upgrading from 1.04 to 1.0.18 , lldpd is stuck in loop after systemctl restart lldpd about lldpd

[vincentbernat]

What's the output of systemctl cat lldpd?

[kanna-uk]

Hi Vincent,
thank you for prompt reply.
Here is the ouput
root@tiger:~# systemctl cat lldpd.service

/lib/systemd/system/lldpd.service

[Unit]
Description=LLDP daemon
Documentation=man:lldpd(8)
After=network-online.target networking.service syslog.service
RequiresMountsFor=/var/run/lldpd

[Service]
Type=notify
NotifyAccess=main
EnvironmentFile=-/etc/default/lldpd
EnvironmentFile=-/etc/sysconfig/lldpd
ExecStart=/usr/sbin/lldpd $DAEMON_ARGS $LLDPD_OPTIONS
Restart=always
StartLimitInterval=180
StartLimitBurst=3
TimeoutStartSec=30
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=yes
ProtectSystem=full

systemd v232 and higher, only.

#ProtectKernelTunables=yes
#ProtectControlGroups=yes
#ProtectKernelModules=yes
#ProtectSystem=full

Security hardening:

NoNewPrivileges=true
RestrictRealtime=true
LockPersonality=true
MemoryDenyWriteExecute=true
ProtectKernelLogs=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectKernelModules=true
ProtectControlGroups=true
ProtectHostname=true
ProtectClock=yes
UMask=0077
RestrictSUIDSGID=true
RestrictNamespaces=true
PrivateDevices=true
SystemCallFilter=~@clock @debug @reboot @raw-io @swap @module @obsolete @cpu-emulation
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target

[kanna-uk]

Just to add the following is the config present before hitting the loop...
DAEMON_ARGS="-c -i -M 4"
configure lldp tx-interval 30
configure lldp tx-hold 4

The intresting part is, if i add the DAEMON_ARGS like the following
DAEMON_ARGS="-dddd -D send -D main -D interfaces -D lldp -D decode -D event -D receive -D alloc -D loop c -M 4"

then do systemctl restart lldpd....i see the neighbours going through....but i do see an extra line in systemctl status lldpd along with the following lines

CGroup: /system.slice/lldpd.service
├─54215 "lldpd: monitor. "
└─54218 "lldpd: 6 neighbors."
|---- dddd -D send -D main -D interfaces -D lldp -D decode -D event -D receive -D alloc -D loop c. -----> similar to this

I am really interested to know the issue here.
Thank you in advance

[kanna-uk]

HI Vincent,
Could you please let me know

[vincentbernat]

The .service file is not the one shipped by lldpd. I suppose it was tweaked by Cumulus Linux. Notably, there are many restrictions. Also, in general, I don't think this is a good idea replacing Cumulus version of lldpd with the upstream one. You are likely to get more problems for that.