podman generate systemd --new can be broken by environment variable substitution and specifier expansion

[ntkme]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

When you have a container with environment variable syntax in command or systemd specifiers, systemd will attempt to expand those result in broken container.

Steps to reproduce the issue:

1. podman run -d --name sleep alpine sh -c 'kill -0 $$ && sleep infinity'
2. podman generate systemd --name --new sleep
3. Start the generated service.

Describe the results you received:

Container will crash with error kill: illegal pid: $. The reason is that systemd will expand environment variable before executing the command. Also, systemd uses $$ to escape a single $, therefore the executed command will be no longer the same as the original command.

Describe the results you expected:

Container will start in the same way as original podman command.

Additional information you deem important (e.g. issue happens only occasionally):

If the executable path is prefixed with ":", environment variable substitution (as described by the "Command Lines" section below) is not applied.

However, this issue is not only limited to literal $ in command line being expanded environment variable as by systemd, literal % may also expanded by systemd as specifiers. For example, if I have printf '%s' 'test', it will become printf '/bin/sh' 'test'.

Reference for how systemd expand command line:
https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStart=
https://www.freedesktop.org/software/systemd/man/systemd.service.html#Command%20lines
https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Specifiers

Output of podman version:

Version:      2.2.1
API Version:  2.1.0
Go Version:   go1.15.5
Built:        Tue Dec  8 14:38:08 2020
OS/Arch:      linux/arm64

[ntkme]

Not sure if it is sufficient, but I think replacing $ with $$ and % with %% for the command line arguments given to the container should fix this.

[vrothberg]

Thanks for reaching out, @ntkme!

Not sure if it is sufficient, but I think replacing $ with $$ and % with %% for the command line arguments given to the container should fix this.

I am open to this idea. @Luap99 what do you think?

[Luap99]

SGTM, we also have to escape a backslash according to the systemd documentation.

[vrothberg]

SGTM, we also have to escape a backslash according to the systemd documentation.

Perfect! Do you have cycles to tackle the issue? I appreciated to have another pair of eyes on the systemd-gen code :)

[Luap99]

Yes I will take this one.