Post #1103691
2026-04-09 10:42 UTC
@lanodan@queer.hacktivis.me I assume OpenRC doesn't authenticate the pid that connects to the notification socket, which isn't a problem in practice. If OpenRC wanted to fully harden against evil services notifying readiness for other services, its supervisor would need to add a whole layer of complexity for that.
But even then, I don't think it would need a synchronization mechanism, because who cares if the notifier is still around, as long as the main pid is?
s6's new s6-notify-fd-from-socket binary, doing the systemd-to-s6 protocol conversion, mitigates the problem by only using autobind with abstract sockets, so any foreign would-be notifier would need to guess the abstract socket name.
Replies (1)
-
@navi@social.vlhl.dev 2026-04-09 16:08
@ska @lanodan we don't auth it at all, and we open one socket per service one socket per-service means we don't need to use cgroups to locate the service like systemd does, but since we have cgroups support, we could add authentication against the cgroup except that would result on the same "race condition" wrt exiting, if the process exits and is reaped before the NOTIFY_SOCKET helper can auth-check it, then we can't auth-check it so to implement permission control on our NOTIFY_SOCKET helper we would also need to implement BARRIER, :blep: