From ff71df0e88b23ca43fd49a14cdb26ff8bb9fe7eb Mon Sep 17 00:00:00 2001 From: Valentin Rothberg Date: Tue, 11 Jul 2023 15:40:12 +0200 Subject: [PATCH] system service: unset listen fds on tcp Disable leaking the LISTEN_* variables into containers which are observed to be passed by systemd even without being socket activated as described in https://access.redhat.com/solutions/6512011. [NO NEW TESTS NEEDED] - Ultimately, the solution 6512011 should be updated. Fixes: bugzilla.redhat.com/show_bug.cgi?id=2180483 Signed-off-by: Valentin Rothberg --- cmd/podman/system/service_abi.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/cmd/podman/system/service_abi.go b/cmd/podman/system/service_abi.go index f5ae6fd509..db4a08f5d5 100644 --- a/cmd/podman/system/service_abi.go +++ b/cmd/podman/system/service_abi.go @@ -96,6 +96,18 @@ func restService(flags *pflag.FlagSet, cfg *entities.PodmanConfig, opts entities libpodRuntime.SetRemoteURI(uri.String()) } + // bugzilla.redhat.com/show_bug.cgi?id=2180483: + // + // Disable leaking the LISTEN_* into containers which + // are observed to be passed by systemd even without + // being socket activated as described in + // https://access.redhat.com/solutions/6512011. + for _, val := range []string{"LISTEN_FDS", "LISTEN_PID", "LISTEN_FDNAMES"} { + if err := os.Unsetenv(val); err != nil { + return fmt.Errorf("unsetting %s: %v", val, err) + } + } + // Set stdin to /dev/null, so shortnames will not prompt devNullfile, err := os.Open(os.DevNull) if err != nil {