rootless: not require userns for help/version

these commands do not require to be root in an userns Closes: containers#1263 Signed-off-by: Giuseppe Scrivano <[email protected]> Closes: containers#1268 Approved by: vrothberg
vrothberg · Aug 14, 2018 · a04ce68 · a04ce68
1 parent 9563f31
commit a04ce68
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 9 deletions.
diff --git a/cmd/podman/main.go b/cmd/podman/main.go
@@ -25,19 +25,12 @@ var (
 	exitCode = 125
 )
 
+var cmdsNotRequiringRootless = map[string]bool{"help": true, "version": true}
+
 func main() {
 	debug := false
 	cpuProfile := false
 
-	became, ret, err := rootless.BecomeRootInUserNS()
-	if err != nil {
-		logrus.Errorf(err.Error())
-		os.Exit(1)
-	}
-	if became {
-		os.Exit(ret)
-	}
-
 	if reexec.Init() {
 		return
 	}
@@ -97,6 +90,19 @@ func main() {
 	}
 
 	app.Before = func(c *cli.Context) error {
+		args := c.Args()
+		if args.Present() {
+			if _, notRequireRootless := cmdsNotRequiringRootless[args.First()]; !notRequireRootless {
+				became, ret, err := rootless.BecomeRootInUserNS()
+				if err != nil {
+					logrus.Errorf(err.Error())
+					os.Exit(1)
+				}
+				if became {
+					os.Exit(ret)
+				}
+			}
+		}
 		if c.GlobalBool("syslog") {
 			hook, err := lsyslog.NewSyslogHook("", "", syslog.LOG_INFO, "")
 			if err == nil {

diff --git a/test/e2e/rootless_test.go b/test/e2e/rootless_test.go
@@ -34,6 +34,16 @@ var _ = Describe("Podman rootless", func() {
 		GinkgoWriter.Write([]byte(timedResult))
 	})
 
+	It("podman rootless help|version", func() {
+		commands := []string{"help", "version"}
+		for _, v := range commands {
+			env := os.Environ()
+			cmd := podmanTest.PodmanAsUser([]string{v}, 1000, 1000, env)
+			cmd.WaitWithDefaultTimeout()
+			Expect(cmd.ExitCode()).To(Equal(0))
+		}
+	})
+
 	It("podman rootless rootfs", func() {
 		// Check if we can create an user namespace
 		err := exec.Command("unshare", "-r", "echo", "hello").Run()