4 files changed, 91 insertions, 42 deletions
diff --git a/pkg/util/mountOpts.go b/pkg/util/mountOpts.go
index d21800bc3..329a7c913 100644
--- a/pkg/util/mountOpts.go
+++ b/pkg/util/mountOpts.go
@@ -13,19 +13,17 @@ var (
 	ErrDupeMntOption = errors.Errorf("duplicate mount option passed")
 )
 
-// DefaultMountOptions sets default mount options for ProcessOptions.
-type DefaultMountOptions struct {
-	Noexec bool
-	Nosuid bool
-	Nodev  bool
+type defaultMountOptions struct {
+	noexec bool
+	nosuid bool
+	nodev  bool
 }
 
 // ProcessOptions parses the options for a bind or tmpfs mount and ensures that
 // they are sensible and follow convention. The isTmpfs variable controls
 // whether extra, tmpfs-specific options will be allowed.
-// The defaults variable controls default mount options that will be set. If it
-// is not included, they will be set unconditionally.
-func ProcessOptions(options []string, isTmpfs bool, defaults *DefaultMountOptions) ([]string, error) {
+// The sourcePath variable, if not empty, contains a bind mount source.
+func ProcessOptions(options []string, isTmpfs bool, sourcePath string) ([]string, error) {
 	var (
 		foundWrite, foundSize, foundProp, foundMode, foundExec, foundSuid, foundDev, foundCopyUp, foundBind, foundZ bool
 	)
@@ -122,13 +120,17 @@ func ProcessOptions(options []string, isTmpfs bool, defaults *DefaultMountOption
 	if !foundProp {
 		newOptions = append(newOptions, "rprivate")
 	}
-	if !foundExec && (defaults == nil || defaults.Noexec) {
+	defaults, err := getDefaultMountOptions(sourcePath)
+	if err != nil {
+		return nil, err
+	}
+	if !foundExec && defaults.noexec {
 		newOptions = append(newOptions, "noexec")
 	}
-	if !foundSuid && (defaults == nil || defaults.Nosuid) {
+	if !foundSuid && defaults.nosuid {
 		newOptions = append(newOptions, "nosuid")
 	}
-	if !foundDev && (defaults == nil || defaults.Nodev) {
+	if !foundDev && defaults.nodev {
 		newOptions = append(newOptions, "nodev")
 	}
 	if isTmpfs && !foundCopyUp {
diff --git a/pkg/util/mountOpts_linux.go b/pkg/util/mountOpts_linux.go
new file mode 100644
index 000000000..3eac4dd25
--- /dev/null
+++ b/pkg/util/mountOpts_linux.go
@@ -0,0 +1,23 @@
+package util
+
+import (
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+func getDefaultMountOptions(path string) (defaultMountOptions, error) {
+	opts := defaultMountOptions{true, true, true}
+	if path == "" {
+		return opts, nil
+	}
+	var statfs unix.Statfs_t
+	if e := unix.Statfs(path, &statfs); e != nil {
+		return opts, &os.PathError{Op: "statfs", Path: path, Err: e}
+	}
+	opts.nodev = (statfs.Flags&unix.MS_NODEV == unix.MS_NODEV)
+	opts.noexec = (statfs.Flags&unix.MS_NOEXEC == unix.MS_NOEXEC)
+	opts.nosuid = (statfs.Flags&unix.MS_NOSUID == unix.MS_NOSUID)
+
+	return opts, nil
+}
diff --git a/pkg/util/mountOpts_other.go b/pkg/util/mountOpts_other.go
new file mode 100644
index 000000000..6a34942e5
--- /dev/null
+++ b/pkg/util/mountOpts_other.go
@@ -0,0 +1,7 @@
+// +build !linux
+
+package util
+
+func getDefaultMountOptions(path string) (opts defaultMountOptions, err error) {
+	return
+}
diff --git a/pkg/util/utils.go b/pkg/util/utils.go
index 0c055745d..babf7dfc9 100644
--- a/pkg/util/utils.go
+++ b/pkg/util/utils.go
@@ -14,7 +14,6 @@ import (
 
 	"github.com/BurntSushi/toml"
 	"github.com/containers/image/v5/types"
-	"github.com/containers/libpod/cmd/podman/cliconfig"
 	"github.com/containers/libpod/pkg/errorhandling"
 	"github.com/containers/libpod/pkg/namespaces"
 	"github.com/containers/libpod/pkg/rootless"
@@ -22,9 +21,9 @@ import (
 	"github.com/containers/storage"
 	"github.com/containers/storage/pkg/idtools"
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/opencontainers/selinux/go-selinux"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"github.com/spf13/pflag"
 	"golang.org/x/crypto/ssh/terminal"
 )
 
@@ -327,6 +326,18 @@ func ParseIDMapping(mode namespaces.UsernsMode, uidMapSlice, gidMapSlice []strin
 		HostGIDMapping: true,
 	}
 
+	if mode.IsAuto() {
+		var err error
+		options.HostUIDMapping = false
+		options.HostGIDMapping = false
+		options.AutoUserNs = true
+		opts, err := mode.GetAutoOptions()
+		if err != nil {
+			return nil, err
+		}
+		options.AutoUserNsOpts = *opts
+		return &options, nil
+	}
 	if mode.IsKeepID() {
 		if len(uidMapSlice) > 0 || len(gidMapSlice) > 0 {
 			return nil, errors.New("cannot specify custom mappings with --userns=keep-id")
@@ -503,35 +514,6 @@ func ParseInputTime(inputTime string) (time.Time, error) {
 	return time.Now().Add(-duration), nil
 }
 
-// GetGlobalOpts checks all global flags and generates the command string
-func GetGlobalOpts(c *cliconfig.RunlabelValues) string {
-	globalFlags := map[string]bool{
-		"cgroup-manager": true, "cni-config-dir": true, "conmon": true, "default-mounts-file": true,
-		"hooks-dir": true, "namespace": true, "root": true, "runroot": true,
-		"runtime": true, "storage-driver": true, "storage-opt": true, "syslog": true,
-		"trace": true, "network-cmd-path": true, "config": true, "cpu-profile": true,
-		"log-level": true, "tmpdir": true}
-	const stringSliceType string = "stringSlice"
-
-	var optsCommand []string
-	c.PodmanCommand.Command.Flags().VisitAll(func(f *pflag.Flag) {
-		if !f.Changed {
-			return
-		}
-		if _, exist := globalFlags[f.Name]; exist {
-			if f.Value.Type() == stringSliceType {
-				flagValue := strings.TrimSuffix(strings.TrimPrefix(f.Value.String(), "["), "]")
-				for _, value := range strings.Split(flagValue, ",") {
-					optsCommand = append(optsCommand, fmt.Sprintf("--%s %s", f.Name, value))
-				}
-			} else {
-				optsCommand = append(optsCommand, fmt.Sprintf("--%s %s", f.Name, f.Value.String()))
-			}
-		}
-	})
-	return strings.Join(optsCommand, " ")
-}
-
 // OpenExclusiveFile opens a file for writing and ensure it doesn't already exist
 func OpenExclusiveFile(path string) (*os.File, error) {
 	baseDir := filepath.Dir(path)
@@ -652,3 +634,38 @@ func ValidateSysctls(strSlice []string) (map[string]string, error) {
 	}
 	return sysctl, nil
 }
+
+// SELinuxKVMLabel returns labels for running kvm isolated containers
+func SELinuxKVMLabel(cLabel string) (string, error) {
+	if cLabel == "" {
+		// selinux is disabled
+		return "", nil
+	}
+	processLabel, _ := selinux.KVMContainerLabels()
+	selinux.ReleaseLabel(processLabel)
+	return swapSELinuxLabel(cLabel, processLabel)
+}
+
+// SELinuxInitLabel returns labels for running systemd based containers
+func SELinuxInitLabel(cLabel string) (string, error) {
+	if cLabel == "" {
+		// selinux is disabled
+		return "", nil
+	}
+	processLabel, _ := selinux.InitContainerLabels()
+	selinux.ReleaseLabel(processLabel)
+	return swapSELinuxLabel(cLabel, processLabel)
+}
+
+func swapSELinuxLabel(cLabel, processLabel string) (string, error) {
+	dcon, err := selinux.NewContext(cLabel)
+	if err != nil {
+		return "", err
+	}
+	scon, err := selinux.NewContext(processLabel)
+	if err != nil {
+		return "", err
+	}
+	dcon["type"] = scon["type"]
+	return dcon.Get(), nil
+}