{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/rkt/issues/2493","repository_url":"https://api.github.com/repos/coreos/rkt","labels_url":"https://api.github.com/repos/coreos/rkt/issues/2493/labels{/name}","comments_url":"https://api.github.com/repos/coreos/rkt/issues/2493/comments","events_url":"https://api.github.com/repos/coreos/rkt/issues/2493/events","html_url":"https://github.com/coreos/rkt/pull/2493","id":150416522,"number":2493,"title":"stage1: replace appexec with pure systemd","user":{"login":"iaguis","id":507354,"avatar_url":"https://avatars.githubusercontent.com/u/507354?v=3","gravatar_id":"","url":"https://api.github.com/users/iaguis","html_url":"https://github.com/iaguis","followers_url":"https://api.github.com/users/iaguis/followers","following_url":"https://api.github.com/users/iaguis/following{/other_user}","gists_url":"https://api.github.com/users/iaguis/gists{/gist_id}","starred_url":"https://api.github.com/users/iaguis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iaguis/subscriptions","organizations_url":"https://api.github.com/users/iaguis/orgs","repos_url":"https://api.github.com/users/iaguis/repos","events_url":"https://api.github.com/users/iaguis/events{/privacy}","received_events_url":"https://api.github.com/users/iaguis/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/coreos/rkt/labels/area/security","name":"area/security","color":"bfe5bf"},{"url":"https://api.github.com/repos/coreos/rkt/labels/component/stage1","name":"component/stage1","color":"0052cc"},{"url":"https://api.github.com/repos/coreos/rkt/labels/kind/design","name":"kind/design","color":"c7def8"},{"url":"https://api.github.com/repos/coreos/rkt/labels/kind/enhancement","name":"kind/enhancement","color":"c7def8"},{"url":"https://api.github.com/repos/coreos/rkt/labels/priority/P1","name":"priority/P1","color":"eb6420"},{"url":"https://api.github.com/repos/coreos/rkt/labels/reviewed/needs%20rework","name":"reviewed/needs rework","color":"bfdadc"},{"url":"https://api.github.com/repos/coreos/rkt/labels/technology/systemd","name":"technology/systemd","color":"d4c5f9"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/coreos/rkt/milestones/36","html_url":"https://github.com/coreos/rkt/milestones/v1.5.0","labels_url":"https://api.github.com/repos/coreos/rkt/milestones/36/labels","id":1676113,"number":36,"title":"v1.5.0","description":"","creator":{"login":"alban","id":27575,"avatar_url":"https://avatars.githubusercontent.com/u/27575?v=3","gravatar_id":"","url":"https://api.github.com/users/alban","html_url":"https://github.com/alban","followers_url":"https://api.github.com/users/alban/followers","following_url":"https://api.github.com/users/alban/following{/other_user}","gists_url":"https://api.github.com/users/alban/gists{/gist_id}","starred_url":"https://api.github.com/users/alban/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alban/subscriptions","organizations_url":"https://api.github.com/users/alban/orgs","repos_url":"https://api.github.com/users/alban/repos","events_url":"https://api.github.com/users/alban/events{/privacy}","received_events_url":"https://api.github.com/users/alban/received_events","type":"User","site_admin":false},"open_issues":68,"closed_issues":26,"state":"open","created_at":"2016-03-31T14:05:09Z","updated_at":"2016-04-26T12:04:46Z","due_on":"2016-04-27T22:00:00Z","closed_at":null},"comments":6,"created_at":"2016-04-22T16:36:52Z","updated_at":"2016-04-26T12:23:17Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/coreos/rkt/pulls/2493","html_url":"https://github.com/coreos/rkt/pull/2493","diff_url":"https://github.com/coreos/rkt/pull/2493.diff","patch_url":"https://github.com/coreos/rkt/pull/2493.patch"},"body":"This PR replaces the following functionality implemented in appexec with systemd options (thanks @alban for the table):\r\n\r\nappexec | systemd option\r\n------------ | -------------\r\nchroot | [RootDirectory=](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#RootDirectory=) (systemd >= v220, https://github.com/systemd/systemd/commit/ee818b89f4890b3a00e93772249fce810f60811e)\r\nchdir | [WorkingDirectory=](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#WorkingDirectory=)\r\nsetenv | [EnvironmentFile=](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#EnvironmentFile=)\r\nsetresgid, setresgid | [User=, Group=](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#User=)\r\nsetgroups | [SupplementaryGroups=](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#SupplementaryGroups=)\r\nexecvp | [ExecStart=](https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStart=)\r\n$PATH lookup | implemented when writing the unit file\r\nELF diagnostic | not yet implemented, see [bfo#89840](https://bugs.freedesktop.org/show_bug.cgi?id=89840)\r\n\r\nDoing this allows us to restrict the capabilities granted to apps, including `CAP_SYS_ADMIN` (see https://github.com/coreos/rkt/issues/576 for loooots of context).\r\n\r\nWe still use enterexec for entering (hence the name change).\r\n\r\nTODOs:\r\n\r\nShould be fixed in this PR:\r\n\r\n- [x] The current `$PATH` resolving code doesn't handle the case where the exec binary is a symlink to an absolute path.\r\n- [x] Code cleanup.\r\n- [x] Write proper commit messages.\r\n- [x] Fix some weird Semaphore failures on flavor src-v229.  \r\n\r\nWe can fix this later:\r\n\r\n- Investigate using a new mount namespace for each app with options like [ReadWriteDirectories=, ReadOnlyDirectories=, InaccessibleDirectories=](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ReadWriteDirectories=) (https://github.com/coreos/rkt/issues/2483)\r\n- Bring the ELF diagnostic functionality back for `rkt run` (https://github.com/coreos/rkt/issues/2506).\r\n- We should use the systemd environment file format in `enterexec` (the new name for `appexec`) to remove code duplication (https://github.com/coreos/rkt/issues/2507).\r\n\r\nFixes #2505 "},"comment":{"url":"https://api.github.com/repos/coreos/rkt/issues/comments/214722076","html_url":"https://github.com/coreos/rkt/pull/2493#issuecomment-214722076","issue_url":"https://api.github.com/repos/coreos/rkt/issues/2493","id":214722076,"user":{"login":"tmrts","id":5067495,"avatar_url":"https://avatars.githubusercontent.com/u/5067495?v=3","gravatar_id":"","url":"https://api.github.com/users/tmrts","html_url":"https://github.com/tmrts","followers_url":"https://api.github.com/users/tmrts/followers","following_url":"https://api.github.com/users/tmrts/following{/other_user}","gists_url":"https://api.github.com/users/tmrts/gists{/gist_id}","starred_url":"https://api.github.com/users/tmrts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tmrts/subscriptions","organizations_url":"https://api.github.com/users/tmrts/orgs","repos_url":"https://api.github.com/users/tmrts/repos","events_url":"https://api.github.com/users/tmrts/events{/privacy}","received_events_url":"https://api.github.com/users/tmrts/received_events","type":"User","site_admin":false},"created_at":"2016-04-26T12:23:17Z","updated_at":"2016-04-26T12:23:17Z","body":"@iaguis `appExec` is still used in `rkt/run.go`, `rkt/prepare.go`, `rkt/cli_apps.go`. Shouldn't they be renamed to `enterexec` or removed?"}}