sysutils/podman: Allow setting ownership on auto-created socket

[dch]

Summary

The podman_service daemon auto-creates a socket on startup, along with
parent directory, and is always run as root. It is often useful to have
another proxy like haproxy or nginx provide more sophisticated security,
and these daemons do not need root privileges.

Test Plan

• use podman_service instead of podman daemon (thanks arrowd)
• rename all the vars accordingly
• PORTREVISION++ again to ensure we are past reverted commit

[dch]

speling

[dch]

ensure default perms align with prior behaviour

[arrowd]

sysutils/podman/files/podman_service.in

29

Another option might be "operator".

30

This should be 0770 to make the socket actually useful for the group.

[dfr]

Thanks for fixing the style nits. For group ownership, I have a slight preference for wheel but operator would also be reasonable. The permission of 0770 suggested by arrowd@ will work but I don't think we need execute permissions so perhaps 0660 instead?

[arrowd]

If I understand it correctly, we need "7" to be set on podman_service_rundir to allow listing its contents. Client programs usually first check for socket existence which requires the ability to list dir's contents.

[dfr]

In D55455#1268471, @arrowd wrote:

If I understand it correctly, we need "7" to be set on podman_service_rundir to allow listing its contents. Client programs usually first check for socket existence which requires the ability to list dir's contents.

That makes perfect sense, thanks!