Process 1 (aka init) needs to be started with an empty signal mask.  That
includes the process 1 that's started after the initrd is finished.  When the
initrd is using systemd (as it does with dracut based initrds) then it is
systemd that calls the real init.  Normally this is systemd again, except
when the user uses for instance "init=/bin/bash" on the kernel command line.

---
 main.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- src/core/main.c
+++ src/core/main.c	2014-02-27 13:54:21.922236495 +0000
@@ -1780,6 +1780,7 @@ finish:
         if (reexecute) {
                 const char **args;
                 unsigned i, args_size;
+                sigset_t ss, o_ss;
 
                 /* Close and disarm the watchdog, so that the new
                  * instance can reinitialize it, but doesn't get
@@ -1863,6 +1864,11 @@ finish:
                 args[i++] = NULL;
                 assert(i <= args_size);
 
+                /* reenable any blocked signals, especially important
+                 * if we switch from initial ramdisk to init=... */
+                sigemptyset(&ss);
+                sigprocmask(SIG_SETMASK,&ss,&o_ss);
+
                 if (switch_root_init) {
                         args[0] = switch_root_init;
                         execv(args[0], (char* const*) args);
@@ -1881,6 +1887,9 @@ finish:
                         log_error("Failed to execute /bin/sh, giving up: %m");
                 } else
                         log_warning("Failed to execute /sbin/init, giving up: %m");
+
+                /* back to saved state if reexec failed */
+                sigprocmask(SIG_SETMASK,&o_ss,NULL);
         }
 
         if (arg_serialization) {