core: rework crash handling

This introduces a new systemd.crash_reboot=1 kernel command line option
that triggers a reboot after crashing.

This also cleans up crash VT handling. Specifically, it cleans up the
configuration setting, to be between 1..63 or a boolean. This is to
replace the previous logic where "-1" meant disabled. We continue to
accept that setting, but only document the boolean syntax instead.

This also brings the documentation of the default settings in sync with
what actually happens.

The CrashChVT= configuration file setting is renamed to CrashChangeVT=,
following our usual logic of not abbreviating unnecessarily. The old
setting stays support for compat reasons.

Fixes #1300

3 files changed, 80 insertions, 30 deletions

diff --git a/man/kernel-command-line.xml b/man/kernel-command-line.xml
index eb73727027..2f81746b5e 100644
--- a/man/kernel-command-line.xml
+++ b/man/kernel-command-line.xml
@@ -79,8 +79,9 @@
         <term><varname>systemd.unit=</varname></term>
         <term><varname>rd.systemd.unit=</varname></term>
         <term><varname>systemd.dump_core=</varname></term>
-        <term><varname>systemd.crash_shell=</varname></term>
         <term><varname>systemd.crash_chvt=</varname></term>
+        <term><varname>systemd.crash_shell=</varname></term>
+        <term><varname>systemd.crash_reboot=</varname></term>
         <term><varname>systemd.confirm_spawn=</varname></term>
         <term><varname>systemd.show_status=</varname></term>
         <term><varname>systemd.log_target=</varname></term>
diff --git a/man/systemd-system.conf.xml b/man/systemd-system.conf.xml
index a4ba0959ea..56db9ff17e 100644
--- a/man/systemd-system.conf.xml
+++ b/man/systemd-system.conf.xml
@@ -90,9 +90,10 @@
         <term><varname>LogColor=</varname></term>
         <term><varname>LogLocation=</varname></term>
         <term><varname>DumpCore=yes</varname></term>
+        <term><varname>CrashChangeVT=no</varname></term>
         <term><varname>CrashShell=no</varname></term>
+        <term><varname>CrashReboot=no</varname></term>
         <term><varname>ShowStatus=yes</varname></term>
-        <term><varname>CrashChVT=1</varname></term>
         <term><varname>DefaultStandardOutput=journal</varname></term>
         <term><varname>DefaultStandardError=inherit</varname></term>
 
diff --git a/man/systemd.xml b/man/systemd.xml
index 479f55de76..9e927c3204 100644
--- a/man/systemd.xml
+++ b/man/systemd.xml
@@ -1,4 +1,4 @@
-<?xml version='1.0'?> <!--*-nxml-*-->
+<?xml version='1.0'?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
 
@@ -131,17 +131,48 @@
       <varlistentry>
         <term><option>--dump-core</option></term>
 
-        <listitem><para>Dump core on crash. This switch has no effect
-        when run as user instance.</para></listitem>
+        <listitem><para>Enable core dumping on crash. This switch has
+        no effect when running as user instance. This setting may also
+        be enabled during boot on the kernel command line via the
+        <varname>systemd.dump_core=</varname> option, see
+        below.</para></listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><option>--crash-vt=</option><replaceable>VT</replaceable></term>
+
+        <listitem><para>Switch to a specific virtual console (VT) on
+        crash. Takes a positive integer in the range 1..63, or a
+        boolean argument. If an integer is passed, selects which VT to
+        switch to. If <constant>yes</constant>, the VT kernel messages
+        are written to is selected. If <constant>no</constant>, no VT
+        switch is attempted. This switch has no effect when running as
+        user instance. This setting may also be enabled during boot,
+        on the kernel command line via the
+        <varname>systemd.crash_vt=</varname> option, see
+        below.</para></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><option>--crash-shell</option></term>
 
-        <listitem><para>Run shell on
-        crash. This switch has no effect when
-        run as user
-        instance.</para></listitem>
+        <listitem><para>Run a shell on crash. This switch has no
+        effect when running as user instance. This setting may also be
+        enabled during boot, on the kernel command line via the
+        <varname>systemd.crash_shell=</varname> option, see
+        below.</para></listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><option>--crash-reboot</option></term>
+
+        <listitem><para>Automatically reboot the system on crash. This
+        switch has no effect when running as user instance. This
+        setting may also be enabled during boot, on the kernel command
+        line via the <varname>systemd.crash_reboot=</varname> option,
+        see below.</para></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><option>--confirm-spawn</option></term>
 
@@ -854,50 +885,67 @@
         <term><varname>systemd.dump_core=</varname></term>
 
         <listitem><para>Takes a boolean argument. If
-        <option>true</option>, systemd dumps core when it crashes.
-        Otherwise, no core dump is created. Defaults to
-        <option>true</option>.</para></listitem>
+        <option>yes</option>, the systemd manager (PID 1) dumps core
+        when it crashes.  Otherwise, no core dump is created. Defaults
+        to <option>yes</option>.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>systemd.crash_chvt=</varname></term>
+
+        <listitem><para>Takes a positive integer, or a boolean
+        argument. If a positive integer (in the range 1..63) is
+        specified the system manager (PID 1) will activate the specified
+        virtual terminal (VT) when it crashes. Defaults to
+        <constant>no</constant>, meaning that no such switch is
+        attempted. If set to <constant>yes</constant> the VT the
+        kernel messages are written to is selected.</para></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><varname>systemd.crash_shell=</varname></term>
 
         <listitem><para>Takes a boolean argument. If
-        <option>true</option>, systemd spawns a shell when it crashes.
-        Otherwise, no shell is spawned. Defaults to
-        <option>false</option>, for security reasons, as the shell is
-        not protected by any password
+        <option>yes</option>, the system manager (PID 1) spawns a
+        shell when it crashes, after a 10s delay. Otherwise, no shell
+        is spawned. Defaults to <option>no</option>, for security
+        reasons, as the shell is not protected by password
         authentication.</para></listitem>
       </varlistentry>
 
       <varlistentry>
-        <term><varname>systemd.crash_chvt=</varname></term>
+        <term><varname>systemd.crash_reboot=</varname></term>
 
-        <listitem><para>Takes an integer argument. If positive systemd
-        activates the specified virtual terminal when it crashes.
-        Defaults to <constant>-1</constant>.</para></listitem>
+        <listitem><para>Takes a boolean argument. If
+        <option>yes</option>, the system manager (PID 1) will reboot
+        the machine automatically when it crashes, after a 10s delay.
+        Otherwise, the system will hang indefinitely. Defaults to
+        <option>no</option>, in order to avoid a reboot loop. If
+        combined with <varname>systemd.crash_shell=</varname>, it is
+        first attempted to invoke a shell, and if this is not
+        successful the system is rebooted.</para></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><varname>systemd.confirm_spawn=</varname></term>
 
         <listitem><para>Takes a boolean argument. If
-        <option>true</option>, asks for confirmation when spawning
-        processes. Defaults to
-        <option>false</option>.</para></listitem>
+        <option>yes</option>, the system manager (PID 1) asks for
+        confirmation when spawning processes. Defaults to
+        <option>no</option>.</para></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><varname>systemd.show_status=</varname></term>
 
         <listitem><para>Takes a boolean argument or the constant
-        <constant>auto</constant>. If <option>true</option>, shows
-        terse service status updates on the console during bootup.
-        <constant>auto</constant> behaves like <option>false</option>
-        until a service fails or there is a significant delay in boot.
-        Defaults to <option>true</option>, unless
-        <option>quiet</option> is passed as kernel command line option
-        in which case it defaults to
+        <constant>auto</constant>. If <option>yes</option>, the
+        systemd manager (PID 1) shows terse service status updates on
+        the console during bootup.  <constant>auto</constant> behaves
+        like <option>false</option> until a service fails or there is
+        a significant delay in boot.  Defaults to
+        <option>yes</option>, unless <option>quiet</option> is passed
+        as kernel command line option in which case it defaults to
         <constant>auto</constant>.</para></listitem>
       </varlistentry>