3 files changed, 41 insertions, 28 deletions

diff --git a/pkg/domain/infra/abi/system.go b/pkg/domain/infra/abi/system.go
index 820ba529b..6be37c87f 100644
--- a/pkg/domain/infra/abi/system.go
+++ b/pkg/domain/infra/abi/system.go
@@ -125,8 +125,14 @@ func (ic *ContainerEngine) SetupRootless(_ context.Context, noMoveProcess bool)
 		paths = append(paths, ctr.Config().ConmonPidFile)
 	}
 
-	became, ret, err = rootless.TryJoinFromFilePaths(pausePidPath, true, paths)
-	utils.MovePauseProcessToScope(pausePidPath)
+	if len(paths) > 0 {
+		became, ret, err = rootless.TryJoinFromFilePaths(pausePidPath, true, paths)
+	} else {
+		became, ret, err = rootless.BecomeRootInUserNS(pausePidPath)
+		if err == nil {
+			utils.MovePauseProcessToScope(pausePidPath)
+		}
+	}
 	if err != nil {
 		logrus.Error(errors.Wrapf(err, "invalid internal status, try resetting the pause process with %q", os.Args[0]+" system migrate"))
 		os.Exit(1)
diff --git a/pkg/rootless/rootless_linux.c b/pkg/rootless/rootless_linux.c
index 94bd40f86..3588313c6 100644
--- a/pkg/rootless/rootless_linux.c
+++ b/pkg/rootless/rootless_linux.c
@@ -178,7 +178,7 @@ get_cmd_line_args ()
           char *tmp = realloc (buffer, allocated);
           if (tmp == NULL)
             return NULL;
-	  buffer = tmp;
+          buffer = tmp;
         }
     }
 
@@ -243,7 +243,7 @@ can_use_shortcut ()
         }
 
       if (argv[argc+1] != NULL && (strcmp (argv[argc], "container") == 0 ||
-	   strcmp (argv[argc], "image") == 0) &&
+                                   strcmp (argv[argc], "image") == 0) &&
      (strcmp (argv[argc+1], "mount") == 0  || strcmp (argv[argc+1], "scp") == 0))
         {
           ret = false;
@@ -512,7 +512,9 @@ create_pause_process (const char *pause_pid_file_path, char **argv)
       r = TEMP_FAILURE_RETRY (read (p[0], &b, 1));
       close (p[0]);
 
-      reexec_in_user_namespace_wait (pid, 0);
+      r = reexec_in_user_namespace_wait (pid, 0);
+      if (r != 0)
+	return -1;
 
       return r == 1 && b == '0' ? 0 : -1;
     }
@@ -757,6 +759,7 @@ reexec_userns_join (int pid_to_join, char *pause_pid_file_path)
     }
 
   execvp (argv[0], argv);
+  fprintf (stderr, "failed to execvp %s: %m\n", argv[0]);
 
   _exit (EXIT_FAILURE);
 }
@@ -788,7 +791,10 @@ copy_file_to_fd (const char *file_to_read, int outfd)
 
   fd = open (file_to_read, O_RDONLY);
   if (fd < 0)
-    return fd;
+    {
+      fprintf (stderr, "open `%s`: %m\n", file_to_read);
+      return fd;
+    }
 
   for (;;)
     {
@@ -796,7 +802,10 @@ copy_file_to_fd (const char *file_to_read, int outfd)
 
       r = TEMP_FAILURE_RETRY (read (fd, buf, sizeof buf));
       if (r < 0)
-        return r;
+        {
+          fprintf (stderr, "read from `%s`: %m\n", file_to_read);
+          return r;
+        }
 
       if (r == 0)
         break;
@@ -805,7 +814,10 @@ copy_file_to_fd (const char *file_to_read, int outfd)
         {
           w = TEMP_FAILURE_RETRY (write (outfd, &buf[t], r - t));
           if (w < 0)
-            return w;
+            {
+              fprintf (stderr, "write file to output fd `%s`: %m\n", file_to_read);
+              return w;
+            }
           t += w;
         }
     }
diff --git a/pkg/rootless/rootless_linux.go b/pkg/rootless/rootless_linux.go
index 5af9a978b..d0bdf0ffe 100644
--- a/pkg/rootless/rootless_linux.go
+++ b/pkg/rootless/rootless_linux.go
@@ -182,7 +182,7 @@ func joinUserAndMountNS(pid uint, pausePid string) (bool, int, error) {
 
 	pidC := C.reexec_userns_join(C.int(pid), cPausePid)
 	if int(pidC) < 0 {
-		return false, -1, errors.Errorf("cannot re-exec process")
+		return false, -1, errors.Errorf("cannot re-exec process to join the existing user namespace")
 	}
 
 	ret := C.reexec_in_user_namespace_wait(pidC, 0)
@@ -461,13 +461,8 @@ func BecomeRootInUserNS(pausePid string) (bool, int, error) {
 // different uidmap and the unprivileged user has no way to read the
 // file owned by the root in the container.
 func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []string) (bool, int, error) {
-	if len(paths) == 0 {
-		return BecomeRootInUserNS(pausePidPath)
-	}
-
 	var lastErr error
 	var pausePid int
-	foundProcess := false
 
 	for _, path := range paths {
 		if !needNewNamespace {
@@ -479,12 +474,9 @@ func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []st
 
 			pausePid, err = strconv.Atoi(string(data))
 			if err != nil {
-				lastErr = errors.Wrapf(err, "cannot parse file %s", path)
+				lastErr = errors.Wrapf(err, "cannot parse file %q", path)
 				continue
 			}
-
-			lastErr = nil
-			break
 		} else {
 			r, w, err := os.Pipe()
 			if err != nil {
@@ -511,26 +503,29 @@ func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []st
 
 			n, err := r.Read(b)
 			if err != nil {
-				lastErr = errors.Wrapf(err, "cannot read %s\n", path)
+				lastErr = errors.Wrapf(err, "cannot read %q", path)
 				continue
 			}
 
 			pausePid, err = strconv.Atoi(string(b[:n]))
-			if err == nil && unix.Kill(pausePid, 0) == nil {
-				foundProcess = true
-				lastErr = nil
-				break
+			if err != nil {
+				lastErr = err
+				continue
 			}
 		}
-	}
-	if !foundProcess && pausePidPath != "" {
-		return BecomeRootInUserNS(pausePidPath)
+
+		if pausePid > 0 && unix.Kill(pausePid, 0) == nil {
+			joined, pid, err := joinUserAndMountNS(uint(pausePid), pausePidPath)
+			if err == nil {
+				return joined, pid, nil
+			}
+			lastErr = err
+		}
 	}
 	if lastErr != nil {
 		return false, 0, lastErr
 	}
-
-	return joinUserAndMountNS(uint(pausePid), pausePidPath)
+	return false, 0, errors.Wrapf(unix.ESRCH, "could not find any running process")
 }
 
 // ReadMappingsProc parses and returns the ID mappings at the specified path.