesystem labeled {{var_run_t}}).
Currently, {{bin/systemd/solr.service}} and {{install_solr_service.sh}} retain
legacy init-era defaults:
* *PID files in data directory*: Solr defaults {{SOLR_PID_DIR}} to
{{/var/solr}} (or {{$SOLR_VAR_DIR}}). Writing PID files into persistent storage
directories violates FHS standards and triggers SELinux AVC denials on
enforcing systems because persistent data directories are not labeled as
runtime state.
* *Missing RuntimeDirectory declaration*: The shipped
{{bin/systemd/solr.service}} unit does not declare {{RuntimeDirectory=solr}}.
As a result, systemd does not automatically provision and permission
({{solr:solr}}) a {{/run/solr}} directory upon service startup.
* *Missing PIDFile directive*: Without an explicit {{PIDFile=}} directive in
{{[Service]}}, systemd relies on heuristic process matching for
{{Type=forking}}, which can lead to supervision issues during restarts.
h3. Proposed Solution
1. *Update bin/systemd/solr.service*:
Add {{RuntimeDirectory}} and an explicit {{PIDFile}} directive to the unit
template:
{code:none}
[Service]
Type=forking
User={{SOLR_USER}}
Group={{SOLR_USER}}
RuntimeDirectory={{SOLR_SERVICE}}
PIDFile=/run/{{SOLR_SERVICE}}/{{SOLR_SERVICE}}-{{SOLR_PORT_LISTEN}}.pid
Environment=SOLR_INCLUDE=/etc/default/{{SOLR_SERVICE}}.in.sh
ExecStart={{SOLR_INSTALL_DIR}}/bin/solr start
ExecStop={{SOLR_INSTALL_DIR}}/bin/solr stop
Restart=on-failure
RestartSec=3s
TimeoutSec=180s
LimitNOFILE=65000
LimitNPROC=65000
{code}
2. *Update install_solr_service.sh default for SOLR_PID_DIR*:
When installing on a systemd-managed host, default {{SOLR_PID_DIR}} to
{{/run/$SOLR_SERVICE}} in {{/etc/default/solr.in.sh}} instead of {{/var/solr}}:
{code:bash}
SOLR_PID_DIR="/run/$SOLR_SERVICE"
{code}
h3. Benefits
* *Zero SELinux denials*: Automatically conforms to standard {{var_run_t}} file
labeling.
* *Clean reboot lifecycle*: Being backed by {{tmpfs}} guarantees stale {{.pid}}
files from unexpected host crashes or power loss are cleared automatically on
reboot.
* *Native systemd lifecycle*: Systemd handles directory creation, ownership,
and cleanup automatically on service start and stop.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
