Properly handle --cap-add all when running with a --user flag

Handle the ALL Flag when running with an account as a user.

Currently we throw an error when the user specifies

podman run --user bin --cap-add all fedora echo hello

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

1 files changed, 12 insertions, 0 deletions

diff --git a/test/e2e/run_privileged_test.go b/test/e2e/run_privileged_test.go
index ab11128ba..760de55b6 100644
--- a/test/e2e/run_privileged_test.go
+++ b/test/e2e/run_privileged_test.go
@@ -90,6 +90,18 @@ var _ = Describe("Podman privileged container tests", func() {
 		containerCapMatchesHost(session.OutputToString(), host_cap.OutputToString())
 	})
 
+	It("podman cap-add CapEff with --user", func() {
+		// Get caps of current process
+		host_cap := SystemExec("awk", []string{"/^CapEff/ { print $2 }", "/proc/self/status"})
+		Expect(host_cap.ExitCode()).To(Equal(0))
+
+		session := podmanTest.Podman([]string{"run", "--user=bin", "--cap-add", "all", "busybox", "awk", "/^CapEff/ { print $2 }", "/proc/self/status"})
+		session.WaitWithDefaultTimeout()
+		Expect(session.ExitCode()).To(Equal(0))
+
+		containerCapMatchesHost(session.OutputToString(), host_cap.OutputToString())
+	})
+
 	It("podman cap-drop CapEff", func() {
 		session := podmanTest.Podman([]string{"run", "--cap-drop", "all", "busybox", "grep", "CapEff", "/proc/self/status"})
 		session.WaitWithDefaultTimeout()