mirror of
https://github.com/containers/podman.git
synced 2026-10-28 20:59:40 -04:00
Jianqiang Liu
7ac4011b5e
When podman.service is socket-activated at user login it races with the other podman units to set up the rootless pause process. If the re-executed child loses the race for the pause PID file, podman falls back to reexec_userns_join(), which forks again. The parent of reexec_in_user_namespace() used to close the LISTEN_FDS socket (fd 3) before this fallback, so the final child inherited a stale fd 3 (the CLOEXEC user-namespace handle) and the journald datagram socket then reused fd 3. The API service tried to accept(2) on a datagram socket and failed with "accept4: operation not supported", leaving podman.service failed at boot while a manual restart worked. Move the close out of reexec_in_user_namespace() into a new close_systemd_activation_fds() helper that the parent calls only after the pause PID race is resolved. On the success path the fds are still closed so they are not leaked for the lifetime of the child; on the race-lost path they stay open so reexec_userns_join() can hand them to the final child. Fixes: https://github.com/podman-container-tools/podman/issues/29964 Signed-off-by: Jianqiang Liu <liujianqiang@uniontech.com>