From patchwork Wed Oct 21 13:45:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Felix Moessbauer X-Patchwork-Id: 5556 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Wed, 21 Oct 2026 15:46:15 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-pl1-f186.google.com (mail-pl1-f186.google.com [209.85.214.186]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 69LDkDgW014860 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 21 Oct 2026 15:46:14 +0200 Received: by mail-pl1-f186.google.com with SMTP id d9443c01a7336-2df375fb9b2sf7231095ad.2 for ; Wed, 21 Oct 2026 06:46:14 -0700 (PDT) ARC-Seal: i=3; a=rsa-sha256; t=1792590368; cv=pass; d=google.com; s=arc-20260327; b=PbzxlovPDD08FFLb3lMmmRWKL62u1Km1w82/yOSqpFWXsLKA0Sqfj+swFthK+u7Utb cu91W0wmoikcf6suubzK/N6vZiXi2hyyktAnFLkrwFv8+s090hqd8AoDpbrnKH//ERqi wL5A+6qOmBxxc0kv0TBLAkTvnDSDdYMMnrAplpSq2vYAtJ+9BffOD2dqOCKE4AlcHNke aDjpngAyieRmYvI2Dr2gSwJIqxraGC3lSN53ftpPaIWUCtBrWz+RxOJf8SJXWib69a40 J8Z/45zGzRKGeoUS8fOX8SjuxjCztCZVHDPPmUQ59k1ZrZKrddZpa5eWSunHkaWDZ2Jd u8og== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:message-id :date:subject:cc:to:from:dkim-signature; bh=chvK/tRzSzuxl0/fP2SYH5H+FFnhhpZqdynvoxPVugA=; fh=4S2shtTaxGYOfG/r/Zksiq7R85MyMnz2gY/ZYQh6vcU=; b=S/uUsO4NpA6q905Mdl4W1QrFmW6vqKN/ww592l/EL1JKwfdU4708GBiPogYfHOevML QhpUKaKqeO1Yj7DDqFuMIqiaYO1tkD8Jr3LmYGXX0bs0zORIccvSbFIg5t2qHtyrfRXR 8kumegkWJputlaFZoDihGND3QN9DTj1WHuQ+5tbEjkHQCLzrOHBfL/64kAUf7Qpmsnwm 1G7re5djdkwZ2IU0iL9NeVR0Mm3Jqwyt4J/KU9r5EiYlGjdv/RoJ7EWjhZoyu2HbPn47 aFWHhas6bng8m79oDcKxVCYxdPLrcmmeZX8E92TpoHzt3yhGHngcXITBx35/fRj+tyg6 3wpw==; darn=isar-build.org ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=r5VP6vLy; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1792590368; x=1793195168; darn=isar-build.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=chvK/tRzSzuxl0/fP2SYH5H+FFnhhpZqdynvoxPVugA=; b=xlVYDohn42SXJGJzZMXbBfffPdvouLZNmbZn2SkEgFersbwNo6pzGU6TwJ/kqnGetA D931Lc/CAgE4S3EnEk1rbH6kw05EDkh9OY3vuHNR8hoRNLQ4f/aAHXQXgW8g0Ru6lhlI JW5z1HNm0SfVChsiB8Gbzo+64YMgE9IPO+BfaluiDwgLE3V0F+8oJMqUoeIpU5u1dxdf 7wT31IOCNt5Ro8oUbK1ewrzYekDE8Iv7cU6Y1IvjEz8WSEmp3SKRHrvlQqlXV0DpfCWj x6RqZSKdn+Zz2Nv4pFEQDfz/HF6e06jpZwTwelmEGAAp69Ft0S/r9GOuA9/9ZsnO+UJU CCFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792590368; x=1793195168; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:message-id:date:subject:cc:to:from:x-beenthere :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=chvK/tRzSzuxl0/fP2SYH5H+FFnhhpZqdynvoxPVugA=; b=Mna7lhf1QUf7f+eTuWKgWhbzkWOUExE8Fmzyy8Hw5PP5ph0xv4f3YSaShSE0BS0zov aBCmDS1XSU4m5u6kvBmPozjKpjFcFokuZES21X5zhRuvJmJzV3FmPo2CI2EfVYGMBBbe hfdDovdfwX2qAzCBBk/fKaOoqcqqaqAgcpFxnJRK+kp4B5UjmxvqjXzWMKA0AZKN9SkE W5OTmHGenVOkgjOCb+3SshnvElSmrf663cTfSTVDhEE/com0blI81aGFpNYiu3Aqmt/c t7y/RVON8S3pCTei2p8M9DqER1hGUPgQNmNO15M6nbrnEX2TXsFZ6up6VHULczz23oTY cHQw== X-Forwarded-Encrypted: i=3; AKwUvBwPmE/a0hXR9jwudXhz6u43tfsx963zF3uKtfHe2/t20LpGB7Z1CGwbrTCh6Ph3YSz66jGrlc4=@isar-build.org X-Gm-Message-State: AFq9FYL2+KxjWdNYH8ZmwYdEYchM5CoB1POUuI3B4GABLJMzsUUT+0QL ubKt2yrtm4emHni7w2ro5NFY0LeF21pVQRBurlC9aDHqB9lbvDyNobfT X-Received: by 2002:a17:902:c951:b0:2e2:ffcb:87a9 with SMTP id d9443c01a7336-2ea43e4ed82mr15365365ad.24.1792590367431; Wed, 21 Oct 2026 06:46:07 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLdflYlx4bFrSKS+BkXB+RVKyDX9q60CHmU0RvQRzS/AUrg==" Received: by 2002:a17:903:1a85:b0:2e8:2ac4:56f0 with SMTP id d9443c01a7336-2ea3bbe30bfls14290475ad.1.-pod-prod-02-us; Wed, 21 Oct 2026 06:46:06 -0700 (PDT) X-Received: by 2002:a05:6a20:431c:b0:3de:5a00:e248 with SMTP id adf61e73a8af0-3e287f471b2mr1439104637.76.1792590365827; Wed, 21 Oct 2026 06:46:05 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1792590365; cv=pass; d=google.com; s=arc-20260327; b=dNDrzz6uLg+Y6bssejatQhCDgLtuArUf9D+An5Wi/qFg9n5KRO9EUippzUJXqRCWuT 4h6R1rhowu7bYfA6e9qXCtUzz2VZFnJktFc1hl07D+loj4Som4RHagbQazHrjqRNxhFn GNqN8FeDtJ5pO6+IcoyrWrlnZwqmQ7axleYjE5zTJ+D6A2sD3/tj1+tKyHlq/erVt1gv 3rUSHTC2RKX5c+i07pCSWB9dIznDRrDo8MWLNRh9Cf70J5NRHN5yQeBw15AtBCJFdsmv PgdDn4SVRBjLGS78znTSvbN7NDdVf8KLsvUMxI1hMRDH0I+18gEoUL3FcX7UW8eyufWY +6KA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:message-id:date:subject:cc :to:from:dkim-signature; bh=dk8CJLzGjlz7m/m431BJQ7y6pofX66J6zWf4sy/MCXc=; fh=6+bCjj6jzibbKRpyyYepFBsRZzL3ccbQ5hqSvj0947A=; b=YsjEl+UbyVZzF8PmxYcYJnaulgNYDFSPuMB4xT05s7GO4Y8lu1Flzvxza3FqHpi1pn ivUJquKXQfttRPEOOcZUpHgcSO8Hw9opUNn5Y6hRbTJ/AbNw9AU0nufLGnNfQiNXMyLq YQ2gZeUB52b1ScBCitLIvT23jK39itwqSgbq/q2+/FvmTo5BrOsHVg/QwqxrOYZyWHE4 VyAgGi9d7QwUk4pXjlV7HUIBieX5AcpqgrG5RSZH95sFu6d0N9W55JP0d7gIqIjF8kbv NwodoMEC9Oyl10hOTnaTvx+0TSuNWOSQHlk4FkXwC2pNQcYH0lygCUvPhCQf9jPMtN/Q M8lg==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=r5VP6vLy; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazlp170110003.outbound.protection.outlook.com. [2a01:111:f403:c200::3]) by gmr-mx.google.com with ESMTPS id d2e1a72fcca58-8a0895c296bsi45638b3a.4.2026.10.21.06.46.05 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 21 Oct 2026 06:46:05 -0700 (PDT) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::3 as permitted sender) client-ip=2a01:111:f403:c200::3; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=mfh65efNKDSmDdZjNCRnsbhcIWBbmPaK/C4bThQz2DUXDoJ2X3Qyw3kb37qiW7RhLq9zVCznjBwhztlGwvigIgK/xmnXWiO3zM4mDm+VKCD+s+K1ZdThrfa+4t3gUjhR4tf08YE+4cOAkrpsRGHYjlXwzwbHUCIJmcpUk6DCV/1zcldnx9jhC6UxP02okkHipBmgi/iXPhfAM1D0ZVGBrUuFJ+Nn6sPOTVjY7plTbV5ZvK3W0gwJ6uvKwmxhND2lpv2lYtpwd8gZq0hBijyPEjDpu7+ReRCNr5NXenrTN4tRUU9WrWCXcQgGCzhSdalYt0Q+g79d9lAq8/UmbLsDqg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=dk8CJLzGjlz7m/m431BJQ7y6pofX66J6zWf4sy/MCXc=; b=b9Tq3oTiruoRbWKEpUQSy1RW02rKwBulrI6f8fArVkN+2B/kUer+hUhRkA5hcookw/ZvtugnOjRHSN9/6vexuOiMiLr3ZMczEsAawUPthphQlf/KEFp9IwZiP13iaPHQ25WDAPItpo4jMdIt+gZAPXaMBg84A6j/XKW7n+932mG8pfJmOwOSp794lqwgmQbg/dE7pehEOZ/nLddlAcCMXUGKzSX+7qBZsFcJJPO6siLU8SRPZsWtMhPDwUmd8uxYjURWQ6kCqrpuCavyW70dymwoUSsA/p4C/e9RBxKItv1sOqmcrzjmNkomBiar0kzCRSanxSWYirZi4XUW22cu9Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:17e::10) by PAWPR10MB7771.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:363::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15; Wed, 21 Oct 2026 13:46:02 +0000 Received: from AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM ([fe80::c54c:ccd8:ebbf:477c]) by AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM ([fe80::c54c:ccd8:ebbf:477c%3]) with mapi id 15.21.0522.017; Wed, 21 Oct 2026 13:46:01 +0000 X-Patchwork-Original-From: "'Felix Moessbauer' via isar-users" From: Felix Moessbauer To: isar-users@googlegroups.com Cc: clara.kowalsky@siemens.com, Felix Moessbauer Subject: [RFC 1/1] test-container: block sudo usage on rootless Date: Wed, 21 Oct 2026 15:45:40 +0200 Message-ID: <20261021134540.331832-1-felix.moessbauer@siemens.com> X-Mailer: git-send-email 2.55.0 X-ClientProxiedBy: FR4P281CA0065.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:ce::8) To AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:17e::10) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM7PR10MB3956:EE_|PAWPR10MB7771:EE_ X-MS-Office365-Filtering-Correlation-Id: fb78b078-5654-40a5-d164-08df2f79a518 X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|1800799024|23010399003|261009223027099003|10067099003|56012099006|6133799003|55112099003|18002099003|11063799006; X-Microsoft-Antispam-Message-Info: y9mt0RRGMM6rIsWXAAOQ/Q0s1aSYLVEFLeA55cOKhUUQ9/kgFN2OojyqhK0eh1B4WyvyZI/0R/TnjWHGso+l8PDQdLRVb8n/aDidYAx95DtZYjwnWd9UY0F6J74nqAAufMj2xf6gGU7wAE+74dNkmt7PZ5+iFcQJSzYWndjAWyy9iyNd/9rM2fMAFWn1IpOAVqmha0iJp0UDWPAAvpCtJ61UQMXc2HQnz6AtE2w0HJfskzGxXgRQN/XDhd7OmhKre6JmRYYf8OP3dkYkPHxQ/dXXmkFcDNz8lAoRHZ3kfiB7+bOAaBOzXx1pwydPhKPfXtuvey25iPZOr+YfML7x/Qk5wo1SF8uNlvyjJL1FHdBJl3X/ogokhVFHm6qq+oCyGSZeQXoLBOWZsM+oOhyJg4/RFKlhY8fel5fVNfbSVmU4KxdZilrJdCWXALt5DqP8VauRVCTL/sKt9rJhVNcw3B7ZZU0AicGcUnf0iSCXSxrEjqg5smWp1IcODkp5W2yR217ZmEKhMOHGMOiOGMAYNtET/6f9O6caUPj5703ltNpIJ5Shaa0+ZqlXeeDqMjvLxAETlGD7iDQomlMdxogeyl+b5Cg6S6r3xixy+XCpbhRwcbEYTR6gN/OBd+dEyuF/QciM7BhKHHhEyzvsm2rU/JDlMhS/VKDwWP3hmoWZEK0= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(23010399003)(261009223027099003)(10067099003)(56012099006)(6133799003)(55112099003)(18002099003)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: OYjzQ9yYLsjFyJ0hmfJ7leiEbuaMtN2PpPVVpd38RmfN9ry5O3+dBoZHKi+zZcJUMmV+2I8m8MgcFMOF+1WvHunM1TA7xM8LGprwaGCatbOkZ3Ofk6vEQp4PJECVEs3OSlU22z21Iic/YmxIlnOh7CH9iL7qNiJpLiYeCYnpGbic24ZmURFfbpv+rML9r38wwf4s2fcM8nVMk4v5ZcluATXstYO8TCZfw1tQrqM7zIVHtX0PLcasvL+ssBctXxfO/v+173/9sO8HCaodFUagP8t63K0CAnnmGkWhkpDCUp6jCMygVjTy8H30Il7a7Hs9Os/OCenuKs3QI4UsollVNN2ZxUOw/JgaPTK9+0QANpuxbiOk9rK0R929pQyqbBOswB3qWH3uyKbB0ZeW+H1e/vbXRKbGJjLIaeCDPvuwrhkdQl2bJgNFKUY0iGSNGytgu9DCdsK33PZb1o/LZrE/p6KTbajh1OyARHMF8q+jpnm8aisHLNNKPcImV7J6fBvXxKsHlbBTD961Nu087yKfXyoeoA5OciqdmA6A4sSaYvEpk8p4Rdqr/gDB/zEU9Iy7oGkpot6YuWzesCWUi37R8jlI/kyg1BzOfq6s++ulet+QxYFnepnVX2ynClTOXUaoguWm5n+SWItGdP90t3ihlytVY6xPqwKT77JK4DD3q4SvWAUeFqf0ZbME0RPXa+3wMdyWZfKhKbW0uie79iEUKGJEsrj+JA10iJ3GNgvmKCgDv08mbnbgWIWjR0gjYVDG8bjfmWSCLkJkdYibWSoijLX4qA0owLp1Oy/6wFznyiOO927b4tU1kU+iYIcd/P4cnKs8sfFWpslaFjRCQ/vdbeLJeNVYLuipKMhi3I6ruevsN2X7386ELDAFa0rabCSI0aZ2xkqFsV2l6NWzo5ufZpITe08rYLWMPlX1R3Bve+jeeeT6oMRAU7RTfVXHw+e7iCCdGwYGVzWziPoBl6qV+YQNbA0KqGWYVMDDo88YKRX9/K8N29m7VGpr/aNYANqTJ5p1yAX6W6nHMZvT0snVIt27tnMohdQjGpyMqWUutSRFcpUcRNFMx7LbhTNt13r/vv2Rs5ZDvifeKSvJnFE0G0vtdoAc3/NIiRAe6pxD2foA82Wf57uNN95qf5Q/Pg1J2pNHH3yXA1rsq3ILAM9MS2zs79OUNtx9gYqLPNKqf4WSCmU4gyQ1BefGxZED7o/uAxp6mTTfo2cx3CvPrdwrxERJPs/lHI1kScte6dP5nBJbZKuwid5yGC1T3m7dKhRY8M5Kswfq5S3u6Bbb8BkTNfapik2dXRc82OZCDgFdYpWEUDbuA8n6vPTkS+cCNnTZiES0PkD54rpm1mE3LfaJX84uluGvl6hfUvWtLwA24YjMDjvAsS9q4wnnhcOi/w8cYxes9dbpcuaLxr+FP7aP98TqGtnDyzH0uXbH5cS4wswaL+nCRJ27xB/wR+VkSS3r5Wuy65a8pEB2TZ6MCwLPa7C60avNqRtsOBClwaqnh5aVn5qoXCZeY9ZuIujG58YBkh3WRl6Ar2PiOZr6G5JzLLn6mVsKY+SePy+mNMh5xY6tawysms41NkmFMwBpUpGLw0wCy0BNmZKYhX85VxlwfsymjB04uQt6/MiKcB3pnpIA9VpQMk0Wq6NyKhPKpo5WM1JcndrEog3kx/ERTa/0wtC0gSqVDSuQWLAFSi4DENuC9BDIILK3Qc4of1bB8Ckfp/5cfL6jsHYB9SarDjoVi7dh9upzrFzUCzQdO08jReU= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: fb78b078-5654-40a5-d164-08df2f79a518 X-MS-Exchange-CrossTenant-AuthSource: AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Oct 2026 13:46:01.8714 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: gbT5B4Sr/AWBspYBQE5CaCflQOHrjjN9tfjWikmPXcSp+o0bJUfGsPCs6H3kHX6EW65RvjjsAeAGkhmJNbxNy3h+CUbxEyPZYzOie5TNqnY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAWPR10MB7771 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=r5VP6vLy; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Felix Moessbauer Reply-To: Felix Moessbauer Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= In rootless mode, no sudo calls must be made. However, the kas-container ships passwordless sudo which also works in the container. To catch the cases where sudo is called in rootless mode, we replace it in the container entrypoint of the test container with a stub that emits a meaningfull error message along with a non zero exit code. Signed-off-by: Felix Moessbauer --- A similar approach could be implemented in the gitlab CI executor as well. Felix testsuite/dockerdata/test-container-entrypoint | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/testsuite/dockerdata/test-container-entrypoint b/testsuite/dockerdata/test-container-entrypoint index d263760d..ba824760 100755 --- a/testsuite/dockerdata/test-container-entrypoint +++ b/testsuite/dockerdata/test-container-entrypoint @@ -65,14 +65,16 @@ case "$args" in ;; esac +block_sudo=0 case "$args" in *"-p rootless=1"*) + block_sudo=1 ;; *) clean_rootless_files=0 ;; esac -export clean_rootless_files +export clean_rootless_files block_sudo mkdir /isar @@ -109,6 +111,19 @@ mkdir -p ${base_dir}/overlay/work sudo mount -t overlay overlay -o lowerdir=/repo,upperdir=${base_dir}/overlay/upper,workdir=${base_dir}/overlay/work /isar sudo mount -o bind ${base_dir} /isar/build +if [ "${block_sudo}" = 1 ]; then + blocker=$(mktemp) + cat < "${blocker}" +#!/bin/sh +echo "ERROR: sudo is blocked in rootless test runs: sudo \$*" >&2 +exit 1 +EOF + sudo install -m 755 -o root -g root "${blocker}" /usr/bin/sudo.blocked + rm -f "${blocker}" + # rename, as the running sudo binary cannot be overwritten in place + sudo mv -f /usr/bin/sudo.blocked /usr/bin/sudo +fi + mkdir -p "${HOME}"/.config/avocado cat < "${HOME}"/.config/avocado/avocado.conf [datadir.paths]