OpenFile= systemd directive is now available in Fedora CoreOS next stream

[eriksjolund]

The new systemd directive OpenFile= is available in systemd 253 (released 15 February 2023).

I think OpenFile= could be useful for Podman, especially if it could be
combined with

• support User= in systemd for running rootless services #12778

The Fedora CoreOS next stream (currently
38.20230310.1.0) ships systemd 253

I booted up fedora-coreos-38.20230310.1.0-qemu.aarch64.qcow2

[core@localhost ~]$ rpm -q systemd
systemd-253-1.fc38.aarch64
[core@localhost ~]$

and made a minimal test with OpenFile=.

(I didn't test OpenFile= together with Podman)

1. As root create the file /etc/systemd/system/onefile.service with the file contents

   [Service]
   User=core
   Group=core
   ExecStart=/usr/bin/bash -c "cat <&3"  
   StandardOutput=journal
   OpenFile=/etc/secretfile:testfdname:read-only
   Type=oneshot
   
   [Install]
   WantedBy=multi-user.target
   

2. As root create the file /etc/secretfile with the file contents

   hello from secret file`
   

   and set restricted file permissions on the file so that the user
   core does not have read access to the file.

   # echo hello from secret file > /etc/secretfile
   # chmod 600 /etc/secretfile
   

3. Run commands

   # systemctl daemon-reload
   # systemctl start onefile.service 
   # journalctl --no-pager -xeu onefile.service | grep hello
   Mar 14 19:57:18 localhost.localdomain bash[4160]: hello from secret file
   # 
   

The systemd system service onefile.service was able to print "hello from secret file" to the journal.
The file /etc/secretfile could be read by the service although the user core does not have read permission to the file.

[vrothberg]

Thanks for sharing, @eriksjolund!

@alexlarsson WDYT?

[rhatdan]

THis could be an easy way to leak an open unix domain socket into a container without having to put the path into the container.

Would also eliminate file permission problems. SELinux would still need to be dealt with.

[eriksjolund]

Passing in FDs into the container would be useful.

Maybe it could also be useful for passing in FDs for internal use of podman, conmon, crun?

For example to fix ownership of PID files

Quote from GitHub issue comment:
This is a limitation on the systemd side. They will only accept notifications,
or PID files, that are created by or sent by root, for security reasons - even
if the User and Group of the unit file are explicitly set to start
the process as a non-root user.