diff mbox series

[RFC,1/1] test-container: block sudo usage on rootless

Message ID 20261021134540.331832-1-felix.moessbauer@siemens.com
State New
Headers show
Series [RFC,1/1] test-container: block sudo usage on rootless | expand

Commit Message

Felix Moessbauer Oct. 21, 2026, 1:45 p.m. UTC 
In rootless mode, no sudo calls must be made. However, the kas-container
ships passwordless sudo which also works in the container. To catch the
cases where sudo is called in rootless mode, we replace it in the
container entrypoint of the test container with a stub that emits a
meaningfull error message along with a non zero exit code.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
A similar approach could be implemented in the gitlab CI executor
as well.

Felix

 testsuite/dockerdata/test-container-entrypoint | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/testsuite/dockerdata/test-container-entrypoint b/testsuite/dockerdata/test-container-entrypoint
index d263760d..ba824760 100755
--- a/testsuite/dockerdata/test-container-entrypoint
+++ b/testsuite/dockerdata/test-container-entrypoint
@@ -65,14 +65,16 @@  case "$args" in
 	;;
 esac
 
+block_sudo=0
 case "$args" in
 	*"-p rootless=1"*)
+		block_sudo=1
 		;;
 	*)
 		clean_rootless_files=0
 		;;
 esac
-export clean_rootless_files
+export clean_rootless_files block_sudo
 
 mkdir /isar
 
@@ -109,6 +111,19 @@  mkdir -p ${base_dir}/overlay/work
 sudo mount -t overlay overlay -o lowerdir=/repo,upperdir=${base_dir}/overlay/upper,workdir=${base_dir}/overlay/work /isar
 sudo mount -o bind ${base_dir} /isar/build
 
+if [ "${block_sudo}" = 1 ]; then
+	blocker=$(mktemp)
+	cat <<EOF > "${blocker}"
+#!/bin/sh
+echo "ERROR: sudo is blocked in rootless test runs: sudo \$*" >&2
+exit 1
+EOF
+	sudo install -m 755 -o root -g root "${blocker}" /usr/bin/sudo.blocked
+	rm -f "${blocker}"
+	# rename, as the running sudo binary cannot be overwritten in place
+	sudo mv -f /usr/bin/sudo.blocked /usr/bin/sudo
+fi
+
 mkdir -p "${HOME}"/.config/avocado
 cat <<EOF > "${HOME}"/.config/avocado/avocado.conf
 [datadir.paths]