start with NOTIFYACCESS=all but then sd_notify(0, "NOTIFYACCESS=main")

[eriksjolund]

Just an idea. I don't know if it would work.

Currently the podman generate systemd ... generates a unit with

NotifyAccess=all

and

--sdnotify=conmon

Click me

[test@localhost ~]$ podman run --rm --name sleep -d docker.io/alpine sleep inf
6e1a42817ea82c3e96acccd8c3648b89b199a61da059333c286cc6c327e860a8
[test@localhost ~]$ podman generate systemd --name --new sleep
# container-sleep.service
# autogenerated by Podman 4.5.0
# Mon Jun  5 19:09:27 UTC 2023

[Unit]
Description=Podman container-sleep.service
Documentation=man:podman-generate-systemd(1)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=%t/containers

[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=on-failure
TimeoutStopSec=70
ExecStart=/usr/bin/podman run \
	--cidfile=%t/%n.ctr-id \
	--cgroups=no-conmon \
	--rm \
	--sdnotify=conmon \
	--replace \
	--name sleep \
	-d docker.io/alpine sleep inf
ExecStop=/usr/bin/podman stop \
	--ignore -t 10 \
	--cidfile=%t/%n.ctr-id
ExecStopPost=/usr/bin/podman rm \
	-f \
	--ignore -t 10 \
	--cidfile=%t/%n.ctr-id
Type=notify
NotifyAccess=all

[Install]
WantedBy=default.target

Maybe Podman could restrict NotifyAccess to main after the mainpid has been set with sd_notify?

There is a new feature in systemd that might be useful

• core: support overriding NOTIFYACCESS= through sd-notify during runtime systemd/systemd#26214

https://github.com/systemd/systemd/blob/6aea5ce814c0723474e0741df45dbf2c202ba739/man/sd_notify.xml#L169-L175

(the feature has not yet landed in a release)

[rhatdan]

Does this apply to quadlet?

[eriksjolund]

I think the situation for quadlet and podman generate systemd services should be roughly the same.

After thinking a bit more, maybe activating NOTIFYACCESS=main at runtime does not improve security that much.
A container has no access to the original notify socket so it would mostly matter to the programs running on the host, for example slirp4netns.
(disclaimer: I have only a sketchy understanding of how all of this works)