Don't use systemd socket activation becuase startup ordering is weird.

Cargo.toml

@@ -21,7 +21,6 @@ slog-term = "^2.6"
 nix = "^0.18"
 num-derive = "^0.2"
 num-traits = "^0.2"
-systemd = "^0.6"
 
 [dev-dependencies]
 criterion = "^0.3"

README.md

@@ -17,15 +17,18 @@ and mailing lists.
 
 ## Installing
 
-You can use the provided debian package to install `nsncd` to run under
-`systemd`. It currently only works when managed by `systemd`, if you're
-interested in managing it in other ways, we'd need to modify how process startup
-works.
+Just run the `nsncd` binary and it will listen at `/var/run/nscd/socket`.
+There's a simple `systemd` unit file, too.
+
+If you're on a Debian-based system, you can use the provided Debian package to
+install `nsncd` to run under `systemd`. See `debian/README.source` for how to
+build it - we use a few Rust crates that aren't packaged for stable Debian
+releases.
 
 ## Bug Reports and Contributions
 
 Please create GitHub issues and/or pull requests.
 
 ## License
 
-`nsncd` is licensed under the [Apache License 2.0](./LICENSE).
+`nsncd` is licensed under the [Apache License 2.0](./LICENSE).

debian/Cargo.toml.append

@@ -1,5 +1,4 @@
 
 
 [patch.crates-io]
-systemd = { path = "vendor-patched/systemd" }
 syn = { path = "vendor/syn" }

debian/README.source

@@ -16,9 +16,6 @@ internet.
 
 The "debian/rules vendor" target does the following:
  - Runs "cargo vendor" and sets up Cargo configuration
- - Works around an issue where the current version of rustc in
-   Stretch/Buster fails to compile the latest version of the "systemd"
-   crate
  - Works around an issue where the "syn" crate includes a .gitignore
    file, which is automatically ignored by dpkg-source when building the
    source package

debian/changelog

@@ -1,3 +1,11 @@
+nsncd (1.1) unstable; urgency=medium
+
+  * Handle requests with internal NULs (fixes twosigma/nsncd#7).
+  * Remove systemd socket activation (fixes twosigma/nsncd#9, internal
+    issue SPDE-8114).
+
+ -- Geoffrey Thomas <geofft@twosigma.com>  Mon, 08 Mar 2021 14:06:57 -0500
+
 nsncd (1.0) unstable; urgency=medium
 
   * Initial release.

debian/control

@@ -2,7 +2,7 @@ Source: nsncd
 Section: misc
 Priority: optional
 Maintainer: Geoffrey Thomas <geofft@twosigma.com>
-Build-Depends: debhelper (>= 12), cargo, libsystemd-dev, pkg-config
+Build-Depends: debhelper (>= 12), cargo, pkg-config
 Standards-Version: 3.9.8
 Homepage: https://github.com/twosigma/nsncd
 VCS-Git: https://github.com/twosigma/nsncd

debian/install

@@ -1,3 +1,2 @@
 target/release/nsncd usr/lib
 *.service lib/systemd/system
-*.socket lib/systemd/system

debian/rules

@@ -10,9 +10,5 @@ override_dh_auto_build:
 vendor:
 	mkdir -p .cargo
 	cargo vendor > .cargo/config
-	mkdir vendor-patched
-	mv vendor/systemd vendor-patched
-	find vendor-patched/systemd -name .cargo-checksum.json -delete
-	find vendor-patched/systemd -name \*.rs -exec sed -i 's/use \(\(..*\)::.*\) as \2/use ::\1 as \2/' {} +
 	cat debian/Cargo.toml.append >> Cargo.toml
 	echo 'nsncd: source-is-missing vendor/*' > debian/source/lintian-overrides

nsncd.service

@@ -18,3 +18,6 @@ Description=name-service non-caching daemon
 [Service]
 ExecStart=/usr/lib/nsncd
 Restart=always
+
+[Install]
+WantedBy=multi-user.target

src/main.rs

@@ -45,17 +45,15 @@
 // - daemon/pidfile stuff
 
 use std::io::prelude::*;
-use std::os::unix::{
-    io::FromRawFd,
-    net::{UnixListener, UnixStream},
-};
+use std::os::unix::fs::PermissionsExt;
+use std::os::unix::net::{UnixListener, UnixStream};
+use std::path::Path;
 use std::thread;
 
-use anyhow::{ensure, Context, Result};
+use anyhow::{Context, Result};
 use slog::{debug, error, Drain};
 use slog_async;
 use slog_term;
-use systemd::daemon::{listen_fds, LISTEN_FDS_START};
 
 mod ffi;
 mod handlers;
@@ -74,6 +72,8 @@ fn handle_stream(log: &slog::Logger, mut stream: UnixStream) -> Result<()> {
     Ok(())
 }
 
+const SOCKET_PATH: &str = "/var/run/nscd/socket";
+
 fn main() -> Result<()> {
     ffi::disable_internal_nscd();
 
@@ -83,13 +83,11 @@ fn main() -> Result<()> {
 
     let logger = slog::Logger::root(drain, slog::o!());
 
-    let listen_fds_found = listen_fds(true)?;
-    ensure!(
-        listen_fds_found == 1,
-        "expected one listen fd, got {}",
-        listen_fds_found
-    );
-    let listener = unsafe { UnixListener::from_raw_fd(LISTEN_FDS_START) };
+    let path = Path::new(SOCKET_PATH);
+    std::fs::create_dir_all(path.parent().expect("socket path has no parent"))?;
+    std::fs::remove_file(path).ok();
+    let listener = UnixListener::bind(path).context("could not bind to socket")?;
+    std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o777))?;
 
     for stream in listener.incoming() {
         match stream {