[systemd-devel] systemd's connections to /run/systemd/private ?

[Brian Reichert]

On Thu, Aug 01, 2019 at 07:18:20PM +0000, Zbigniew J??drzejewski-Szmek wrote:
> Yes. (With the caveat that there *are* legitimate reasons to have new
> long-lived fds created, so not every long-lived fd is "wrong".)

I finally was able to track down what's happening on my system.

This is sufficient to reproduce the effect of increasing the number
of file descriptors open to /run/systemd/private; at least, on my
box, in it's current state:

  sh -c 'exec 1>&-; /usr/bin/systemctl status ntpd.service'

We have cronjob that closes STDOUT, remaps STDERR to a log file,
and runs this systemctl command.  In my environment, this one-liner
will cause that FD count to go up by, 100% reproducible.

Somehow, closing STDOUT is necessary to see this.

FWIW, the strace effort didn't yeild anything; instead, I configured
auditd to reveal when systemctl was invoked, and found a pattern
of invocations I was able to backtrack to the cronjob.

> Zbyszek

-- 
Brian Reichert				<reichert at numachi.com>
BSD admin/developer at large