summaryrefslogtreecommitdiff
path: root/cmd
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2020-04-02 19:25:33 -0400
committerDaniel J Walsh <dwalsh@redhat.com>2020-04-03 15:25:57 -0400
commit9f2d9679d7cf8e6ef6929c8838008e46cfc2efc0 (patch)
tree847bfdbb97632709c361eda342050416c09283f2 /cmd
parent64cade0f71a8189403d208cbc7dc8716008229be (diff)
downloadpodman-9f2d9679d7cf8e6ef6929c8838008e46cfc2efc0.tar.gz
podman-9f2d9679d7cf8e6ef6929c8838008e46cfc2efc0.tar.bz2
podman-9f2d9679d7cf8e6ef6929c8838008e46cfc2efc0.zip
Cleanup whether to enter user namespace for rootless commands
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'cmd')
-rw-r--r--cmd/podman/main_local.go22
1 files changed, 20 insertions, 2 deletions
diff --git a/cmd/podman/main_local.go b/cmd/podman/main_local.go
index 23b3f5ae7..a65e6acf8 100644
--- a/cmd/podman/main_local.go
+++ b/cmd/podman/main_local.go
@@ -11,7 +11,6 @@ import (
"os"
"runtime/pprof"
"strconv"
- "strings"
"syscall"
"github.com/containers/common/pkg/config"
@@ -192,7 +191,7 @@ func setupRootless(cmd *cobra.Command, args []string) error {
}
}
- if os.Geteuid() == 0 || cmd == _searchCommand || cmd == _versionCommand || cmd == _mountCommand || cmd == _migrateCommand || strings.HasPrefix(cmd.Use, "help") {
+ if !executeCommandInUserNS(cmd) {
return nil
}
@@ -243,6 +242,25 @@ func setupRootless(cmd *cobra.Command, args []string) error {
return nil
}
+// Most podman commands when run in rootless mode, need to be executed in the
+// users usernamespace. This function is updated with a list of commands that
+// should NOT be run within the user namespace.
+func executeCommandInUserNS(cmd *cobra.Command) bool {
+ if os.Geteuid() == 0 {
+ return false
+ }
+ switch cmd {
+ case _migrateCommand,
+ _mountCommand,
+ _renumberCommand,
+ _infoCommand,
+ _searchCommand,
+ _versionCommand:
+ return false
+ }
+ return true
+}
+
func setRLimits() error {
rlimits := new(syscall.Rlimit)
rlimits.Cur = 1048576