units/serial-getty@.service \
units/console-getty.service \
units/container-getty@.service \
+ units/system-update-cleanup.service \
units/systemd-initctl.service \
units/systemd-remount-fs.service \
units/systemd-ask-password-wall.service \
units/console-getty.service.m4.in \
units/container-getty@.service.m4.in \
units/rescue.service.in \
+ units/system-update-cleanup.service.in \
units/systemd-initctl.service.in \
units/systemd-remount-fs.service.in \
units/systemd-update-utmp.service.in \
<listitem>
<para>The upgrade scripts should exit only after the update is finished. It is expected
that the service which performs the upgrade will cause the machine to reboot after it
- is done.</para>
+ is done. If the <filename>system-update.target</filename> is successfully reached, i.e.
+ all update services have run, and the <filename>/system-update</filename> symlink still
+ exists, it will be removed and the machine rebooted as a safety measure.</para>
</listitem>
<listitem>
<filename>sysinit.target</filename>,
<filename>syslog.socket</filename>,
<filename>system-update.target</filename>,
+ <filename>system-update-cleanup.service</filename>,
<filename>time-sync.target</filename>,
<filename>timers.target</filename>,
<filename>umount.target</filename>,
</varlistentry>
<varlistentry>
<term><filename>system-update.target</filename></term>
+ <term><filename>system-update-cleanup.service</filename></term>
<listitem>
<para>A special target unit that is used for offline system updates.
<citerefentry><refentrytitle>systemd-system-update-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>
exists. For more information see
<citerefentry><refentrytitle>systemd.offline-updates</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
</para>
+
+ <para>Updates should happen before the <filename>system-update.target</filename> is
+ reached, and the services which implement them should cause the machine to reboot. As
+ a safety measure, if this does not happen, and <filename>/system-update</filename>
+ still exists after <filename>system-update.target</filename> is reached,
+ <filename>system-update-cleanup.service</filename> will remove this symlink and
+ reboot the machine.</para>
</listitem>
</varlistentry>
<varlistentry>
/rc-local.service
/rescue.service
/serial-getty@.service
+/system-update-cleanup.service
/systemd-ask-password-console.service
/systemd-ask-password-wall.service
/systemd-backlight@.service
--- /dev/null
+# This file is part of systemd.
+#
+# systemd is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+
+[Unit]
+Description=Remove the Offline System Updates symlink
+Documentation=man:systemd.special(5) man:systemd.offline-updates(7)
+After=system-update.target
+DefaultDependencies=no
+Conflicts=shutdown.target
+
+# system-update-generator uses laccess("/system-update"), while a plain
+# ConditionPathExists=/system-update uses access("/system-update"), so
+# we need an alternate condition to cover the case of a dangling symlink.
+#
+# This service is only invoked if /system-update exists, i.e. if the
+# condition tested by system-update-generator remains true and the system
+# would be diverted into system-update.target again after reboot. This way
+# we guard against being diverted into system-update.target again, which
+# works as a safety measure, but we will not step on the toes of the
+# update script if it successfully removed the symlink and scheduled a
+# reboot or some other action on its own.
+ConditionPathExists=|/system-update
+ConditionPathIsSymbolicLink=|/system-update
+
+[Service]
+Type=oneshot
+ExecStart=/bin/rm -fv /system-update
+ExecStart=@SYSTEMCTL@ reboot
After=sysinit.target
Before=shutdown.target
AllowIsolate=yes
+Wants=system-update-cleanup.service