Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Switch all rootful to rootfull #13964

Merged
merged 1 commit into from
Apr 22, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions cmd/podman/machine/init.go
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ import (
"github.com/containers/podman/v4/pkg/machine"
"github.com/pkg/errors"
"github.com/spf13/cobra"
"github.com/spf13/pflag"
)

var (
Expand Down Expand Up @@ -106,8 +107,18 @@ func init() {
flags.StringVar(&initOpts.IgnitionPath, IgnitionPathFlagName, "", "Path to ignition file")
_ = initCmd.RegisterFlagCompletionFunc(IgnitionPathFlagName, completion.AutocompleteDefault)

rootfulFlagName := "rootful"
flags.BoolVar(&initOpts.Rootful, rootfulFlagName, false, "Whether this machine should prefer rootful container execution")
rootfullFlagName := "rootfull"
flags.BoolVar(&initOpts.Rootfull, rootfullFlagName, false, "Whether this machine should prefer rootfull container execution")
flags.SetNormalizeFunc(aliasFlags)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we still support rootful? Similar to how we're still supporting the --pull-always option under the covers?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We do, that is what the SetNormalizeFunc does, It basically aliases rootful->rootfull, so if people built scripts with the old option, it will continue to work.

}

// aliasFlags is a function to handle backwards compatibility with old flags
func aliasFlags(f *pflag.FlagSet, name string) pflag.NormalizedName {
switch name {
case "rootful":
name = "rootfull"
}
return pflag.NormalizedName(name)
}

// TODO should we allow for a users to append to the qemu cmdline?
Expand Down
7 changes: 4 additions & 3 deletions cmd/podman/machine/set.go
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ var (
Long: "Sets an updatable virtual machine setting",
RunE: setMachine,
Args: cobra.MaximumNArgs(1),
Example: `podman machine set --rootful=false`,
Example: `podman machine set --rootfull=false`,
ValidArgsFunction: completion.AutocompleteNone,
}
)
Expand All @@ -33,8 +33,9 @@ func init() {
})
flags := setCmd.Flags()

rootfulFlagName := "rootful"
flags.BoolVar(&setOpts.Rootful, rootfulFlagName, false, "Whether this machine should prefer rootful container execution")
rootfullFlagName := "rootfull"
flags.BoolVar(&setOpts.Rootfull, rootfullFlagName, false, "Whether this machine should prefer rootfull container execution")
flags.SetNormalizeFunc(aliasFlags)
}

func setMachine(cmd *cobra.Command, args []string) error {
Expand Down
2 changes: 1 addition & 1 deletion contrib/cirrus/logformatter
Original file line number Diff line number Diff line change
Expand Up @@ -204,7 +204,7 @@ END_HTML

print { $out_fh } "<pre> <!-- begin processed output -->\n";

# Assume rootful prompt, check for rootless (here and in log itself, below)
# Assume rootfull prompt, check for rootless (here and in log itself, below)
my $Prompt = '#';
$Prompt = '$' if $test_name =~ /rootless/;

Expand Down
2 changes: 1 addition & 1 deletion contrib/podmanimage/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -70,4 +70,4 @@ file to `/etc/modules.load.d`. See `man modules-load.d` for more details.

### Blog Post with Details

Dan Walsh wrote a blog post on the [Enable Sysadmin](https://www.redhat.com/sysadmin/) site titled [How to use Podman inside of a container](https://www.redhat.com/sysadmin/podman-inside-container). In it, he details how to use these images as a rootful and as a rootless user. Please refer to this blog for more detailed information.
Dan Walsh wrote a blog post on the [Enable Sysadmin](https://www.redhat.com/sysadmin/) site titled [How to use Podman inside of a container](https://www.redhat.com/sysadmin/podman-inside-container). In it, he details how to use these images as a rootfull and as a rootless user. Please refer to this blog for more detailed information.
2 changes: 1 addition & 1 deletion contrib/remote/containers.conf
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,5 @@
# Default Remote URI to access the Podman service.
# Examples:
# remote rootless ssh://engineering.lab.company.com/run/user/1000/podman/podman.sock
# remote rootful ssh://[email protected]:22/run/podman/podman.sock
# remote rootfull ssh://[email protected]:22/run/podman/podman.sock
# remote_uri= ""
2 changes: 1 addition & 1 deletion docs/source/markdown/podman-build.1.md
Original file line number Diff line number Diff line change
Expand Up @@ -429,7 +429,7 @@ container full access to local system services such as D-bus and is therefore
considered insecure.
- **ns:**_path_: path to a network namespace to join.
- **private**: create a new namespace for the container (default)
- **\<network name|ID\>**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootful users.
- **\<network name|ID\>**: Join the network with the given name or ID, e.g. use `--network mynet` to join the network with the name mynet. Only supported for rootfull users.

#### **--no-cache**

Expand Down
2 changes: 1 addition & 1 deletion docs/source/markdown/podman-image-scp.1.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ podman-image-scp - Securely copy an image from one host to another

## DESCRIPTION
**podman image scp** copies container images between hosts on a network. You can load to the remote host or from the remote host as well as in between two remote hosts.
Note: `::` is used to specify the image name depending on if you are saving or loading. Images can also be transferred from rootful to rootless storage on the same machine without using sshd. This feature is not supported on the remote client, including Mac and Windows (excluding WSL2) machines.
Note: `::` is used to specify the image name depending on if you are saving or loading. Images can also be transferred from rootfull to rootless storage on the same machine without using sshd. This feature is not supported on the remote client, including Mac and Windows (excluding WSL2) machines.

**podman image scp [GLOBAL OPTIONS]**

Expand Down
6 changes: 3 additions & 3 deletions docs/source/markdown/podman-machine-init.1.md
Original file line number Diff line number Diff line change
Expand Up @@ -59,9 +59,9 @@ Memory (in MB).

Start the virtual machine immediately after it has been initialized.

#### **--rootful**=*true|false*
#### **--rootfull**=*true|false*

Whether this machine should prefer rootful (`true`) or rootless (`false`)
Whether this machine should prefer rootfull (`true`) or rootless (`false`)
container execution. This option will also determine the remote connection default
if there is no existing remote connection configurations.

Expand Down Expand Up @@ -95,7 +95,7 @@ Driver to use for mounting volumes from the host, such as `virtfs`.
```
$ podman machine init
$ podman machine init myvm
$ podman machine init --rootful
$ podman machine init --rootfull
$ podman machine init --disk-size 50
$ podman machine init --memory=1024 myvm
$ podman machine init -v /Users:/mnt/Users
Expand Down
20 changes: 10 additions & 10 deletions docs/source/markdown/podman-machine-set.1.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,39 +19,39 @@ subset can be changed after machine initialization.

Print usage statement.

#### **--rootful**=*true|false*
#### **--rootfull**=*true|false*

Whether this machine should prefer rootful (`true`) or rootless (`false`)
Whether this machine should prefer rootfull (`true`) or rootless (`false`)
container execution. This option will also update the current podman
remote connection default if it is currently pointing at the specified
machine name (or `podman-machine-default` if no name is specified).

Unlike [**podman system connection default**](podman-system-connection-default.1.md)
this option will also make the API socket, if available, forward to the rootful/rootless
this option will also make the API socket, if available, forward to the rootfull/rootless
socket in the VM.

## EXAMPLES

To switch the default VM `podman-machine-default` from rootless to rootful:
To switch the default VM `podman-machine-default` from rootless to rootfull:

```
$ podman machine set --rootful
$ podman machine set --rootfull
```

or more explicitly:

```
$ podman machine set --rootful=true
$ podman machine set --rootfull=true
```

To switch the default VM `podman-machine-default` from rootful to rootless:
To switch the default VM `podman-machine-default` from rootfull to rootless:
```
$ podman machine set --rootful=false
$ podman machine set --rootfull=false
```

To switch the VM `myvm` from rootless to rootful:
To switch the VM `myvm` from rootless to rootfull:
```
$ podman machine set --rootful myvm
$ podman machine set --rootfull myvm
```

## SEE ALSO
Expand Down
2 changes: 1 addition & 1 deletion libpod/networking_slirp4netns.go
Original file line number Diff line number Diff line change
Expand Up @@ -210,7 +210,7 @@ func createBasicSlirp4netnsCmdArgs(options *slirp4netnsNetworkOptions, features
return cmdArgs, nil
}

// setupSlirp4netns can be called in rootful as well as in rootless
// setupSlirp4netns can be called in rootfull as well as in rootless
func (r *Runtime) setupSlirp4netns(ctr *Container, netns ns.NetNS) error {
path := r.config.Engine.NetworkCmdPath
if path == "" {
Expand Down
8 changes: 4 additions & 4 deletions pkg/bindings/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ The bindings require that the Podman system service is running for the specified
by calling the service directly.

### Starting the service with system
The command to start the Podman service differs slightly depending on the user that is running the service. For a rootful service,
The command to start the Podman service differs slightly depending on the user that is running the service. For a rootfull service,
start the service like this:
```
# systemctl start podman.socket
Expand All @@ -26,7 +26,7 @@ It can be handy to run the system service manually. Doing so allows you to enab
$ podman --log-level=debug system service -t0
```
If you do not provide a specific path for the socket, a default is provided. The location of that socket for
rootful connections is `/run/podman/podman.sock` and for rootless it is `/run/USERID#/podman/podman.sock`. For more
rootfull connections is `/run/podman/podman.sock` and for rootless it is `/run/USERID#/podman/podman.sock`. For more
information about the Podman system service, see `man podman-system-service`.

### Creating a connection
Expand All @@ -35,7 +35,7 @@ as they will be required to compile a Go program making use of the bindings.


The first step for using the bindings is to create a connection to the socket. As mentioned earlier, the destination
of the socket depends on the user who owns it. In this case, a rootful connection is made.
of the socket depends on the user who owns it. In this case, a rootfull connection is made.

```
import (
Expand All @@ -59,7 +59,7 @@ The `conn` variable returned from the `bindings.NewConnection` function can then
to interact with containers.

### Examples
The following examples build upon the connection example from above. They are all rootful connections as well.
The following examples build upon the connection example from above. They are all rootfull connections as well.

Note: Optional arguments to the bindings methods are set using With*() methods on *Option structures.
Composite types are not duplicated rather the address is used. As such, you should not change an underlying
Expand Down
6 changes: 3 additions & 3 deletions pkg/domain/infra/abi/images.go
Original file line number Diff line number Diff line change
Expand Up @@ -367,7 +367,7 @@ func (ir *ImageEngine) Transfer(ctx context.Context, source entities.ImageScpOpt
if rootless.IsRootless() && (len(dest.User) == 0 || dest.User == "root") { // if we are rootless and do not have a destination user we can just use sudo
return transferRootless(source, dest, podman, parentFlags)
}
return transferRootful(source, dest, podman, parentFlags)
return transferRootfull(source, dest, podman, parentFlags)
}

func (ir *ImageEngine) Tag(ctx context.Context, nameOrID string, tags []string, options entities.ImageTagOptions) error {
Expand Down Expand Up @@ -785,8 +785,8 @@ func transferRootless(source entities.ImageScpOptions, dest entities.ImageScpOpt
return cmdLoad.Run()
}

// TransferRootful creates new podman processes using exec.Command and a new uid/gid alongside a cleared environment
func transferRootful(source entities.ImageScpOptions, dest entities.ImageScpOptions, podman string, parentFlags []string) error {
// transferRootfull creates new podman processes using exec.Command and a new uid/gid alongside a cleared environment
func transferRootfull(source entities.ImageScpOptions, dest entities.ImageScpOptions, podman string, parentFlags []string) error {
basicCommand := []string{podman}
basicCommand = append(basicCommand, parentFlags...)
saveCommand := append(basicCommand, "save")
Expand Down
4 changes: 2 additions & 2 deletions pkg/machine/config.go
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ type InitOptions struct {
URI url.URL
Username string
ReExec bool
Rootful bool
Rootfull bool
// The numerical userid of the user that called machine
UID string
}
Expand Down Expand Up @@ -95,7 +95,7 @@ type ListResponse struct {
}

type SetOptions struct {
Rootful bool
Rootfull bool
}

type SSHOptions struct {
Expand Down
8 changes: 4 additions & 4 deletions pkg/machine/qemu/config.go
Original file line number Diff line number Diff line change
Expand Up @@ -57,8 +57,8 @@ type MachineVMV1 struct {
QMPMonitor Monitorv1
// RemoteUsername of the vm user
RemoteUsername string
// Whether this machine should run in a rootful or rootless manner
Rootful bool
// Whether this machine should run in a rootfull or rootless manner
Rootfull bool
// UID is the numerical id of the user that called machine
UID int
}
Expand Down Expand Up @@ -99,8 +99,8 @@ type ImageConfig struct {

// HostUser describes the host user
type HostUser struct {
// Whether this machine should run in a rootful or rootless manner
Rootful bool
// Whether this machine should run in a rootfull or rootless manner
Rootfull bool
// UID is the numerical id of the user that called machine
UID int
}
Expand Down
20 changes: 10 additions & 10 deletions pkg/machine/qemu/machine.go
Original file line number Diff line number Diff line change
Expand Up @@ -204,7 +204,7 @@ func migrateVM(configPath string, config []byte, vm *MachineVM) error {
vm.QMPMonitor = qmpMonitor
vm.ReadySocket = readySocket
vm.RemoteUsername = old.RemoteUsername
vm.Rootful = old.Rootful
vm.Rootfull = old.Rootfull
vm.UID = old.UID

// Backup the original config file
Expand Down Expand Up @@ -258,7 +258,7 @@ func (v *MachineVM) Init(opts machine.InitOptions) (bool, error) {
)
sshDir := filepath.Join(homedir.Get(), ".ssh")
v.IdentityPath = filepath.Join(sshDir, v.Name)
v.Rootful = opts.Rootful
v.Rootfull = opts.Rootfull

switch opts.ImagePath {
case Testing, Next, Stable, "":
Expand Down Expand Up @@ -356,8 +356,8 @@ func (v *MachineVM) Init(opts machine.InitOptions) (bool, error) {
names := []string{v.Name, v.Name + "-root"}

// The first connection defined when connections is empty will become the default
// regardless of IsDefault, so order according to rootful
if opts.Rootful {
// regardless of IsDefault, so order according to rootfull
if opts.Rootfull {
uris[0], names[0], uris[1], names[1] = uris[1], names[1], uris[0], names[0]
}

Expand Down Expand Up @@ -435,7 +435,7 @@ func (v *MachineVM) Init(opts machine.InitOptions) (bool, error) {
}

func (v *MachineVM) Set(_ string, opts machine.SetOptions) error {
if v.Rootful == opts.Rootful {
if v.Rootfull == opts.Rootfull {
return nil
}

Expand All @@ -459,15 +459,15 @@ func (v *MachineVM) Set(_ string, opts machine.SetOptions) error {

if changeCon {
newDefault := v.Name
if opts.Rootful {
if opts.Rootfull {
newDefault += "-root"
}
if err := machine.ChangeDefault(newDefault); err != nil {
return err
}
}

v.Rootful = opts.Rootful
v.Rootfull = opts.Rootfull
return v.writeConfig()
}

Expand Down Expand Up @@ -1117,7 +1117,7 @@ func (v *MachineVM) setupAPIForwarding(cmd []string) ([]string, string, apiForwa
destSock := fmt.Sprintf("/run/user/%d/podman/podman.sock", v.UID)
forwardUser := "core"

if v.Rootful {
if v.Rootfull {
destSock = "/run/podman/podman.sock"
forwardUser = "root"
}
Expand Down Expand Up @@ -1323,11 +1323,11 @@ func (v *MachineVM) waitAPIAndPrintInfo(forwardState apiForwardingState, forward
}

waitAndPingAPI(forwardSock)
if !v.Rootful {
if !v.Rootfull {
fmt.Printf("\nThis machine is currently configured in rootless mode. If your containers\n")
fmt.Printf("require root permissions (e.g. ports < 1024), or if you run into compatibility\n")
fmt.Printf("issues with non-podman clients, you can switch using the following command: \n")
fmt.Printf("\n\tpodman machine set --rootful%s\n\n", suffix)
fmt.Printf("\n\tpodman machine set --rootfull%s\n\n", suffix)
}

fmt.Printf("API forwarding listening on: %s\n", forwardSock)
Expand Down
Loading