Tolerate non-running containers in paused cp

Signed-off-by: Matthew Heon <matthew.heon@pm.me>

cmd/podman/cp.go

@@ -97,13 +97,22 @@ func copyBetweenHostAndContainer(runtime *libpod.Runtime, src string, dest strin
 
 	if pause {
 		if err := ctr.Pause(); err != nil {
-			return err
+			// An invalid state error is fine.
-		}
+			// The container isn't running or is already paused.
-		defer func() {
+			// TODO: We can potentially start the container while
-			if err := ctr.Unpause(); err != nil {
+			// the copy is running, which still allows a race where
-				logrus.Errorf("Error unpausing container after copying: %v", err)
+			// malicious code could mess with the symlink.
+			if errors.Cause(err) != libpod.ErrCtrStateInvalid {
+				return err
 			}
-		}()
+		} else if err == nil {
+			// Only add the defer if we actually paused
+			defer func() {
+				if err := ctr.Unpause(); err != nil {
+					logrus.Errorf("Error unpausing container after copying: %v", err)
+				}
+			}()
+		}
 	}
 
 	user, err := getUser(mountPoint, ctr.User())