propose running init/rm command on hyperv machine in elevated mode

This commit adds automatic UAC elevation prompts for HyperV machine
init/rm actions when administrator privileges are required.
Previously, users had to manually run Podman as administrator
when creating the first machine or removing the last machine, which
requires Windows Registry modifications.

When the HyperV command gets relaunched as elevated, the error of the
elevated process is saved on a file to be displayed by the caller. The
implementation is the same as that used by WSL.

Signed-off-by: lstocchi <lstocchi@redhat.com>

Author: lstocchi

cmd/podman/machine/init.go

@@ -287,7 +287,13 @@ func initMachine(cmd *cobra.Command, args []string) error {
 		// Examples:
 		// - a user has chosen to perform their own reboot
 		// - reexec for limited admin operations, returning to parent
-		if errors.Is(err, define.ErrInitRelaunchAttempt) {
+		if errors.Is(err, define.ErrRelaunchAttempt) {
+			fmt.Println("Machine init complete")
+			if now {
+				fmt.Printf("Machine %q started successfully\n", initOpts.Name)
+				return nil
+			}
+			printStartCommand(initOpts.Name)
 			return nil
 		}
 		return err
@@ -297,15 +303,21 @@ func initMachine(cmd *cobra.Command, args []string) error {
 	fmt.Println("Machine init complete")
 
 	if now {
+		// Pass reexec flag from init to start
+		startOpts.ReExec = initOpts.ReExec
 		return start(cmd, args)
 	}
 
+	printStartCommand(initOpts.Name)
+	return err
+}
+
+func printStartCommand(machineName string) {
 	extra := ""
-	if initOpts.Name != defaultMachineName {
-		extra = " " + initOpts.Name
+	if machineName != defaultMachineName {
+		extra = " " + machineName
 	}
 	fmt.Printf("To start your machine run:\n\n\tpodman machine start%s\n\n", extra)
-	return err
 }
 
 // checkMaxMemory gets the total system memory and compares it to the variable.  if the variable

cmd/podman/machine/rm.go

@@ -3,9 +3,12 @@
 package machine
 
 import (
+	"errors"
+
 	"github.com/containers/podman/v6/cmd/podman/registry"
 	"github.com/containers/podman/v6/libpod/events"
 	"github.com/containers/podman/v6/pkg/machine"
+	"github.com/containers/podman/v6/pkg/machine/define"
 	"github.com/containers/podman/v6/pkg/machine/shim"
 	"github.com/spf13/cobra"
 )
@@ -38,6 +41,13 @@ func init() {
 
 	imageFlagName := "save-image"
 	flags.BoolVar(&destroyOptions.SaveImage, imageFlagName, false, "Do not delete the image file")
+
+	flags.BoolVar(
+		&destroyOptions.ReExec,
+		"reexec", false,
+		"process was rexeced",
+	)
+	_ = flags.MarkHidden("reexec")
 }
 
 func rm(_ *cobra.Command, args []string) error {
@@ -53,6 +63,13 @@ func rm(_ *cobra.Command, args []string) error {
 	}
 
 	if err := shim.Remove(mc, vmProvider, destroyOptions); err != nil {
+		// The removal is partially complete and podman should
+		// exit gracefully with no error and no success message.
+		// Examples:
+		// - reexec for limited admin operations, returning to parent
+		if errors.Is(err, define.ErrRelaunchAttempt) {
+			return nil
+		}
 		return err
 	}
 	newMachineEvent(events.Remove, events.Event{Name: vmName})

pkg/machine/config.go

@@ -66,6 +66,7 @@ type SSHOptions struct {
 }
 
 type StartOptions struct {
+	ReExec  bool
 	NoInfo  bool
 	Quiet   bool
 	Rosetta bool
@@ -74,6 +75,7 @@ type StartOptions struct {
 type StopOptions struct{}
 
 type RemoveOptions struct {
+	ReExec       bool
 	Force        bool
 	SaveImage    bool
 	SaveIgnition bool

pkg/machine/define/errors.go

@@ -6,10 +6,10 @@ import (
 )
 
 var (
-	ErrWrongState          = errors.New("VM in wrong state to perform action")
-	ErrNotImplemented      = errors.New("functionality not implemented")
-	ErrInitRelaunchAttempt = errors.New("stopping execution: 'init' relaunched with --reexec flag to reinitialize the VM")
-	ErrRebootInitiated     = errors.New("system reboot initiated")
+	ErrWrongState      = errors.New("VM in wrong state to perform action")
+	ErrNotImplemented  = errors.New("functionality not implemented")
+	ErrRelaunchAttempt = errors.New("stopping execution: command relaunched with --reexec flag for elevated privileges")
+	ErrRebootInitiated = errors.New("system reboot initiated")
 )
 
 type ErrVMAlreadyExists struct {

pkg/machine/hyperv/stubber.go

@@ -46,6 +46,7 @@ func (h HyperVStubber) CreateVM(_ define.CreateVMOpts, mc *vmconfigs.MachineConf
 	var err error
 	callbackFuncs := machine.CleanUp()
 	defer callbackFuncs.CleanIfErr(&err)
+	callbackFuncs.Add(createErrorLogCallback(&err))
 	go callbackFuncs.CleanOnSignal()
 
 	hwConfig := hypervctl.HardwareConfig{
@@ -63,6 +64,13 @@ func (h HyperVStubber) CreateVM(_ define.CreateVMOpts, mc *vmconfigs.MachineConf
 	// This is to prevent a non-admin user from creating the first machine
 	// which would require adding vsock entries into the Windows Registry.
 	if err := h.canCreate(); err != nil {
+		// If it returns ErrHypervRegistryInitRequiresElevation and we're not already re-executing,
+		// offer to elevate automatically if user is in admin group
+		if err == ErrHypervRegistryInitRequiresElevation && !windows.IsReExecuting() && windows.IsInAdministratorsGroup() {
+			message := "To initialize the first Hyper-V machine, Podman requires admin rights to set up the Windows Registry.\n\n" +
+				windows.UACConfirmationPrompt
+			return launchElevate(message)
+		}
 		return err
 	}
 
@@ -179,6 +187,13 @@ func (h HyperVStubber) Remove(mc *vmconfigs.MachineConfig) ([]string, func() err
 	// This is to prevent a non-admin user from deleting the last machine
 	// which would require removal of vsock entries from the Windows Registry.
 	if err := h.canRemove(mc); err != nil {
+		// If we get ErrHypervRegistryRemoveRequiresElevation and we're not already re-executing,
+		// and the user has admin rights (is in admin group), offer to elevate automatically
+		if err == ErrHypervRegistryRemoveRequiresElevation && !windows.IsReExecuting() && windows.IsInAdministratorsGroup() {
+			message := "Removing this Hyper-V machine requires admin rights to clean up the Windows Registry.\n\n" +
+				windows.UACConfirmationPrompt
+			return nil, nil, launchElevate(message)
+		}
 		return nil, nil, err
 	}
 
@@ -237,6 +252,35 @@ func (h HyperVStubber) canCreate() error {
 	return ErrHypervUserNotInAdminGroup
 }
 
+// launchElevate attempts to automatically re-run the command as administrator
+// This is similar to how WSL handles elevation.
+func launchElevate(message string) error {
+	if windows.MessageBox(message, "Podman Machine", false) != 1 {
+		return errors.New("elevation process cancelled by user. Please rerun the command as administrator")
+	}
+	err := windows.CreateOrTruncateElevatedOutputFile()
+	if err != nil {
+		return err
+	}
+
+	err = windows.RelaunchElevatedWait()
+	if err != nil {
+		windows.DumpOutputFile()
+		return fmt.Errorf("elevated process failed with error: %w", err)
+	}
+	return define.ErrRelaunchAttempt
+}
+
+// createErrorLogCallback creates a callback function that logs errors to file when --reexec is detected
+func createErrorLogCallback(err *error) func() error {
+	return func() error {
+		if *err != nil && windows.IsReExecuting() {
+			windows.LogErrorToFile(*err)
+		}
+		return nil
+	}
+}
+
 func isLegacyMachine(mc *vmconfigs.MachineConfig) bool {
 	return mc.HyperVHypervisor != nil && mc.HyperVHypervisor.ReadyVsock.MachineName != ""
 }
@@ -372,6 +416,7 @@ func (h HyperVStubber) StartVM(mc *vmconfigs.MachineConfig) (func() error, func(
 
 	callbackFuncs := machine.CleanUp()
 	defer callbackFuncs.CleanIfErr(&err)
+	callbackFuncs.Add(createErrorLogCallback(&err))
 	go callbackFuncs.CleanOnSignal()
 
 	if mc.IsFirstBoot() {
@@ -547,6 +592,11 @@ func (h HyperVStubber) PrepareIgnition(mc *vmconfigs.MachineConfig, _ *ignition.
 	readySock, err := vsock.LoadHVSockRegistryEntryByPurpose(vsock.Events)
 	if err != nil {
 		if !windows.HasAdminRights() {
+			if !windows.IsReExecuting() && windows.IsInAdministratorsGroup() {
+				message := "Initializing the first Hyper-V machine requires admin rights to set up the Windows Registry.\n\n" +
+					windows.UACConfirmationPrompt
+				return nil, launchElevate(message)
+			}
 			return nil, ErrHypervRegistryInitRequiresElevation
 		}
 		readySock, err = vsock.NewHVSockRegistryEntry(vsock.Events)

pkg/machine/shim/host.go

@@ -75,7 +75,14 @@ func Init(opts machineDefine.InitOptions, mp vmconfigs.VMProvider) error {
 	)
 
 	callbackFuncs := machine.CleanUp()
-	defer callbackFuncs.CleanIfErr(&err)
+	defer func() {
+		// Do not clean up on relaunch: the elevated child process
+		// completed init successfully and is using the resources
+		// (e.g. the disk image) that cleanup would remove.
+		if !errors.Is(err, machineDefine.ErrRelaunchAttempt) {
+			callbackFuncs.CleanIfErr(&err)
+		}
+	}()
 	go callbackFuncs.CleanOnSignal()
 
 	dirs, err := env.GetMachineDirs(mp.VMType())
@@ -159,17 +166,20 @@ func Init(opts machineDefine.InitOptions, mp vmconfigs.VMProvider) error {
 	}
 	mc.ImagePath = imagePath
 
-	// TODO The following stanzas should be re-written in a differeent place.  It should have a custom
-	// parser for our image pulling.  It would be nice if init just got an error and mydisk back.
-	//
-	// Eventual valid input:
-	// "" <- means take the default
-	// "http|https://path"
-	// "/path
-	// "docker://quay.io/something/someManifest
-
-	if err := diskpull.GetDisk(opts.Image, dirs, mc.ImagePath, mp.VMType(), mc.Name, opts.SkipTlsVerify); err != nil {
-		return err
+	// If the process was re-executed with elevation, the image has already been pulled
+	// in the parent process, so skip disk pulling here.
+	if !opts.ReExec {
+		// TODO The following stanzas should be re-written in a differeent place.  It should have a custom
+		// parser for our image pulling.  It would be nice if init just got an error and mydisk back.
+		//
+		// Eventual valid input:
+		// "" <- means take the default
+		// "http|https://path"
+		// "/path
+		// "docker://quay.io/something/someManifest
+		if err := diskpull.GetDisk(opts.Image, dirs, mc.ImagePath, mp.VMType(), mc.Name, opts.SkipTlsVerify); err != nil {
+			return err
+		}
 	}
 
 	callbackFuncs.Add(mc.ImagePath.Delete)
@@ -460,8 +470,10 @@ func Start(mc *vmconfigs.MachineConfig, mp vmconfigs.VMProvider, opts machine.St
 	if err != nil {
 		return err
 	}
-	mc.Lock()
-	defer mc.Unlock()
+	if !opts.ReExec {
+		mc.Lock()
+		defer mc.Unlock()
+	}
 	if err := mc.Refresh(); err != nil {
 		return fmt.Errorf("reload config: %w", err)
 	}
@@ -732,8 +744,10 @@ func Remove(mc *vmconfigs.MachineConfig, mp vmconfigs.VMProvider, opts machine.R
 	if err != nil {
 		return err
 	}
-	mc.Lock()
-	defer mc.Unlock()
+	if !opts.ReExec {
+		mc.Lock()
+		defer mc.Unlock()
+	}
 	if err := mc.Refresh(); err != nil {
 		return fmt.Errorf("reload config: %w", err)
 	}

pkg/machine/windows/util_windows.go

@@ -5,7 +5,9 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"os/user"
 	"path/filepath"
+	"slices"
 	"strings"
 	"syscall"
 	"unsafe"
@@ -15,6 +17,27 @@ import (
 	"golang.org/x/sys/windows"
 )
 
+const UACConfirmationPrompt = "Since you are not running as admin, a new window will open and " +
+	"require you to approve administrator privileges.\n\n"
+
+// IsInAdministratorsGroup checks if the current user is a member of the Administrators group,
+// regardless of whether the current process is elevated. This can be used to determine
+// if the user can elevate privileges via UAC.
+func IsInAdministratorsGroup() bool {
+	u, err := user.Current()
+	if nil != err {
+		return false
+	}
+	ids, err := u.GroupIds()
+	if nil != err {
+		return false
+	}
+	// S-1-5-32-544 is the SID for the Administrators group
+	// see: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
+	return slices.Contains(ids, "S-1-5-32-544")
+}
+
+// HasAdminRights checks if the current process has administrator privileges.
 func HasAdminRights() bool {
 	var sid *windows.SID
 
@@ -249,3 +272,16 @@ func DumpOutputFile() {
 	defer file.Close()
 	_, _ = io.Copy(os.Stdout, file)
 }
+
+// LogErrorToFile logs an error message to the elevated output log file if --reexec is detected
+func LogErrorToFile(err error) {
+	if err == nil {
+		return
+	}
+	file, fileErr := GetElevatedOutputFileWrite()
+	if fileErr != nil {
+		return
+	}
+	defer file.Close()
+	_, _ = fmt.Fprintf(file, "Error: %v\n", err)
+}

pkg/machine/wsl/machine.go

@@ -316,15 +316,14 @@ func attemptFeatureInstall(reExec, admin bool) error {
 	message := "WSL is not installed on this system, installing it.\n\n"
 
 	if !admin {
-		message += "Since you are not running as admin, a new window will open and " +
-			"require you to approve administrator privileges.\n\n"
+		message += winutil.UACConfirmationPrompt
 	}
 
 	message += "NOTE: A system reboot will be required as part of this process. " +
 		"If you prefer, you may abort now, and perform a manual installation using the \"wsl --install\" command."
 
 	if !reExec && winutil.MessageBox(message, "Podman Machine", false) != 1 {
-		return fmt.Errorf("the WSL installation aborted: %w", define.ErrInitRelaunchAttempt)
+		return fmt.Errorf("the WSL installation aborted: %w", define.ErrRelaunchAttempt)
 	}
 
 	if !reExec && !admin {
@@ -342,16 +341,16 @@ func launchElevate(operation string) error {
 		if eerr, ok := err.(*winutil.ExitCodeError); ok {
 			if eerr.Code == ErrorSuccessRebootRequired {
 				fmt.Println("Reboot is required to continue installation, please reboot at your convenience")
-				return define.ErrInitRelaunchAttempt
+				return define.ErrRelaunchAttempt
 			}
 		}
 
 		fmt.Fprintf(os.Stderr, "Elevated process failed with error: %v\n\n", err)
 		winutil.DumpOutputFile()
 		fmt.Fprintf(os.Stderr, wslInstallError, operation)
-		return fmt.Errorf("%w: %w", err, define.ErrInitRelaunchAttempt)
+		return fmt.Errorf("%w: %w", err, define.ErrRelaunchAttempt)
 	}
-	return define.ErrInitRelaunchAttempt
+	return define.ErrRelaunchAttempt
 }
 
 func installWsl() error {