summaryrefslogtreecommitdiff
path: root/libpod/runtime.go
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2021-04-26 09:19:00 -0400
committerGitHub <noreply@github.com>2021-04-26 09:19:00 -0400
commit333817a187f7811919b9f5fb75a829fe5abfbc44 (patch)
treed9e27e24f5edaabfd3ee8245370b405ba6f64815 /libpod/runtime.go
parent9ca53cfb4fa137ef1fcfeaff4ab871c488a235f7 (diff)
parent722ea2f1f82ff16271b50b508d709e5da275e32a (diff)
downloadpodman-333817a187f7811919b9f5fb75a829fe5abfbc44.tar.gz
podman-333817a187f7811919b9f5fb75a829fe5abfbc44.tar.bz2
podman-333817a187f7811919b9f5fb75a829fe5abfbc44.zip
Merge pull request #10079 from giuseppe/create-userns-for-root-without-CAP_SYS_ADMIN
runtime: create userns when CAP_SYS_ADMIN is not present
Diffstat (limited to 'libpod/runtime.go')
-rw-r--r--libpod/runtime.go12
1 files changed, 10 insertions, 2 deletions
diff --git a/libpod/runtime.go b/libpod/runtime.go
index dc53d5ef1..3518ed25a 100644
--- a/libpod/runtime.go
+++ b/libpod/runtime.go
@@ -29,6 +29,7 @@ import (
"github.com/containers/podman/v3/pkg/rootless"
"github.com/containers/podman/v3/pkg/util"
"github.com/containers/storage"
+ "github.com/containers/storage/pkg/unshare"
"github.com/cri-o/ocicni/pkg/ocicni"
"github.com/docker/docker/pkg/namesgenerator"
spec "github.com/opencontainers/runtime-spec/specs-go"
@@ -338,9 +339,16 @@ func makeRuntime(ctx context.Context, runtime *Runtime) (retErr error) {
}
logrus.Debugf("Set libpod namespace to %q", runtime.config.Engine.Namespace)
+ hasCapSysAdmin, err := unshare.HasCapSysAdmin()
+ if err != nil {
+ return err
+ }
+
+ needsUserns := !hasCapSysAdmin
+
// Set up containers/storage
var store storage.Store
- if os.Geteuid() != 0 {
+ if needsUserns {
logrus.Debug("Not configuring container store")
} else if runtime.noStore {
logrus.Debug("No store required. Not opening container store.")
@@ -480,7 +488,7 @@ func makeRuntime(ctx context.Context, runtime *Runtime) (retErr error) {
// If we need to refresh, then it is safe to assume there are
// no containers running. Create immediately a namespace, as
// we will need to access the storage.
- if os.Geteuid() != 0 {
+ if needsUserns {
aliveLock.Unlock() // Unlock to avoid deadlock as BecomeRootInUserNS will reexec.
pausePid, err := util.GetRootlessPauseProcessPidPathGivenDir(runtime.config.Engine.TmpDir)
if err != nil {