Re: [RFC 1/1] test-container: block sudo usage on rootless

["'Clara Kowalsky' via isar-users" <isar-users@googlegroups.com>]

On 10/21/26 15:45, Felix Moessbauer wrote:
> In rootless mode, no sudo calls must be made. However, the kas-container
> ships passwordless sudo which also works in the container. To catch the
> cases where sudo is called in rootless mode, we replace it in the
> container entrypoint of the test container with a stub that emits a
> meaningfull error message along with a non zero exit code.
> 
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
> A similar approach could be implemented in the gitlab CI executor
> as well.
> 
> Felix
> 
>   testsuite/dockerdata/test-container-entrypoint | 17 ++++++++++++++++-
>   1 file changed, 16 insertions(+), 1 deletion(-)
> 
> diff --git a/testsuite/dockerdata/test-container-entrypoint b/testsuite/dockerdata/test-container-entrypoint
> index d263760d..ba824760 100755
> --- a/testsuite/dockerdata/test-container-entrypoint
> +++ b/testsuite/dockerdata/test-container-entrypoint
> @@ -65,14 +65,16 @@ case "$args" in
>   	;;
>   esac
>   
> +block_sudo=0
>   case "$args" in
>   	*"-p rootless=1"*)
> +		block_sudo=1
>   		;;
>   	*)
>   		clean_rootless_files=0
>   		;;
>   esac
> -export clean_rootless_files
> +export clean_rootless_files block_sudo
>   
>   mkdir /isar
>   
> @@ -109,6 +111,19 @@ mkdir -p ${base_dir}/overlay/work
>   sudo mount -t overlay overlay -o lowerdir=/repo,upperdir=${base_dir}/overlay/upper,workdir=${base_dir}/overlay/work /isar
>   sudo mount -o bind ${base_dir} /isar/build
>   
> +if [ "${block_sudo}" = 1 ]; then
> +	blocker=$(mktemp)
> +	cat <<EOF > "${blocker}"
> +#!/bin/sh
> +echo "ERROR: sudo is blocked in rootless test runs: sudo \$*" >&2
> +exit 1
> +EOF
> +	sudo install -m 755 -o root -g root "${blocker}" /usr/bin/sudo.blocked
> +	rm -f "${blocker}"
> +	# rename, as the running sudo binary cannot be overwritten in place
> +	sudo mv -f /usr/bin/sudo.blocked /usr/bin/sudo
> +fi
> +
>   mkdir -p "${HOME}"/.config/avocado
>   cat <<EOF > "${HOME}"/.config/avocado/avocado.conf
>   [datadir.paths]

Tested with the InstallerTest and unpatched rootfs-add-files in rootless 
mode, it works.

Tested-by: Clara Kowalsky <clara.kowalsky@siemens.com>

BR,
Clara

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/01c69bbe-065b-4ab1-b822-8de485330e4e%40siemens.com.