core: rework unit timeout handling, and add new setting RuntimeMaxSec=

This clean-ups timeout handling in PID 1. Specifically, instead of storing 0 in internal timeout variables as
indication for a disabled timeout, use USEC_INFINITY which is in-line with how we do this in the rest of our code
(following the logic that 0 means "no", and USEC_INFINITY means "never").

This also replace all usec_t additions with invocations to usec_add(), so that USEC_INFINITY is properly propagated,
and sd-event considers it has indication for turning off the event source.

This also alters the deserialization of the units to restart timeouts from the time they were originally started from.
Before this patch timeouts would be restarted beginning with the time of the deserialization, which could lead to
artificially prolonged timeouts if a daemon reload took place.

Finally, a new RuntimeMaxSec= setting is introduced for service units, that specifies a maximum runtime after which a
specific service is forcibly terminated. This is useful to put time limits on time-intensive processing jobs.

This also simplifies the various xyz_spawn() calls of the various types in that explicit distruction of the timers is
removed, as that is done anyway by the state change handlers, and a state change is always done when the xyz_spawn()
calls fail.

Fixes: #2249

diff --git a/src/shared/bus-util.c b/src/shared/bus-util.c
index f97d5b384669ba319ddf7c476536d8c3ee243d5d..703360f7f8798ebcd011ff44f53228a4e8d45d53 100644 (file)
--- a/src/shared/bus-util.c
+++ b/src/shared/bus-util.c
@@ -1438,7 +1438,7 @@ int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignmen
                                           eq[0] == '-');
                 goto finish;
 
-        } else if (STR_IN_SET(field, "AccuracySec", "RandomizedDelaySec")) {
+        } else if (STR_IN_SET(field, "AccuracySec", "RandomizedDelaySec", "RuntimeMaxSec")) {
                 char *n;
                 usec_t t;
                 size_t l;