Merge pull request #2583 from giuseppe/rootless-fix-pod-rm

rootless: fix stop and rm when the container is running with uid != 0

12 files changed, 295 insertions, 21 deletions

diff --git a/cmd/podman/main.go b/cmd/podman/main.go
index 3571f526e..bbeb72397 100644
--- a/cmd/podman/main.go
+++ b/cmd/podman/main.go
@@ -65,18 +65,23 @@ var cmdsNotRequiringRootless = map[*cobra.Command]bool{
 	_exportCommand:  true,
 	//// `info` must be executed in an user namespace.
 	//// If this change, please also update libpod.refreshRootless()
-	_loginCommand:   true,
-	_logoutCommand:  true,
-	_mountCommand:   true,
-	_killCommand:    true,
-	_pauseCommand:   true,
-	_restartCommand: true,
-	_runCommand:     true,
-	_unpauseCommand: true,
-	_searchCommand:  true,
-	_statsCommand:   true,
-	_stopCommand:    true,
-	_topCommand:     true,
+	_loginCommand:    true,
+	_logoutCommand:   true,
+	_mountCommand:    true,
+	_killCommand:     true,
+	_pauseCommand:    true,
+	_podRmCommand:    true,
+	_podKillCommand:  true,
+	_podStatsCommand: true,
+	_podStopCommand:  true,
+	_restartCommand:  true,
+	_rmCommand:       true,
+	_runCommand:      true,
+	_unpauseCommand:  true,
+	_searchCommand:   true,
+	_statsCommand:    true,
+	_stopCommand:     true,
+	_topCommand:      true,
 }
 
 var rootCmd = &cobra.Command{
diff --git a/cmd/podman/pod.go b/cmd/podman/pod.go
index 2d9bca21d..9a9c7a702 100644
--- a/cmd/podman/pod.go
+++ b/cmd/podman/pod.go
@@ -1,7 +1,12 @@
 package main
 
 import (
+	"os"
+
 	"github.com/containers/libpod/cmd/podman/cliconfig"
+	"github.com/containers/libpod/pkg/adapter"
+	"github.com/containers/libpod/pkg/rootless"
+	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )
 
@@ -34,6 +39,48 @@ var podSubCommands = []*cobra.Command{
 	_podUnpauseCommand,
 }
 
+func joinPodNS(runtime *adapter.LocalRuntime, all, latest bool, inputArgs []string) ([]string, bool, bool, error) {
+	if rootless.IsRootless() {
+		if os.Geteuid() == 0 {
+			return []string{rootless.Argument()}, false, false, nil
+		} else {
+			var err error
+			var pods []*adapter.Pod
+			if all {
+				pods, err = runtime.GetAllPods()
+				if err != nil {
+					return nil, false, false, errors.Wrapf(err, "unable to get pods")
+				}
+			} else if latest {
+				pod, err := runtime.GetLatestPod()
+				if err != nil {
+					return nil, false, false, errors.Wrapf(err, "unable to get latest pod")
+				}
+				pods = append(pods, pod)
+			} else {
+				for _, i := range inputArgs {
+					pod, err := runtime.LookupPod(i)
+					if err != nil {
+						return nil, false, false, errors.Wrapf(err, "unable to lookup pod %s", i)
+					}
+					pods = append(pods, pod)
+				}
+			}
+			for _, p := range pods {
+				_, ret, err := runtime.JoinOrCreateRootlessPod(p)
+				if err != nil {
+					return nil, false, false, err
+				}
+				if ret != 0 {
+					os.Exit(ret)
+				}
+			}
+			os.Exit(0)
+		}
+	}
+	return inputArgs, all, latest, nil
+}
+
 func init() {
 	podCommand.AddCommand(podSubCommands...)
 	podCommand.SetHelpTemplate(HelpTemplate())
diff --git a/cmd/podman/pod_rm.go b/cmd/podman/pod_rm.go
index a40992818..735676f8a 100644
--- a/cmd/podman/pod_rm.go
+++ b/cmd/podman/pod_rm.go
@@ -2,9 +2,11 @@ package main
 
 import (
 	"fmt"
+	"os"
 
 	"github.com/containers/libpod/cmd/podman/cliconfig"
 	"github.com/containers/libpod/pkg/adapter"
+	"github.com/containers/libpod/pkg/rootless"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -46,11 +48,23 @@ func init() {
 
 // podRmCmd deletes pods
 func podRmCmd(c *cliconfig.PodRmValues) error {
+	if os.Geteuid() != 0 {
+		rootless.SetSkipStorageSetup(true)
+	}
 	runtime, err := adapter.GetRuntime(&c.PodmanCommand)
 	if err != nil {
 		return errors.Wrapf(err, "could not get runtime")
 	}
 	defer runtime.Shutdown(false)
+
+	if rootless.IsRootless() {
+		var err error
+		c.InputArgs, c.All, c.Latest, err = joinPodNS(runtime, c.All, c.Latest, c.InputArgs)
+		if err != nil {
+			return err
+		}
+	}
+
 	podRmIds, podRmErrors := runtime.RemovePods(getContext(), c)
 	for _, p := range podRmIds {
 		fmt.Println(p)
diff --git a/cmd/podman/pod_stats.go b/cmd/podman/pod_stats.go
index 7dbd84525..5c30e0595 100644
--- a/cmd/podman/pod_stats.go
+++ b/cmd/podman/pod_stats.go
@@ -53,6 +53,11 @@ func init() {
 }
 
 func podStatsCmd(c *cliconfig.PodStatsValues) error {
+
+	if os.Geteuid() != 0 {
+		return errors.New("stats is not supported in rootless mode")
+	}
+
 	format := c.Format
 	all := c.All
 	latest := c.Latest
diff --git a/cmd/podman/pod_stop.go b/cmd/podman/pod_stop.go
index f1b0ac51f..754a3a7db 100644
--- a/cmd/podman/pod_stop.go
+++ b/cmd/podman/pod_stop.go
@@ -2,9 +2,11 @@ package main
 
 import (
 	"fmt"
+	"os"
 
 	"github.com/containers/libpod/cmd/podman/cliconfig"
 	"github.com/containers/libpod/pkg/adapter"
+	"github.com/containers/libpod/pkg/rootless"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -46,12 +48,24 @@ func init() {
 }
 
 func podStopCmd(c *cliconfig.PodStopValues) error {
+	if os.Geteuid() != 0 {
+		rootless.SetSkipStorageSetup(true)
+	}
+
 	runtime, err := adapter.GetRuntime(&c.PodmanCommand)
 	if err != nil {
 		return errors.Wrapf(err, "could not get runtime")
 	}
 	defer runtime.Shutdown(false)
 
+	if rootless.IsRootless() {
+		var err error
+		c.InputArgs, c.All, c.Latest, err = joinPodNS(runtime, c.All, c.Latest, c.InputArgs)
+		if err != nil {
+			return err
+		}
+	}
+
 	podStopIds, podStopErrors := runtime.StopPods(getContext(), c)
 	for _, p := range podStopIds {
 		fmt.Println(p)
diff --git a/cmd/podman/rm.go b/cmd/podman/rm.go
index 4230bb396..56aaae9eb 100644
--- a/cmd/podman/rm.go
+++ b/cmd/podman/rm.go
@@ -2,12 +2,16 @@ package main
 
 import (
 	"fmt"
+	"io/ioutil"
+	"os"
+	"strconv"
 
 	"github.com/containers/libpod/cmd/podman/cliconfig"
 	"github.com/containers/libpod/cmd/podman/libpodruntime"
 	"github.com/containers/libpod/cmd/podman/shared"
 	"github.com/containers/libpod/libpod"
 	"github.com/containers/libpod/libpod/image"
+	"github.com/containers/libpod/pkg/rootless"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -48,11 +52,39 @@ func init() {
 	markFlagHiddenForRemoteClient("latest", flags)
 }
 
+func joinContainerOrCreateRootlessUserNS(runtime *libpod.Runtime, ctr *libpod.Container) (bool, int, error) {
+	if os.Geteuid() == 0 {
+		return false, 0, nil
+	}
+	s, err := ctr.State()
+	if err != nil {
+		return false, -1, err
+	}
+	opts := rootless.Opts{
+		Argument: ctr.ID(),
+	}
+	if s == libpod.ContainerStateRunning || s == libpod.ContainerStatePaused {
+		data, err := ioutil.ReadFile(ctr.Config().ConmonPidFile)
+		if err != nil {
+			return false, -1, errors.Wrapf(err, "cannot read conmon PID file %q", ctr.Config().ConmonPidFile)
+		}
+		conmonPid, err := strconv.Atoi(string(data))
+		if err != nil {
+			return false, -1, errors.Wrapf(err, "cannot parse PID %q", data)
+		}
+		return rootless.JoinDirectUserAndMountNSWithOpts(uint(conmonPid), &opts)
+	}
+	return rootless.BecomeRootInUserNSWithOpts(&opts)
+}
+
 // saveCmd saves the image to either docker-archive or oci
 func rmCmd(c *cliconfig.RmValues) error {
 	var (
 		deleteFuncs []shared.ParallelWorkerInput
 	)
+	if os.Geteuid() != 0 {
+		rootless.SetSkipStorageSetup(true)
+	}
 
 	ctx := getContext()
 	runtime, err := libpodruntime.GetRuntime(&c.PodmanCommand)
@@ -61,6 +93,53 @@ func rmCmd(c *cliconfig.RmValues) error {
 	}
 	defer runtime.Shutdown(false)
 
+	if rootless.IsRootless() {
+		// When running in rootless mode we cannot manage different containers and
+		// user namespaces from the same context, so be sure to re-exec once for each
+		// container we are dealing with.
+		// What we do is to first collect all the containers we want to delete, then
+		// we re-exec in each of the container namespaces and from there remove the single
+		// container.
+		var container *libpod.Container
+		if os.Geteuid() == 0 {
+			// We are in the namespace, override InputArgs with the single
+			// argument that was passed down to us.
+			c.All = false
+			c.Latest = false
+			c.InputArgs = []string{rootless.Argument()}
+		} else {
+			var containers []*libpod.Container
+			if c.All {
+				containers, err = runtime.GetContainers()
+			} else if c.Latest {
+				container, err = runtime.GetLatestContainer()
+				if err != nil {
+					return errors.Wrapf(err, "unable to get latest pod")
+				}
+				containers = append(containers, container)
+			} else {
+				for _, c := range c.InputArgs {
+					container, err = runtime.LookupContainer(c)
+					if err != nil {
+						return err
+					}
+					containers = append(containers, container)
+				}
+			}
+			// Now we really delete the containers.
+			for _, c := range containers {
+				_, ret, err := joinContainerOrCreateRootlessUserNS(runtime, c)
+				if err != nil {
+					return err
+				}
+				if ret != 0 {
+					os.Exit(ret)
+				}
+			}
+			os.Exit(0)
+		}
+	}
+
 	failureCnt := 0
 	delContainers, err := getAllOrLatestContainers(&c.PodmanCommand, runtime, -1, "all")
 	if err != nil {
diff --git a/libpod/container_internal.go b/libpod/container_internal.go
index d86062e38..00e6786f9 100644
--- a/libpod/container_internal.go
+++ b/libpod/container_internal.go
@@ -1086,7 +1086,7 @@ func (c *Container) cleanupStorage() error {
 		// error
 		// We still want to be able to kick the container out of the
 		// state
-		if err == storage.ErrNotAContainer || err == storage.ErrContainerUnknown {
+		if errors.Cause(err) == storage.ErrNotAContainer || errors.Cause(err) == storage.ErrContainerUnknown {
 			logrus.Errorf("Storage for container %s has been removed", c.ID())
 			return nil
 		}
diff --git a/pkg/adapter/runtime.go b/pkg/adapter/runtime.go
index 732b89530..482b6119a 100644
--- a/pkg/adapter/runtime.go
+++ b/pkg/adapter/runtime.go
@@ -337,3 +337,43 @@ func IsImageNotFound(err error) bool {
 func (r *LocalRuntime) HealthCheck(c *cliconfig.HealthCheckValues) (libpod.HealthCheckStatus, error) {
 	return r.Runtime.HealthCheck(c.InputArgs[0])
 }
+
+// JoinOrCreateRootlessPod joins the specified pod if it is running or it creates a new user namespace
+// if the pod is stopped
+func (r *LocalRuntime) JoinOrCreateRootlessPod(pod *Pod) (bool, int, error) {
+	if os.Geteuid() == 0 {
+		return false, 0, nil
+	}
+	opts := rootless.Opts{
+		Argument: pod.ID(),
+	}
+
+	inspect, err := pod.Inspect()
+	if err != nil {
+		return false, 0, err
+	}
+	for _, ctr := range inspect.Containers {
+		prevCtr, err := r.LookupContainer(ctr.ID)
+		if err != nil {
+			return false, -1, err
+		}
+		s, err := prevCtr.State()
+		if err != nil {
+			return false, -1, err
+		}
+		if s != libpod.ContainerStateRunning && s != libpod.ContainerStatePaused {
+			continue
+		}
+		data, err := ioutil.ReadFile(prevCtr.Config().ConmonPidFile)
+		if err != nil {
+			return false, -1, errors.Wrapf(err, "cannot read conmon PID file %q", prevCtr.Config().ConmonPidFile)
+		}
+		conmonPid, err := strconv.Atoi(string(data))
+		if err != nil {
+			return false, -1, errors.Wrapf(err, "cannot parse PID %q", data)
+		}
+		return rootless.JoinDirectUserAndMountNSWithOpts(uint(conmonPid), &opts)
+	}
+
+	return rootless.BecomeRootInUserNSWithOpts(&opts)
+}
diff --git a/pkg/adapter/runtime_remote.go b/pkg/adapter/runtime_remote.go
index 10c25c3f3..9ca4e245f 100644
--- a/pkg/adapter/runtime_remote.go
+++ b/pkg/adapter/runtime_remote.go
@@ -751,3 +751,10 @@ func IsImageNotFound(err error) bool {
 func (r *LocalRuntime) HealthCheck(c *cliconfig.HealthCheckValues) (libpod.HealthCheckStatus, error) {
 	return -1, libpod.ErrNotImplemented
 }
+
+// JoinOrCreateRootlessPod joins the specified pod if it is running or it creates a new user namespace
+// if the pod is stopped
+func (r *LocalRuntime) JoinOrCreateRootlessPod(pod *Pod) (bool, int, error) {
+	// Nothing to do in the remote case
+	return true, 0, nil
+}
diff --git a/pkg/rootless/rootless.go b/pkg/rootless/rootless.go
new file mode 100644
index 000000000..a531e43ce
--- /dev/null
+++ b/pkg/rootless/rootless.go
@@ -0,0 +1,9 @@
+package rootless
+
+// Opts allows to customize how re-execing to a rootless process is done
+type Opts struct {
+	// Argument overrides the arguments on the command line
+	// for the re-execed process.  The process in the namespace
+	// must use rootless.Argument() to read its value.
+	Argument string
+}
diff --git a/pkg/rootless/rootless_linux.go b/pkg/rootless/rootless_linux.go
index d43151e8e..b2677f7d9 100644
--- a/pkg/rootless/rootless_linux.go
+++ b/pkg/rootless/rootless_linux.go
@@ -60,6 +60,11 @@ func SkipStorageSetup() bool {
 	return skipStorageSetup
 }
 
+// Argument returns the argument that was set for the rootless session.
+func Argument() string {
+	return os.Getenv("_LIBPOD_ROOTLESS_ARG")
+}
+
 // GetRootlessUID returns the UID of the user in the parent userNS
 func GetRootlessUID() int {
 	uidEnv := os.Getenv("_LIBPOD_ROOTLESS_UID")
@@ -134,8 +139,16 @@ func JoinNS(pid uint, preserveFDs int) (bool, int, error) {
 
 // JoinDirectUserAndMountNS re-exec podman in a new userNS and join the user and mount
 // namespace of the specified PID without looking up its parent.  Useful to join directly
-// the conmon process.
+// the conmon process.  It is a convenience function for JoinDirectUserAndMountNSWithOpts
+// with a default configuration.
 func JoinDirectUserAndMountNS(pid uint) (bool, int, error) {
+	return JoinDirectUserAndMountNSWithOpts(pid, nil)
+}
+
+// JoinDirectUserAndMountNSWithOpts re-exec podman in a new userNS and join the user and
+// mount namespace of the specified PID without looking up its parent.  Useful to join
+// directly the conmon process.
+func JoinDirectUserAndMountNSWithOpts(pid uint, opts *Opts) (bool, int, error) {
 	if os.Geteuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" {
 		return false, -1, nil
 	}
@@ -152,6 +165,12 @@ func JoinDirectUserAndMountNS(pid uint) (bool, int, error) {
 	}
 	defer userNS.Close()
 
+	if opts != nil && opts.Argument != "" {
+		if err := os.Setenv("_LIBPOD_ROOTLESS_ARG", opts.Argument); err != nil {
+			return false, -1, err
+		}
+	}
+
 	pidC := C.reexec_userns_join(C.int(userNS.Fd()), C.int(mountNS.Fd()))
 	if int(pidC) < 0 {
 		return false, -1, errors.Errorf("cannot re-exec process")
@@ -194,8 +213,16 @@ func JoinNSPath(path string) (bool, int, error) {
 // BecomeRootInUserNS re-exec podman in a new userNS.  It returns whether podman was re-executed
 // into a new user namespace and the return code from the re-executed podman process.
 // If podman was re-executed the caller needs to propagate the error code returned by the child
-// process.
+// process.  It is a convenience function for BecomeRootInUserNSWithOpts with a default configuration.
 func BecomeRootInUserNS() (bool, int, error) {
+	return BecomeRootInUserNSWithOpts(nil)
+}
+
+// BecomeRootInUserNSWithOpts re-exec podman in a new userNS.  It returns whether podman was
+// re-execute into a new user namespace and the return code from the re-executed podman process.
+// If podman was re-executed the caller needs to propagate the error code returned by the child
+// process.
+func BecomeRootInUserNSWithOpts(opts *Opts) (bool, int, error) {
 	if os.Geteuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" {
 		if os.Getenv("_LIBPOD_USERNS_CONFIGURED") == "init" {
 			return false, 0, runInUser()
@@ -214,6 +241,12 @@ func BecomeRootInUserNS() (bool, int, error) {
 	defer w.Close()
 	defer w.Write([]byte("0"))
 
+	if opts != nil && opts.Argument != "" {
+		if err := os.Setenv("_LIBPOD_ROOTLESS_ARG", opts.Argument); err != nil {
+			return false, -1, err
+		}
+	}
+
 	pidC := C.reexec_in_user_namespace(C.int(r.Fd()))
 	pid := int(pidC)
 	if pid < 0 {
diff --git a/pkg/rootless/rootless_unsupported.go b/pkg/rootless/rootless_unsupported.go
index 1823c023e..54e70961b 100644
--- a/pkg/rootless/rootless_unsupported.go
+++ b/pkg/rootless/rootless_unsupported.go
@@ -11,10 +11,18 @@ func IsRootless() bool {
 	return false
 }
 
+// BecomeRootInUserNS re-exec podman in a new userNS.  It returns whether podman was re-executed
+// into a new user namespace and the return code from the re-executed podman process.
+// If podman was re-executed the caller needs to propagate the error code returned by the child
+// process.  It is a convenience function for BecomeRootInUserNSWithOpts with a default configuration.
+func BecomeRootInUserNS() (bool, int, error) {
+	return false, -1, errors.New("this function is not supported on this os")
+}
+
 // BecomeRootInUserNS is a stub function that always returns false and an
 // error on unsupported OS's
-func BecomeRootInUserNS() (bool, int, error) {
-	return false, -1, errors.New("this function is not supported on this os1")
+func BecomeRootInUserNSWithOpts(opts *Opts) (bool, int, error) {
+	return false, -1, errors.New("this function is not supported on this os")
 }
 
 // GetRootlessUID returns the UID of the user in the parent userNS
@@ -34,18 +42,31 @@ func SkipStorageSetup() bool {
 // JoinNS re-exec podman in a new userNS and join the user namespace of the specified
 // PID.
 func JoinNS(pid uint) (bool, int, error) {
-	return false, -1, errors.New("this function is not supported on this os2")
+	return false, -1, errors.New("this function is not supported on this os")
 }
 
 // JoinNSPath re-exec podman in a new userNS and join the owner user namespace of the
 // specified path.
 func JoinNSPath(path string) (bool, int, error) {
-	return false, -1, errors.New("this function is not supported on this os3")
+	return false, -1, errors.New("this function is not supported on this os")
+}
+
+// JoinDirectUserAndMountNSWithOpts re-exec podman in a new userNS and join the user and
+// mount namespace of the specified PID without looking up its parent.  Useful to join
+// directly the conmon process.
+func JoinDirectUserAndMountNSWithOpts(pid uint, opts *Opts) (bool, int, error) {
+	return false, -1, errors.New("this function is not supported on this os")
 }
 
 // JoinDirectUserAndMountNS re-exec podman in a new userNS and join the user and mount
 // namespace of the specified PID without looking up its parent.  Useful to join directly
-// the conmon process.
+// the conmon process.  It is a convenience function for JoinDirectUserAndMountNSWithOpts
+// with a default configuration.
 func JoinDirectUserAndMountNS(pid uint) (bool, int, error) {
-	return false, -1, errors.New("this function is not supported on this os4")
+	return false, -1, errors.New("this function is not supported on this os")
+}
+
+// Argument returns the argument that was set for the rootless session.
+func Argument() string {
+	return ""
 }