3 ms·
Very neat indeed. It says on the about page that it starts a container on demand and gives you the output. You can see in the output that systemd detects it i
by smashed 3y ago
Very neat indeed.
It says on the about page that it starts a container on demand and gives you the output.
You can see in the output that systemd detects it is running under podman.
No idea what kind of container as a service they are using, and how they secure/lock it down. Systemd is a pretty powerful system, you can make it execute pretty much anything...
- yonatan8070 3y agoThe bit where you edit the unit files is essentially built-in RCE
- CameronNemo 3y agoPresumably there are limits in place via podman (cgroups)... I didn't test them but did feel the urge to do so. I also didn't test network access, which could cause arbitrary code execution.