Use a systemd system service to allow rootless podman to run privileged OCI hooks

[eriksjolund]

A half-baked idea. Actually, the idea is still very sketchy and far from being even half-baked.
Maybe it would be possible to

• Let rootless podman be started from a systemd system service with User= so that crun inherits some file descriptors that were opened by the systemd system manager (originating from OpenFile= configuration). crun communicates with a rootful process by reading and writing to these file descriptors.
• The rootfull process is started from ExecStartPost= with a path that has a + prepended to it so that the process is running as root. (Alternatively it could be started from ExecStartPre= in the same way). The rootful process can open the "communication" files and read and write to the files to communicate with crun.
• The rootful process reads instructions from crun to perform some privileged actions.

Use case

This functionality would for example be useful to the OCI hook oci-seccomp-bpf-hook that currently is not usable for rootless Podman.