Cleanup whether to enter user namespace for rootless commands

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

1 files changed, 20 insertions, 2 deletions

diff --git a/cmd/podman/main_local.go b/cmd/podman/main_local.go
index 23b3f5ae7..a65e6acf8 100644
--- a/cmd/podman/main_local.go
+++ b/cmd/podman/main_local.go
@@ -11,7 +11,6 @@ import (
 	"os"
 	"runtime/pprof"
 	"strconv"
-	"strings"
 	"syscall"
 
 	"github.com/containers/common/pkg/config"
@@ -192,7 +191,7 @@ func setupRootless(cmd *cobra.Command, args []string) error {
 		}
 	}
 
-	if os.Geteuid() == 0 || cmd == _searchCommand || cmd == _versionCommand || cmd == _mountCommand || cmd == _migrateCommand || strings.HasPrefix(cmd.Use, "help") {
+	if !executeCommandInUserNS(cmd) {
 		return nil
 	}
 
@@ -243,6 +242,25 @@ func setupRootless(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
+// Most podman commands when run in rootless mode, need to be executed in the
+// users usernamespace.  This function is updated with a  list of commands that
+// should NOT be run within the user namespace.
+func executeCommandInUserNS(cmd *cobra.Command) bool {
+	if os.Geteuid() == 0 {
+		return false
+	}
+	switch cmd {
+	case _migrateCommand,
+		_mountCommand,
+		_renumberCommand,
+		_infoCommand,
+		_searchCommand,
+		_versionCommand:
+		return false
+	}
+	return true
+}
+
 func setRLimits() error {
 	rlimits := new(syscall.Rlimit)
 	rlimits.Cur = 1048576