#1121938 monit: check program causes Monit to crash on Debian Trixie unless script is wrapped with /bin/sh -c

Package:
monit
Source:
monit
Description:
utility for monitoring and managing daemons or similar programs
Submitter:
J
Date:
2025-12-04 22:51:02 UTC
Severity:
normal
#1121938#5
Date:
2025-12-04 22:48:01 UTC
From:
To:
Dear Maintainer,

After upgrading from Debian Bookworm to Trixie, Monit began failing to start
whenever a "check program" block executes a script *directly*. Monit
validates
the configuration successfully (`monit -t` reports "Control file syntax
OK"),
but the daemon then crashes or starts without the HTTP interface, leading to
`systemctl status monit` showing:

  monit.service: Main process exited, status=1/FAILURE

This problem occurs only on Trixie’s Monit 5.34.3 package. The same config
worked fine on Bookworm.
-------------------------------------------------------------------------------
Minimal reproducible example
-------------------------------------------------------------------------------

1. Create a simple script:

   #!/bin/bash
   exit 1

2. Monit configuration that **fails**:

   check program test with path "/home/user/test.sh
<https://bitli.pro/2Ehxf_cda8f386>" timeout 15 seconds
     if status != 0 then exec "/bin/true"

3. Monit reports configuration OK, but the daemon crashes or refuses HTTP.

4. Changing only the path to use a shell wrapper makes it work:

   check program test with path "/bin/sh -c '/home/user/test.sh
<https://bitli.pro/2Ehxg_d8e2d88c>'" timeout 15 seconds
     if status != 0 then exec "/bin/true"

With `/bin/sh -c`, Monit starts normally and all behavior is restored.
Without it, Monit consistently fails on Trixie.

-------------------------------------------------------------------------------
Real-world configuration that broke after upgrading
-------------------------------------------------------------------------------

  check program ISP with path "/home/pi/checkISP.sh
<https://bitli.pro/2Ehxh_d7b03e4d>" timeout 15 seconds
    start program   = "/home/pi/Mullvad.sh
<https://bitli.pro/2Ehxi_16963e2f> start"   timeout 15 seconds
    stop program    = "/home/pi/Mullvad.sh
<https://bitli.pro/2Ehxj_8a78cced> stop"    timeout 15 seconds
    restart program = "/home/pi/Mullvad.sh
<https://bitli.pro/2Ehxk_82bad976> restart" timeout 15 seconds

    if status != 0 for 2 cycles then restart
    if 5 restarts within 5 cycles then timeout

This worked on Bookworm.
On Trixie, Monit fails unless the script paths are rewritten:

  path "/bin/sh -c '/home/pi/checkISP.sh <https://bitli.pro/2Ehxl_b471b4eb>
'"



-------------------------------------------------------------------------------
Expected behavior
-------------------------------------------------------------------------------

Monit should be able to execute a script directly via `check program`
without
requiring `/bin/sh -c`.



-------------------------------------------------------------------------------
Actual behavior
-------------------------------------------------------------------------------

- Monit daemon fails to start cleanly
- `monit summary` reports “daemon not running”
- systemd marks the service as exited with status=1



-------------------------------------------------------------------------------
System info
-------------------------------------------------------------------------------

Debian version: 13 (Trixie)
Package: monit 1:5.34.3-1
Init system: systemd 256



-------------------------------------------------------------------------------


Thank you.