Network namespace support for supervise-daemon

[BetaRays]

Hello, I have a use-case for running a service in a given network namespace, but last I looked it wasn’t an option in supervise-daemon. Though it can set user, group, capabilities, chroot, etc.

In the meantime I have a workaround that looks like this but I’m not very happy about it.
I use ip netns exec to run the command in the network namespace, which needs a capability that the daemon itself shouldn’t have.
Using %cap_sys_admin (Inh) doesn’t seem to work so I use ^cap_sys_admin (Amb) then use capsh to remove the capability from the daemon…

#!/sbin/openrc-run
[…]

supervisor="supervise-daemon"
description="STUN/TURN server (netns)"
eturnal_command="/usr/sbin/eturnalctl"
command="/bin/ip"
# capsh to remove cap_sys_admin, just using %cap_sys_admin didn't seem to work
command_args='netns exec turn capsh --inh=cap_net_bind_service -- -c '"'"'"$0" "$@"'"' ${eturnal_command}"
capabilities="^cap_net_bind_service,^cap_sys_admin"

command_args_foreground="foreground"
command_args_background="daemon"
command_user="eturnal:turnserver"

[…]

(Another option I suppose would be to run the command as root and use su or similar instead of capsh, but that seems to defeat the purpose of supervise-daemon too.)

I’d love to have a less hacky way to do this. For example, systemd unit files have NetworkNamespacePath apparently.