propose running init/rm command on hyperv machine in elevated mode

This commit adds automatic UAC elevation prompts for HyperV machine
init/rm actions when administrator privileges are required.
Previously, users had to manually run Podman as administrator
when creating the first machine or removing the last machine, which
requires Windows Registry modifications.

Signed-off-by: lstocchi <lstocchi@redhat.com>

Author: lstocchi

cmd/podman/machine/init.go

@@ -287,7 +287,7 @@ func initMachine(cmd *cobra.Command, args []string) error {
 		// Examples:
 		// - a user has chosen to perform their own reboot
 		// - reexec for limited admin operations, returning to parent
-		if errors.Is(err, define.ErrInitRelaunchAttempt) {
+		if errors.Is(err, define.ErrRelaunchAttempt) {
 			return nil
 		}
 		return err

cmd/podman/machine/rm.go

@@ -3,9 +3,12 @@
 package machine
 
 import (
+	"errors"
+
 	"github.com/containers/podman/v6/cmd/podman/registry"
 	"github.com/containers/podman/v6/libpod/events"
 	"github.com/containers/podman/v6/pkg/machine"
+	"github.com/containers/podman/v6/pkg/machine/define"
 	"github.com/containers/podman/v6/pkg/machine/shim"
 	"github.com/spf13/cobra"
 )
@@ -38,6 +41,13 @@ func init() {
 
 	imageFlagName := "save-image"
 	flags.BoolVar(&destroyOptions.SaveImage, imageFlagName, false, "Do not delete the image file")
+
+	flags.BoolVar(
+		&destroyOptions.ReExec,
+		"reexec", false,
+		"process was rexeced",
+	)
+	_ = flags.MarkHidden("reexec")
 }
 
 func rm(_ *cobra.Command, args []string) error {
@@ -53,6 +63,13 @@ func rm(_ *cobra.Command, args []string) error {
 	}
 
 	if err := shim.Remove(mc, vmProvider, destroyOptions); err != nil {
+		// The removal is partially complete and podman should
+		// exit gracefully with no error and no success message.
+		// Examples:
+		// - reexec for limited admin operations, returning to parent
+		if errors.Is(err, define.ErrRelaunchAttempt) {
+			return nil
+		}
 		return err
 	}
 	newMachineEvent(events.Remove, events.Event{Name: vmName})

pkg/machine/config.go

@@ -74,6 +74,7 @@ type StartOptions struct {
 type StopOptions struct{}
 
 type RemoveOptions struct {
+	ReExec       bool
 	Force        bool
 	SaveImage    bool
 	SaveIgnition bool

pkg/machine/define/errors.go

@@ -6,10 +6,10 @@ import (
 )
 
 var (
-	ErrWrongState          = errors.New("VM in wrong state to perform action")
-	ErrNotImplemented      = errors.New("functionality not implemented")
-	ErrInitRelaunchAttempt = errors.New("stopping execution: 'init' relaunched with --reexec flag to reinitialize the VM")
-	ErrRebootInitiated     = errors.New("system reboot initiated")
+	ErrWrongState      = errors.New("VM in wrong state to perform action")
+	ErrNotImplemented  = errors.New("functionality not implemented")
+	ErrRelaunchAttempt = errors.New("stopping execution: command relaunched with --reexec flag for elevated privileges")
+	ErrRebootInitiated = errors.New("system reboot initiated")
 )
 
 type ErrVMAlreadyExists struct {

pkg/machine/hyperv/stubber.go

@@ -62,6 +62,14 @@ func (h HyperVStubber) CreateVM(_ define.CreateVMOpts, mc *vmconfigs.MachineConf
 	// This is to prevent a non-admin user from creating the first machine
 	// which would require adding vsock entries into the Windows Registry.
 	if err := h.canCreate(); err != nil {
+		// If it returns ErrHypervRegistryInitRequiresElevation and we're not already re-executing,
+		// offer to elevate automatically if user is in admin group
+		if err == ErrHypervRegistryInitRequiresElevation && !windows.IsReExecuting() && windows.IsInAdministratorsGroup() {
+			message := "To initialize the first Hyper-V machine, Podman requires admin rights to set up the Windows Registry.\n\n" +
+				"A UAC prompt will appear asking for your approval.\n\n" +
+				"Would you like to continue?"
+			return launchElevate(message)
+		}
 		return err
 	}
 
@@ -178,6 +186,14 @@ func (h HyperVStubber) Remove(mc *vmconfigs.MachineConfig) ([]string, func() err
 	// This is to prevent a non-admin user from deleting the last machine
 	// which would require removal of vsock entries from the Windows Registry.
 	if err := h.canRemove(mc); err != nil {
+		// If we get ErrHypervRegistryRemoveRequiresElevation and we're not already re-executing,
+		// and the user has admin rights (is in admin group), offer to elevate automatically
+		if err == ErrHypervRegistryRemoveRequiresElevation && !windows.IsReExecuting() && windows.IsInAdministratorsGroup() {
+			message := "Removing this Hyper-V machine requires admin rights to clean up the Windows Registry.\n\n" +
+				"A UAC prompt will appear asking for your approval.\n\n" +
+				"Would you like to continue?"
+			return nil, nil, launchElevate(message)
+		}
 		return nil, nil, err
 	}
 
@@ -236,6 +252,21 @@ func (h HyperVStubber) canCreate() error {
 	return ErrHypervUserNotInAdminGroup
 }
 
+// launchElevate attempts to automatically re-run the command as administrator
+// This is similar to how WSL handles elevation.
+func launchElevate(message string) error {
+	if windows.MessageBox(message, "Podman Machine", false) != 1 {
+		return errors.New("elevation process cancelled by user. Please rerun the command as administrator")
+	}
+
+	err := windows.RelaunchElevatedWait()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Elevated process failed with error: %v\n\n", err)
+		return fmt.Errorf("elevated process failed with error: %w", err)
+	}
+	return define.ErrRelaunchAttempt
+}
+
 func isLegacyMachine(mc *vmconfigs.MachineConfig) bool {
 	return mc.HyperVHypervisor != nil && mc.HyperVHypervisor.ReadyVsock.MachineName != ""
 }
@@ -553,6 +584,12 @@ func (h HyperVStubber) PrepareIgnition(mc *vmconfigs.MachineConfig, _ *ignition.
 	readySock, err := vsock.LoadHVSockRegistryEntryByPurpose(vsock.Events)
 	if err != nil {
 		if !windows.HasAdminRights() {
+			if !windows.IsReExecuting() && windows.IsInAdministratorsGroup() {
+				message := "Initializing the first Hyper-V machine requires admin rights to set up the Windows Registry.\n\n" +
+					"A UAC prompt will appear asking for your approval.\n\n" +
+					"Would you like to continue?"
+				return nil, launchElevate(message)
+			}
 			return nil, ErrHypervRegistryInitRequiresElevation
 		}
 		readySock, err = vsock.NewHVSockRegistryEntry(vsock.Events)

pkg/machine/shim/host.go

@@ -732,8 +732,10 @@ func Remove(mc *vmconfigs.MachineConfig, mp vmconfigs.VMProvider, opts machine.R
 	if err != nil {
 		return err
 	}
-	mc.Lock()
-	defer mc.Unlock()
+	if !opts.ReExec {
+		mc.Lock()
+		defer mc.Unlock()
+	}
 	if err := mc.Refresh(); err != nil {
 		return fmt.Errorf("reload config: %w", err)
 	}

pkg/machine/windows/util_windows.go

@@ -4,6 +4,8 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"os/user"
+	"slices"
 	"strings"
 	"syscall"
 	"unsafe"
@@ -12,6 +14,24 @@ import (
 	"golang.org/x/sys/windows"
 )
 
+// IsInAdministratorsGroup checks if the current user is a member of the Administrators group,
+// regardless of whether the current process is elevated. This can be used to determine
+// if the user can elevate privileges via UAC.
+func IsInAdministratorsGroup() bool {
+	u, err := user.Current()
+	if nil != err {
+		return false
+	}
+	ids, err := u.GroupIds()
+	if nil != err {
+		return false
+	}
+	// S-1-5-32-544 is the SID for the Administrators group
+	// see: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
+	return slices.Contains(ids, "S-1-5-32-544")
+}
+
+// HasAdminRights checks if the current process has administrator privileges.
 func HasAdminRights() bool {
 	var sid *windows.SID
 
@@ -181,3 +201,13 @@ func wrapMaybef(err error, format string, args ...any) error {
 
 	return fmt.Errorf(format, args...)
 }
+
+// IsReExecuting checks if the current process was re-executed with --reexec flag
+func IsReExecuting() bool {
+	for _, arg := range os.Args {
+		if arg == "--reexec" {
+			return true
+		}
+	}
+	return false
+}

pkg/machine/wsl/machine.go

@@ -325,7 +325,7 @@ func attemptFeatureInstall(reExec, admin bool) error {
 		"If you prefer, you may abort now, and perform a manual installation using the \"wsl --install\" command."
 
 	if !reExec && winutil.MessageBox(message, "Podman Machine", false) != 1 {
-		return fmt.Errorf("the WSL installation aborted: %w", define.ErrInitRelaunchAttempt)
+		return fmt.Errorf("the WSL installation aborted: %w", define.ErrRelaunchAttempt)
 	}
 
 	if !reExec && !admin {
@@ -343,16 +343,16 @@ func launchElevate(operation string) error {
 		if eerr, ok := err.(*winutil.ExitCodeError); ok {
 			if eerr.Code == ErrorSuccessRebootRequired {
 				fmt.Println("Reboot is required to continue installation, please reboot at your convenience")
-				return define.ErrInitRelaunchAttempt
+				return define.ErrRelaunchAttempt
 			}
 		}
 
 		fmt.Fprintf(os.Stderr, "Elevated process failed with error: %v\n\n", err)
 		dumpOutputFile()
 		fmt.Fprintf(os.Stderr, wslInstallError, operation)
-		return fmt.Errorf("%w: %w", err, define.ErrInitRelaunchAttempt)
+		return fmt.Errorf("%w: %w", err, define.ErrRelaunchAttempt)
 	}
-	return define.ErrInitRelaunchAttempt
+	return define.ErrRelaunchAttempt
 }
 
 func installWsl() error {