Merge pull request #12918 from teacup-on-rockingchair/systemctl_remed…

…iations_for_non_running_system Add systemd check if it is running for systemctl start commands
ComplianceAsCode · Jan 29, 2025 · 7d23e5b · 7d23e5b
2 parents 9e4c6ee + 7a1927a
commit 7d23e5b
Show file tree

Hide file tree

Showing 8 changed files with 30 additions and 8 deletions.
diff --git a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/bash/shared.sh b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/bash/shared.sh
@@ -17,7 +17,9 @@ sed -i '/^\s*\(weekly\|monthly\|yearly\).*$/d' $LOGROTATE_CONF_FILE
 {{% if 'sle' in product or product == 'slmicro5' %}}
 # enable logrotate timer service
 "$SYSTEMCTL_EXEC" unmask 'logrotate.timer'
-"$SYSTEMCTL_EXEC" start 'logrotate.timer'
+if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
+  "$SYSTEMCTL_EXEC" start 'logrotate.timer'
+fi
 "$SYSTEMCTL_EXEC" enable 'logrotate.timer'
 {{% else %}}
 # configure cron.daily if not already

diff --git a/...are/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh b/...are/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh
@@ -31,4 +31,8 @@ chmod 0644 /etc/systemd/system/aidecheck.*
 # enable the aide related services
 systemctl daemon-reload
 systemctl enable aidecheck.service
-systemctl --now enable aidecheck.timer
+systemctl enable aidecheck.timer
+
+if [[ $(systemctl is-system-running) != "offline" ]]; then
+  systemctl start aidecheck.timer
+fi
diff --git a/shared/macros/10-bash.jinja b/shared/macros/10-bash.jinja
@@ -684,11 +684,15 @@ Macro to enable or disable a particular service.
 #}}
 {{%- if init_system == "systemd" -%}}
   {{%- if service_state == "disable" -%}}
+if [[ $(/usr/bin/systemctl is-system-running) != "offline" ]]; then
 /usr/bin/systemctl stop "{{{ service }}}"
+fi
 /usr/bin/systemctl disable "{{{ service }}}"
   {{%- else -%}}
 /usr/bin/systemctl enable "{{{ service }}}"
+if [[ $(/usr/bin/systemctl is-system-running) != "offline" ]]; then
 /usr/bin/systemctl start "{{{ service }}}"
+fi
   {{%- endif %}}
 # The service may not be running because it has been started and failed,
 # so let's reset the state so OVAL checks pass.

diff --git a/shared/templates/service_disabled/bash.template b/shared/templates/service_disabled/bash.template
@@ -7,12 +7,16 @@
 
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
-"$SYSTEMCTL_EXEC" stop '{{{ DAEMONNAME }}}.service'
+if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
+  "$SYSTEMCTL_EXEC" stop '{{{ DAEMONNAME }}}.service'
+fi
 "$SYSTEMCTL_EXEC" disable '{{{ DAEMONNAME }}}.service'
 "$SYSTEMCTL_EXEC" mask '{{{ DAEMONNAME }}}.service'
 # Disable socket activation if we have a unit file for it
 if "$SYSTEMCTL_EXEC" -q list-unit-files {{{ DAEMONNAME }}}.socket; then
-    "$SYSTEMCTL_EXEC" stop '{{{ DAEMONNAME }}}.socket'
+    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
+      "$SYSTEMCTL_EXEC" stop '{{{ DAEMONNAME }}}.socket'
+    fi
     "$SYSTEMCTL_EXEC" mask '{{{ DAEMONNAME }}}.socket'
 fi
 # The service may not be running because it has been started and failed,

diff --git a/shared/templates/service_enabled/bash.template b/shared/templates/service_enabled/bash.template
@@ -7,7 +7,9 @@
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" unmask '{{{ DAEMONNAME }}}.service'
-"$SYSTEMCTL_EXEC" start '{{{ DAEMONNAME }}}.service'
+if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
+  "$SYSTEMCTL_EXEC" start '{{{ DAEMONNAME }}}.service'
+fi
 "$SYSTEMCTL_EXEC" enable '{{{ DAEMONNAME }}}.service'
 {{% else %}}
 JINJA TEMPLATE ERROR: Unknown init system '{{{ init_system }}}'

diff --git a/shared/templates/socket_disabled/bash.template b/shared/templates/socket_disabled/bash.template
@@ -8,6 +8,8 @@ SOCKET_NAME="{{{ SOCKETNAME }}}.socket"
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 
 if "$SYSTEMCTL_EXEC" -q list-unit-files --type socket | grep -q "$SOCKET_NAME"; then
-    "$SYSTEMCTL_EXEC" stop "$SOCKET_NAME"
+    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
+      "$SYSTEMCTL_EXEC" stop "$SOCKET_NAME"
+    fi
     "$SYSTEMCTL_EXEC" mask "$SOCKET_NAME"
 fi
diff --git a/shared/templates/systemd_mount_enabled/bash.template b/shared/templates/systemd_mount_enabled/bash.template
@@ -6,5 +6,7 @@
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" unmask '{{{ MOUNTNAME }}}.mount'
-"$SYSTEMCTL_EXEC" start '{{{ MOUNTNAME }}}.mount'
+if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
+  "$SYSTEMCTL_EXEC" start '{{{ MOUNTNAME }}}.mount'
+fi
 "$SYSTEMCTL_EXEC" enable '{{{ MOUNTNAME }}}.mount'
diff --git a/shared/templates/timer_enabled/bash.template b/shared/templates/timer_enabled/bash.template
@@ -5,5 +5,7 @@
 # disruption = low
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
-"$SYSTEMCTL_EXEC" start '{{{ TIMERNAME }}}.timer'
+if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
+  "$SYSTEMCTL_EXEC" start '{{{ TIMERNAME }}}.timer'
+fi
 "$SYSTEMCTL_EXEC" enable '{{{ TIMERNAME }}}.timer'