shutdown: use 90s SIGKILL timeout

There's really no reason to use 10s here, let's instead default to 90s like we
do for everything else.

The SIGKILL during the final killing spree is in most regards the fourth level
of a safety net, after all: any normal service should have already been stopped
during the normal service shutdown logic, first via SIGTERM and then SIGKILL,
and then also via SIGTERM during the finall killing spree before we send
SIGKILL. And as a fourth level safety net it should only be required in
exceptional cases, which means it's safe to rais the default timeout, as normal
shutdowns should never be delayed by it.

Note that journald excludes itself from the normal service shutdown, and relies
on the final killing spree to terminate it (this is because it wants to cover
the normal shutdown phase's complete logging). If the system's IO is
excessively slow, then the 10s might not be enough for journald to sync
everything to disk and logs might get lost during shutdown.

1 files changed, 2 insertions, 3 deletions

diff --git a/src/core/killall.c b/src/core/killall.c
index e1359b72d2..a8b814e868 100644
--- a/src/core/killall.c
+++ b/src/core/killall.c
@@ -23,6 +23,7 @@
 #include <unistd.h>
 
 #include "alloc-util.h"
+#include "def.h"
 #include "fd-util.h"
 #include "formats-util.h"
 #include "killall.h"
@@ -33,8 +34,6 @@
 #include "terminal-util.h"
 #include "util.h"
 
-#define TIMEOUT_USEC (10 * USEC_PER_SEC)
-
 static bool ignore_proc(pid_t pid, bool warn_rootfs) {
         _cleanup_fclose_ FILE *f = NULL;
         char c;
@@ -99,7 +98,7 @@ static void wait_for_children(Set *pids, sigset_t *mask) {
         if (set_isempty(pids))
                 return;
 
-        until = now(CLOCK_MONOTONIC) + TIMEOUT_USEC;
+        until = now(CLOCK_MONOTONIC) + DEFAULT_TIMEOUT_USEC;
         for (;;) {
                 struct timespec ts;
                 int k;