Bug 2368409

Summary:	Remove obsolete syslog.target ordering from php-fpm.service
Product:	[Fedora] Fedora	Reporter:	Marcos Mello <marcosfrm>
Component:	php	Assignee:	Remi Collet <fedora>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	low	Docs Contact:
Priority:	unspecified
Version:	42	CC:	fedora, jorton
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	php-8.4.8-1.fc42	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-06-13 01:02:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Marcos Mello 2025-05-25 01:13:23 UTC

php-fpm.service has "After=syslog.target network.target" in the [Unit] section. syslog.target no longer exists since the very old systemd 198 and is a useless ordering that can be removed.

See:
https://github.com/systemd/systemd/commit/5d4caf565471ff3401bd9b53aa814c8545a18a93

Reproducible: Always




Additional Information:
php-fpm-8.4.7-1.fc42.x86_64

Comment 1 Remi Collet 2025-05-26 09:20:04 UTC

Fixed in https://src.fedoraproject.org/rpms/php/c/3a8c58a81af1370a996829c109d3f88de0e4cc58?branch=f42


Will be part of 8.4.8 update, planned for next week (Thusday June 5th)

Comment 2 Marcos Mello 2025-05-26 18:20:28 UTC

By the way, upstream has a more complete service with hardening options:

https://github.com/php/php-src/blob/master/sapi/fpm/php-fpm.service.in

(I reported yesterday for KillMode=mixed to be added: https://github.com/php/php-src/issues/18655)

The difference that would need adaptation is the addition of RuntimeDirectory=php-fpm, since `pid = /run/php-fpm/php-fpm.pid` is used in /etc/php-fpm.conf, adjusting PIDFile= accordingly. `RuntimeDirectoryMode=` is 0755 by default, so it could be omitted.

Comment 3 Remi Collet 2025-05-27 05:51:50 UTC

> By the way, upstream has a more complete service with hardening options:

Yes, I'm aware of these options, but I'm reluctant to apply them

Ex: ProtectSystem=full

In manual install mode, a webapp will use a single tree with everything inside (sources, config, data...)
but a package webapp will put its config in /etc, and may require write access at installation time
and we have SElinux which protect /etc content

Comment 4 Fedora Update System 2025-06-05 05:41:59 UTC

FEDORA-2025-b2132a69ee (php-8.4.8-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-b2132a69ee

Comment 5 Fedora Update System 2025-06-13 01:02:22 UTC

FEDORA-2025-b2132a69ee (php-8.4.8-1.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.