summaryrefslogtreecommitdiff
path: root/pkg/rootless
Commit message (Collapse)AuthorAge
* remote: do not join user NSValentin Rothberg2022-04-26
| | | | | | | | | As noticed while debugging #13992, do not join the rootless user NS as a Linux remote client. [NO NEW TESTS NEEDED] as existing tests should continue to work. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* If newuidmap or newgidmap fail, then check their permissionsDaniel J Walsh2022-04-08
| | | | | | | | | | Often distributions to not have newuidmap and netgidmap configured to be setuid. If Podman fails to setup the user namespace, check to see if these files doe not have the proper protection and tell the user. [NO NEW TESTS NEEDED] Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Remove error stutterDaniel J Walsh2022-03-25
| | | | | | | | | | | | | | | | | When podman gets an error it prints out "Error: " before printing the error string. If the error message starts with error, we end up with Error: error ... This PR Removes all of these stutters. logrus.Error() also prints out that this is an error, so no need for the error stutter. [NO NEW TESTS NEEDED] Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* fix a number of errcheck issuesValentin Rothberg2022-03-22
| | | | | | Numerous issues remain, especially in tests/e2e. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* linter: enable nilerrValentin Rothberg2022-03-22
| | | | | | | A number of cases looked suspicious, so I marked them with `FIXME`s to leave some breadcrumbs. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* go fmt: use go 1.18 conditional-build syntaxValentin Rothberg2022-03-18
| | | | Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* rootless: report correctly the errorGiuseppe Scrivano2022-01-19
| | | | | | | | | | | | | | `err` is nil at this point, so errors.Wrapf() would return nil ignoring the remaining arguments. This would prevent SetupRootless() to fail causing podman to run without capabilities but believing so, and it would end up in a crash when accessing the local store. Closes: https://github.com/containers/podman/discussions/12923 [NO NEW TESTS NEEDED] it requires running in the environment created by bazel linux-sandbox. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* bump go module to version 4Valentin Rothberg2022-01-18
| | | | | | | | | | | | | Automated for .go files via gomove [1]: `gomove github.com/containers/podman/v3 github.com/containers/podman/v4` Remaining files via vgrep [2]: `vgrep github.com/containers/podman/v3` [1] https://github.com/KSubedi/gomove [2] https://github.com/vrothberg/vgrep Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Merge pull request #12429 from cdoern/scpOpenShift Merge Robot2022-01-05
|\ | | | | podman image scp never enter podman user NS
| * podman image scp never enter podman user NScdoern2021-12-23
| | | | | | | | | | | | | | | | | | | | | | Podman image scp should never enter the Podman UserNS unless it needs to. This allows for a sudo exec.Command to transfer images to and from rootful storage. If this command is run using sudo, the simple sudo podman save/load does not work, machinectl/su is necessary here. This modification allows for both rootful and rootless transfers, and an overall change of scp to be more of a wrapper function for different load and save calls as well as the ssh component Signed-off-by: cdoern <cdoern@redhat.com>
* | rootless: include the args in the debug messageGiuseppe Scrivano2021-12-17
|/ | | | | | | | | include the arguments used to create the user namespace to help debugging. [NO NEW TESTS NEEDED] it changes a debug message Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* [NO NEW TESTS NEEDED] rootless: declare TEMP_FAILURE_RETRY before usage ↵Marc Nguyen2021-12-10
| | | | | | (Fixes: #12563) Signed-off-by: Nguyen Marc <nguyen_marc@live.fr>
* Merge pull request #12325 from giuseppe/rootless-use-auto-cleanupOpenShift Merge Robot2021-11-17
|\ | | | | rootless: use auto cleanup functions
| * rootless: drop strerror(errno) callsGiuseppe Scrivano2021-11-17
| | | | | | | | | | | | *printf functions already support printing the errno string with %m Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * rootless: reuse existing open_namespace functionGiuseppe Scrivano2021-11-17
| | | | | | | | | | | | there is already a function for opening a namespace path, reuse it. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * rootless: use auto cleanup functionsGiuseppe Scrivano2021-11-17
| | | | | | | | | | | | | | | | simplify code using auto cleanup functions [NO NEW TESTS NEEDED] it is a refactoring of existing code Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | rootless: use catatonit to maintain user+mnt namespaceGiuseppe Scrivano2021-11-17
|/ | | | | | | | | if catatonit is present, use it to keep the rootless user+mnt namespace alive. [NO NEW TESTS NEEDED] no new features added. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* rootless: adjust error messageGiuseppe Scrivano2021-11-10
| | | | | | | | | | since we now support reading additional IDs with libsubid, clarify that the /etc/subuid and /etc/subgid files are honored only when shadow-utils is configured to use them. [NO TESTS NEEDED] Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* podman machine: do not join usernsPaul Holzinger2021-09-27
| | | | | | | | | | | The go logic already prevents podman from joining the userns for machine commands but the c shortcut code did not. [NO TESTS NEEDED] Fixes #11731 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* standardize logrus messages to upper caseDaniel J Walsh2021-09-22
| | | | | | | | Remove ERROR: Error stutter from logrus messages also. [ NO TESTS NEEDED] This is just code cleanup. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* make sure that signal buffers are sufficiently bigValentin Rothberg2021-08-17
| | | | | | | | | | | | | | | Dealing with os.Signal channels seems more like an art than science since signals may get lost. os.Notify doesn't block on an unbuffered channel, so users are expected to know what they're doing or hope for the best. In the recent past, I've seen a number of flakes and BZs on non-amd64 architectures where I was under the impression that signals may got lost, for instance, during stop and exec. [NO TESTS NEEDED] since this is art. Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* rootless: avoid zombie process on first launchGiuseppe Scrivano2021-07-29
| | | | | | | | | | | | | | avoid a zombie process if on the first launch Podman creates a long living process, such as "podman system service -t 0". The `r` variable was overriden thus causing the waitpid to fail and not clean up the intermediate process. Closes: https://github.com/containers/podman/issues/10575 [NO TESTS NEEDED] Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* rootless: check that / is mounted as sharedGiuseppe Scrivano2021-07-28
| | | | | | | | | | | | if the root mount '/' is not mounted as MS_SHARED, print a warning, otherwise new mounts that are created in the host won't be propagated to the rootless mount namespace. Closes: https://github.com/containers/podman/issues/10946 [NO TESTS NEEDED] Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* podman: ignore ESRCH from killGiuseppe Scrivano2021-07-01
| | | | | | | | Closes: https://github.com/containers/podman/issues/10826 [NO TESTS NEEDED] Fixes a race condition Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* rootless: fix fast join userns pathGiuseppe Scrivano2021-06-09
| | | | | | | | | | | | | | commit ab886328357184cd0a8375a5dedf816ba91789f9 changed the path for the pause.pid file but didn't update the same path in the C code. This prevented Podman to take the fast path when the userns is already created and to join it without re-execing itself. Fix the path in the C code as well so we can join the rootless user+mount namespace without having to re-exec Podman. [NO TESTS NEEDED] Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* rootless: fix SIGSEGV ,make LISTEN_FDNAMES optional [Closes #10435].flouthoc2021-05-29
| | | | | | [NO TESTS NEEDED] Signed-off-by: flouthoc <flouthoc.git@gmail.com>
* rootless: improve automatic range splitGiuseppe Scrivano2021-05-05
| | | | | | | | | | sort.Search returns the smallest index, so provide the available IDs in decreasing order. It fixes an issue when splitting the current mappings over multiple available IDs. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* rootless: Tell the user what was led to the error, not just what it isAndrej Shadura2021-04-27
| | | | | | | | | | | | | | | | | | Users coming e.g. from Docker do not always read the manual and expect podman to not require sudo or uidmap, for them the default message is not very helpful: Error: Cannot connect to the Podman socket, make sure there is a Podman REST API service running.: cannot find newuidmap: exec: "newuidmap": executable file not found in $PATH Adding a bit more context to this would help to nudge them into the right direction and tell them what to look for in the documentation: command required for rootless mode with multiple IDs: exec: "newuidmap": executable file not found in $PATH Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk> [NO TESTS NEEDED]
* rootless: attempt to copy current mappings firstGiuseppe Scrivano2021-04-26
| | | | | | | | | | when creating a user namespace, attempt to create it first by copying the current mappings and then fallback to the other methods: 1) use newidmap tools and ... 2) create a user namespace with a single user mapped. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* rootless: if root is not sub?id raise a debug messageGiuseppe Scrivano2021-04-22
| | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* Move socket activation check into init() and set global condition.pendulm2021-04-05
| | | | | | | | | So rootless setup could use this condition in parent and child, child podman should adjust LISTEN_PID to its self PID. Add system test for systemd socket activation Signed-off-by: pendulm <lonependulm@gmail.com>
* Merge pull request #9855 from giuseppe/fix-service-race-conditionOpenShift Merge Robot2021-03-29
|\ | | | | service: use LISTEN_FDS
| * rootless: use is_fd_inheritedGiuseppe Scrivano2021-03-29
| | | | | | | | | | | | | | since we already have an exported function that does the check, refactor the code to use it instead of duplicating the logic. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | [NO TESTS NEEDED] Shrink the size of podman-remoteDaniel J Walsh2021-03-29
|/ | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* bump go module to v3Valentin Rothberg2021-02-22
| | | | | | | | | We missed bumping the go module, so let's do it now :) * Automated go code with github.com/sirkon/go-imports-rename * Manually via `vgrep podman/v2` the rest Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* Log working dir when chdir failsJonas Schievink2021-02-19
| | | | Signed-off-by: Jonas Schievink <jonasschievink@gmail.com>
* leak fix in rootless_linux.c fcn can_use_shortcutJakub Guzik2021-02-19
| | | | Signed-off-by: Jakub Guzik <jakubmguzik@gmail.com>
* Enable stylecheck linterPaul Holzinger2021-02-11
| | | | | | | | Use the stylecheck linter and fix the reported problems. [NO TESTS NEEDED] Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
* rootless: automatically split userns rangesGiuseppe Scrivano2021-01-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | writing to the id map fails when an extent overlaps multiple mappings in the parent user namespace: $ cat /proc/self/uid_map 0 1000 1 1 100000 65536 $ unshare -U sleep 100 & [1] 1029703 $ printf "0 0 100\n" | tee /proc/$!/uid_map 0 0 100 tee: /proc/1029703/uid_map: Operation not permitted This limitation is particularly annoying when working with rootless containers as each container runs in the rootless user namespace, so a command like: $ podman run --uidmap 0:0:2 --rm fedora echo hi Error: writing file `/proc/664087/gid_map`: Operation not permitted: OCI permission denied would fail since the specified mapping overlaps the first mapping (where the user id is mapped to root) and the second extent with the additional IDs available. Detect such cases and automatically split the specified mapping with the equivalent of: $ podman run --uidmap 0:0:1 --uidmap 1:1:1 --rm fedora echo hi hi A fix has already been proposed for the kernel[1], but even if it accepted it will take time until it is available in a released kernel, so fix it also in pkg/rootless. [1] https://lkml.kernel.org/lkml/20201203150252.1229077-1-gscrivan@redhat.com/ Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* rootless: add function to retrieve uid mappingsGiuseppe Scrivano2021-01-07
| | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* rootless: add function to retrieve gid mappingsGiuseppe Scrivano2021-01-07
| | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* SpellingJosh Soref2020-12-22
| | | | Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
* Remove excessive error wrappingKir Kolyshkin2020-10-05
| | | | | | | | | | | | | | | | | In case os.Open[File], os.Mkdir[All], ioutil.ReadFile and the like fails, the error message already contains the file name and the operation that fails, so there is no need to wrap the error with something like "open %s failed". While at it - replace a few places with os.Open, ioutil.ReadAll with ioutil.ReadFile. - replace errors.Wrapf with errors.Wrap for cases where there are no %-style arguments. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* rootless: use sync.Once for GetAvailableGids()Giuseppe Scrivano2020-10-02
| | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* rootless: move GetAvailableGids to the rootless pkgGiuseppe Scrivano2020-10-02
| | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* rootless: fix hang when newidmap is not installedGiuseppe Scrivano2020-09-25
| | | | | | | | | | | | when newidmap is not installed the code would hit the reexec_in_user_namespace_wait code and wait for the child process to be terminated. The child process is blocked waiting on the w pipe. So make sure to unblock the child process first and then clean it up. Closes: https://github.com/containers/podman/issues/7776 Signed-off-by: Giuseppe Scrivano <giuseppe@scrivano.org>
* Wait for reexec to finish when fileOutput is nilJonathan Dieter2020-08-15
| | | | | | | Currently, we're not cleanup up after ourselves when fileOutput is nil. This patch fixes that. Signed-off-by: Jonathan Dieter <jonathan.dieter@spearline.com>
* Fix hang when `path` doesn't existJonathan Dieter2020-08-11
| | | | | | | | | | I'm not sure if this is an OS-specific issue, but on CentOS 8, if `path` doesn't exist, this hangs while waiting to read from this socket, even though the socket is closed by the `reexec_in_user_namespace`. Switching to a pipe fixes the problem, and pipes shouldn't be an issue since this is Linux-specific code. Signed-off-by: Jonathan Dieter <jonathan.dieter@spearline.com>
* validate fds --preserve-fdsQi Wang2020-08-04
| | | | | | validate file descriptors passed from podman run and podman exec --preserve-fds. Signed-off-by: Qi Wang <qiwan@redhat.com>
* rootless: system service joins immediately the namespacesGiuseppe Scrivano2020-08-03
| | | | | | | | | | when there is a pause process running, let the "system service" podman instance join immediately the existing namespaces. Closes: https://github.com/containers/podman/issues/7180 Closes: https://github.com/containers/podman/issues/6660 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-27 09:51:41 +0000