Listen_fds protocol

Feature Requests
1

I've heard that I can bind rootless services to privileged ports using systemd and the LISTEN_FDS protocol, but it seems that it requires pihole to support the LISTEN_FDS protocol.

Is this a planned feature? Would it make sense?

2

The pihole-FTL daemon already runs rootless:

$ ps -o uid,user,gid,group,pid,cmd -C pihole-FTL
  UID USER       GID GROUP        PID CMD
  999 pihole    1001 pihole    392596 /usr/bin/pihole-FTL -f

$ man capabilities
[..]
       Starting with Linux 2.2, Linux divides the privileges traditionally
       associated  with  superuser into distinct units, known as capabili‐
       ties, which can be independently enabled and  disabled.   Capabili‐
       ties are a per-thread attribute.
[..]
       CAP_NET_BIND_SERVICE
              Bind a socket to Internet domain privileged ports (port num‐
              bers less than 1024).

$ systemctl --no-pager cat pihole-FTL.service
[..]
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_NET_ADMIN CAP_SYS_NICE CAP_IPC_LOCK CAP_CHOWN CAP_SYS_TIME

$ sudo getpcaps $(pidof -s pihole-FTL)
392596: cap_chown,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_sys_nice,cap_sys_time=eip
3

My bad. I meant so I can pass the file descriptor of the socket when running on rootless podman. As far as I know, netavark (podman tool for networking) will not be allowed to open port 53 on rootless mode.

I've seen some workarounds, but I guess that supporting LISTEN_FDS protocol would make things easier.

4

IMHO Pi-Hole became so light and compact since the release of Version 6.0 that there is pretty much ZERO reason to run it in any kind of Container unless it's something like the LXC ones :slight_smile: