Merge pull request #3786 from giuseppe/fix-rootless-checks

rootless: drop some superflous checks

cmd/podman/pod_create.go

@@ -78,7 +78,7 @@ func podCreateCmd(c *cliconfig.PodCreateValues) error {
 	if !c.Infra && c.Flag("share").Changed && c.Share != "none" && c.Share != "" {
 		return errors.Errorf("You cannot share kernel namespaces on the pod level without an infra container")
 	}
-	if c.Flag("pod-id-file").Changed && os.Geteuid() == 0 {
+	if c.Flag("pod-id-file").Changed {
 		podIdFile, err = util.OpenExclusiveFile(c.PodIDFile)
 		if err != nil && os.IsExist(err) {
 			return errors.Errorf("pod id file exists. Ensure another pod is not using it or delete %s", c.PodIDFile)

cmd/podman/pod_stats.go

@@ -15,6 +15,8 @@ import (
 	"github.com/containers/libpod/libpod"
 	"github.com/containers/libpod/libpod/define"
 	"github.com/containers/libpod/pkg/adapter"
+	"github.com/containers/libpod/pkg/cgroups"
+	"github.com/containers/libpod/pkg/rootless"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )
@@ -53,9 +55,14 @@ func init() {
 }
 
 func podStatsCmd(c *cliconfig.PodStatsValues) error {
-
-	if os.Geteuid() != 0 {
-		return errors.New("stats is not supported in rootless mode")
+	if rootless.IsRootless() {
+		unified, err := cgroups.IsCgroup2UnifiedMode()
+		if err != nil {
+			return err
+		}
+		if !unified {
+			return errors.New("stats is not supported in rootless mode without cgroups v2")
+		}
 	}
 
 	format := c.Format

cmd/podman/shared/create.go

@@ -55,7 +55,7 @@ func CreateContainer(ctx context.Context, c *GenericCLIResults, runtime *libpod.
 		rootfs = c.InputArgs[0]
 	}
 
-	if c.IsSet("cidfile") && os.Geteuid() == 0 {
+	if c.IsSet("cidfile") {
 		cidFile, err = util.OpenExclusiveFile(c.String("cidfile"))
 		if err != nil && os.IsExist(err) {
 			return nil, nil, errors.Errorf("container id file exists. Ensure another container is not using it or delete %s", c.String("cidfile"))
@@ -70,8 +70,8 @@ func CreateContainer(ctx context.Context, c *GenericCLIResults, runtime *libpod.
 	imageName := ""
 	var data *inspect.ImageData = nil
 
-	// Set the storage if we are running as euid == 0 and there is no rootfs specified
-	if rootfs == "" && os.Geteuid() == 0 {
+	// Set the storage if there is no rootfs specified
+	if rootfs == "" {
 		var writer io.Writer
 		if !c.Bool("quiet") {
 			writer = os.Stderr

cmd/podman/stats.go

@@ -2,7 +2,6 @@ package main
 
 import (
 	"fmt"
-	"os"
 	"reflect"
 	"strings"
 	"time"
@@ -13,6 +12,8 @@ import (
 	"github.com/containers/libpod/cmd/podman/libpodruntime"
 	"github.com/containers/libpod/libpod"
 	"github.com/containers/libpod/libpod/define"
+	"github.com/containers/libpod/pkg/cgroups"
+	"github.com/containers/libpod/pkg/rootless"
 	"github.com/docker/go-units"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
@@ -66,8 +67,14 @@ func init() {
 }
 
 func statsCmd(c *cliconfig.StatsValues) error {
-	if os.Geteuid() != 0 {
-		return errors.New("stats is not supported for rootless containers")
+	if rootless.IsRootless() {
+		unified, err := cgroups.IsCgroup2UnifiedMode()
+		if err != nil {
+			return err
+		}
+		if !unified {
+			return errors.New("stats is not supported in rootless mode without cgroups v2")
+		}
 	}
 
 	all := c.All

libpod/oci_internal_linux.go

@@ -352,31 +352,29 @@ func startCommandGivenSelinux(cmd *exec.Cmd) error {
 // it then signals for conmon to start by sending nonse data down the start fd
 func (r *OCIRuntime) moveConmonToCgroupAndSignal(ctr *Container, cmd *exec.Cmd, startFd *os.File, uuid string) error {
 	cgroupParent := ctr.CgroupParent()
-	if os.Geteuid() == 0 {
-		if r.cgroupManager == SystemdCgroupsManager {
-			unitName := createUnitName("libpod-conmon", ctr.ID())
+	if r.cgroupManager == SystemdCgroupsManager {
+		unitName := createUnitName("libpod-conmon", ctr.ID())
 
-			realCgroupParent := cgroupParent
-			splitParent := strings.Split(cgroupParent, "/")
-			if strings.HasSuffix(cgroupParent, ".slice") && len(splitParent) > 1 {
-				realCgroupParent = splitParent[len(splitParent)-1]
-			}
+		realCgroupParent := cgroupParent
+		splitParent := strings.Split(cgroupParent, "/")
+		if strings.HasSuffix(cgroupParent, ".slice") && len(splitParent) > 1 {
+			realCgroupParent = splitParent[len(splitParent)-1]
+		}
 
-			logrus.Infof("Running conmon under slice %s and unitName %s", realCgroupParent, unitName)
-			if err := utils.RunUnderSystemdScope(cmd.Process.Pid, realCgroupParent, unitName); err != nil {
-				logrus.Warnf("Failed to add conmon to systemd sandbox cgroup: %v", err)
-			}
+		logrus.Infof("Running conmon under slice %s and unitName %s", realCgroupParent, unitName)
+		if err := utils.RunUnderSystemdScope(cmd.Process.Pid, realCgroupParent, unitName); err != nil {
+			logrus.Warnf("Failed to add conmon to systemd sandbox cgroup: %v", err)
+		}
+	} else {
+		cgroupPath := filepath.Join(ctr.config.CgroupParent, "conmon")
+		control, err := cgroups.New(cgroupPath, &spec.LinuxResources{})
+		if err != nil {
+			logrus.Warnf("Failed to add conmon to cgroupfs sandbox cgroup: %v", err)
 		} else {
-			cgroupPath := filepath.Join(ctr.config.CgroupParent, "conmon")
-			control, err := cgroups.New(cgroupPath, &spec.LinuxResources{})
-			if err != nil {
+			// we need to remove this defer and delete the cgroup once conmon exits
+			// maybe need a conmon monitor?
+			if err := control.AddPid(cmd.Process.Pid); err != nil {
 				logrus.Warnf("Failed to add conmon to cgroupfs sandbox cgroup: %v", err)
-			} else {
-				// we need to remove this defer and delete the cgroup once conmon exits
-				// maybe need a conmon monitor?
-				if err := control.AddPid(cmd.Process.Pid); err != nil {
-					logrus.Warnf("Failed to add conmon to cgroupfs sandbox cgroup: %v", err)
-				}
 			}
 		}
 	}

pkg/spec/storage.go

@@ -238,11 +238,6 @@ func (config *CreateConfig) parseVolumes(runtime *libpod.Runtime) ([]spec.Mount,
 // Conflicts are resolved simply - the last container specified wins.
 // Container names may be suffixed by mount options after a colon.
 func (config *CreateConfig) getVolumesFrom(runtime *libpod.Runtime) (map[string]spec.Mount, map[string]*libpod.ContainerNamedVolume, error) {
-	// TODO: This can probably be disabled now
-	if os.Geteuid() != 0 {
-		return nil, nil, nil
-	}
-
 	// Both of these are maps of mount destination to mount type.
 	// We ensure that each destination is only mounted to once in this way.
 	finalMounts := make(map[string]spec.Mount)