Execute service in VRF

[Paktosan]

Some services on my system have to run in a specific VRF to work properly.

For that, I would like to be able to set a variable VRF=dc-services in my unit.

Instead, I currently adjust ExecStart, so for example ExecStart=/usr/sbin/chronyd $DAEMON_OPTS becomes ExecStart=/usr/sbin/ip vrf exec dc-services /usr/sbin/chronyd $DAEMON_OPTS.

This however has some drawbacks. For example, the unit shipped with chrony on Debian uses ProtectControlGroups=yes. I have to unset that because otherwise ip is unable to set the VRF. I consider this suboptimal.

I was unable to find such an option in systemd 247 on Debian 11.

[Paktosan]

It gets even worse when the service should run as non-root user.
ip vrf exec dc-services runuser -u www-data -g www-data -- rsync would be the new ExecStart and the unit has to run as root.

[bluca]

It makes sense to have a feature like that - please feel free to send a PR to implement it

[lukasjuhrich]

What would be preferable here – letting systemd delegate to ip vrf, or implementing the cgroup configuration logic (or whatever is necessary) in systemd?

I am not familiar with systemd internals as of yet (and neither with what ip vrf actually does in the background), so I can't quite judge this.

For anyone else wondering, the relevant ip vrf logic seems to be at ipvrf.c:vrf_switch.

[bluca]

Implement the logic, we don't want to wrap the execution in an external binary. We already have all the logic required to create cgroup/namespaces, so it should be relatively simple to wire up.

[toreanderson]

If someone decides to implement this, might also be worthwhile to add the possibility of running services inside network namespaces at the same time (or even inside a VRF inside a network namespace for that matter).

This currently needs to be done in the exact same way, using an override file with ExecStart=/bin/ip [vrf|netns] exec [vrf|netns]name [runuser_if_necessary --] Original_ExecStart.

[isjerryxiao]

One possible solution: https://jerryxiao.cc/archives/1004
It wouldn't be too hard to add this simple ebpf program to systemd given that systemd already have the IPAddressAllow and IPAddressDeny code for reference.

[poettering]

@isjerryxiao a PR adding that would be more than lovely.

[barinet]

The Execstart=ip vrf exec vrfred sudo -u user daemon args hack plays havoc with SELinux; on Fedora 38 I see sshd failing to run because it's run in ifconfig_t ....

Would the sneaky BPFProgram trick avoid this?