systemd: Ensure systemd shuts down OpenVPN in a proper way

By default, when systemd is stopping OpenVPN it will send the SIGTERM to all processes within the same process control-group. This can come as a surprise to plug-ins which may have fork()ed out child processes.

So we tell systemd to only send the SIGTERM signal to the main OpenVPN process and let OpenVPN take care of the shutdown process on its own.

If the main OpenVPN process does not stop within 90 seconds (unless changed), it will send SIGKILL to all remaining processes within the same process control-group.

This issue have been reported in both Debian and Fedora.

Trac: 581

---
 distro/systemd/[email protected]... | 1 +
 distro/systemd/[email protected]... | 1 +
 2 files changed, 2 insertions(+)

index 49e3f51c..cbcef653 100644
@@ -17,6 +17,7 @@ DeviceAllow=/dev/null rw
 DeviceAllow=/dev/net/tun rw
 ProtectSystem=true
 ProtectHome=true
+KillMode=process
 
 [Install]
 WantedBy=multi-user.target

index 9a8a2c73..b343868a 100644
@@ -17,6 +17,7 @@ DeviceAllow=/dev/null rw
 DeviceAllow=/dev/net/tun rw
 ProtectSystem=true
 ProtectHome=true
+KillMode=process
 
 [Install]
 WantedBy=multi-user.target

2.13.5

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Applying lazy-ack policy to this patch.

Your patch has been applied to the following branches

commit 29446a18e1f2b52d20f359253b085e96fe458367 (master) commit b49c1ca407e046debebf5633c117d679b9e20555 (release/2.4)

Author: David Sommerseth
Date:   Thu Sep 7 01:47:05 2017 +0200

     systemd: Ensure systemd shuts down OpenVPN in a proper way

     Trac: 581
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg15369.html
     Signed-off-by: David Sommerseth <[email protected]...>

- --
kind regards,

David Sommerseth

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBCgAGBQJZxFARAAoJEIbPlEyWcf3yF2sP/3evuI0srXbzxB56GUgD7SGq OmdYKgne0qAXihX1fVSuWoD3kpryK19k6qv+yfSLMwWP3Yc4QDgrIkleb4Tdn1LM gDZTMt+uEPFm6Zq4o4OFbf/0EHrZxyVgMvvJwBcgJHR9g76V+tdqkWGZYiKr84pg pP7oZns/4hVLJZgubksdHiZEuYPBt3G0O6tbO8jj+AKVa0MiLukHk7D2I6i4m0dN QOGTYtmS1PU2BMXzg1SfDjL+KHniDfKJnd3oVqRkCZc+IPa6xUNVHKhK9ni8BqmA 490bAwG9FFHEl/tOOm6V5LEP0dvzVv4pFFV/jzRQNzaTpUU9fOOlzuXbJU8oozMC IGhl5bK9/RhjkjW0tK8dUUKmNeB6j0ugL8cdodasGLPdWIo9HZGouksHSw8zMjdH qeX2zRxgeWiiyYCPg4+u4ruur3c2qqbvvLrd00IIqAX2DXPUUBE+sni+zOI5GBhK 2qyi/IuxXxHYtyXE9vtcGy+VyKx7LtwZb3cYv/ovlZbPtKSIelktmCQWOMPV89fo rn/3cROAxh8FlNgUOBSCwN+aHW9lZZZrvUrr0FQKcReL6L7w4gjsMoCXCjRAgPPT Z0wC7Pe/ZWBZt55ZyWqN3Yvh/Yomi9NMeuKZW8jFmTGSL4Bhht0JbbXi+xHtgH7J Wbl49F1ScqPtVGBiNIaX
=jhKE
-----END PGP SIGNATURE-----