[RFC 1/1] test-container: block sudo usage on rootless

[RFC 1/1] test-container: block sudo usage on rootless

['Felix Moessbauer' via isar-users]

In rootless mode, no sudo calls must be made. However, the kas-container
ships passwordless sudo which also works in the container. To catch the
cases where sudo is called in rootless mode, we replace it in the
container entrypoint of the test container with a stub that emits a
meaningfull error message along with a non zero exit code.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
A similar approach could be implemented in the gitlab CI executor
as well.

Felix

 testsuite/dockerdata/test-container-entrypoint | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/testsuite/dockerdata/test-container-entrypoint b/testsuite/dockerdata/test-container-entrypoint
index d263760d..ba824760 100755
--- a/testsuite/dockerdata/test-container-entrypoint
+++ b/testsuite/dockerdata/test-container-entrypoint
@@ -65,14 +65,16 @@ case "$args" in
 	;;
 esac
 
+block_sudo=0
 case "$args" in
 	*"-p rootless=1"*)
+		block_sudo=1
 		;;
 	*)
 		clean_rootless_files=0
 		;;
 esac
-export clean_rootless_files
+export clean_rootless_files block_sudo
 
 mkdir /isar
 
@@ -109,6 +111,19 @@ mkdir -p ${base_dir}/overlay/work
 sudo mount -t overlay overlay -o lowerdir=/repo,upperdir=${base_dir}/overlay/upper,workdir=${base_dir}/overlay/work /isar
 sudo mount -o bind ${base_dir} /isar/build
 
+if [ "${block_sudo}" = 1 ]; then
+	blocker=$(mktemp)
+	cat <<EOF > "${blocker}"
+#!/bin/sh
+echo "ERROR: sudo is blocked in rootless test runs: sudo \$*" >&2
+exit 1
+EOF
+	sudo install -m 755 -o root -g root "${blocker}" /usr/bin/sudo.blocked
+	rm -f "${blocker}"
+	# rename, as the running sudo binary cannot be overwritten in place
+	sudo mv -f /usr/bin/sudo.blocked /usr/bin/sudo
+fi
+
 mkdir -p "${HOME}"/.config/avocado
 cat <<EOF > "${HOME}"/.config/avocado/avocado.conf
 [datadir.paths]
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261021134540.331832-1-felix.moessbauer%40siemens.com.

Re: [RFC 1/1] test-container: block sudo usage on rootless

['Clara Kowalsky' via isar-users]

On 10/21/26 15:45, Felix Moessbauer wrote:
> In rootless mode, no sudo calls must be made. However, the kas-container
> ships passwordless sudo which also works in the container. To catch the
> cases where sudo is called in rootless mode, we replace it in the
> container entrypoint of the test container with a stub that emits a
> meaningfull error message along with a non zero exit code.
> 
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
> A similar approach could be implemented in the gitlab CI executor
> as well.
> 
> Felix
> 
>   testsuite/dockerdata/test-container-entrypoint | 17 ++++++++++++++++-
>   1 file changed, 16 insertions(+), 1 deletion(-)
> 
> diff --git a/testsuite/dockerdata/test-container-entrypoint b/testsuite/dockerdata/test-container-entrypoint
> index d263760d..ba824760 100755
> --- a/testsuite/dockerdata/test-container-entrypoint
> +++ b/testsuite/dockerdata/test-container-entrypoint
> @@ -65,14 +65,16 @@ case "$args" in
>   	;;
>   esac
>   
> +block_sudo=0
>   case "$args" in
>   	*"-p rootless=1"*)
> +		block_sudo=1
>   		;;
>   	*)
>   		clean_rootless_files=0
>   		;;
>   esac
> -export clean_rootless_files
> +export clean_rootless_files block_sudo
>   
>   mkdir /isar
>   
> @@ -109,6 +111,19 @@ mkdir -p ${base_dir}/overlay/work
>   sudo mount -t overlay overlay -o lowerdir=/repo,upperdir=${base_dir}/overlay/upper,workdir=${base_dir}/overlay/work /isar
>   sudo mount -o bind ${base_dir} /isar/build
>   
> +if [ "${block_sudo}" = 1 ]; then
> +	blocker=$(mktemp)
> +	cat <<EOF > "${blocker}"
> +#!/bin/sh
> +echo "ERROR: sudo is blocked in rootless test runs: sudo \$*" >&2
> +exit 1
> +EOF
> +	sudo install -m 755 -o root -g root "${blocker}" /usr/bin/sudo.blocked
> +	rm -f "${blocker}"
> +	# rename, as the running sudo binary cannot be overwritten in place
> +	sudo mv -f /usr/bin/sudo.blocked /usr/bin/sudo
> +fi
> +
>   mkdir -p "${HOME}"/.config/avocado
>   cat <<EOF > "${HOME}"/.config/avocado/avocado.conf
>   [datadir.paths]

Tested with the InstallerTest and unpatched rootfs-add-files in rootless 
mode, it works.

Tested-by: Clara Kowalsky <clara.kowalsky@siemens.com>

BR,
Clara

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/01c69bbe-065b-4ab1-b822-8de485330e4e%40siemens.com.

Re: [RFC 1/1] test-container: block sudo usage on rootless

['Moessbauer, Felix' via isar-users]

On Wed, 2026-10-21 at 15:45 +0200, Felix Moessbauer wrote:
> In rootless mode, no sudo calls must be made. However, the kas-container
> ships passwordless sudo which also works in the container. To catch the
> cases where sudo is called in rootless mode, we replace it in the
> container entrypoint of the test container with a stub that emits a
> meaningfull error message along with a non zero exit code.

Hi, 

IMHO this can be merged. If needed, I can re-send as PATCH instead of
RFC. Just let me know.

Felix

> 
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
> A similar approach could be implemented in the gitlab CI executor
> as well.
> 
> Felix
> 
>  testsuite/dockerdata/test-container-entrypoint | 17 ++++++++++++++++-
>  1 file changed, 16 insertions(+), 1 deletion(-)
> 
> diff --git a/testsuite/dockerdata/test-container-entrypoint b/testsuite/dockerdata/test-container-entrypoint
> index d263760d..ba824760 100755
> --- a/testsuite/dockerdata/test-container-entrypoint
> +++ b/testsuite/dockerdata/test-container-entrypoint
> @@ -65,14 +65,16 @@ case "$args" in
>  	;;
>  esac
>  
> +block_sudo=0
>  case "$args" in
>  	*"-p rootless=1"*)
> +		block_sudo=1
>  		;;
>  	*)
>  		clean_rootless_files=0
>  		;;
>  esac
> -export clean_rootless_files
> +export clean_rootless_files block_sudo
>  
>  mkdir /isar
>  
> @@ -109,6 +111,19 @@ mkdir -p ${base_dir}/overlay/work
>  sudo mount -t overlay overlay -o lowerdir=/repo,upperdir=${base_dir}/overlay/upper,workdir=${base_dir}/overlay/work /isar
>  sudo mount -o bind ${base_dir} /isar/build
>  
> +if [ "${block_sudo}" = 1 ]; then
> +	blocker=$(mktemp)
> +	cat <<EOF > "${blocker}"
> +#!/bin/sh
> +echo "ERROR: sudo is blocked in rootless test runs: sudo \$*" >&2
> +exit 1
> +EOF
> +	sudo install -m 755 -o root -g root "${blocker}" /usr/bin/sudo.blocked
> +	rm -f "${blocker}"
> +	# rename, as the running sudo binary cannot be overwritten in place
> +	sudo mv -f /usr/bin/sudo.blocked /usr/bin/sudo
> +fi
> +
>  mkdir -p "${HOME}"/.config/avocado
>  cat <<EOF > "${HOME}"/.config/avocado/avocado.conf
>  [datadir.paths]
> -- 
> 2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/9d5951d1d2a3c41267a5c6700f17397786966f10.camel%40siemens.com.

Re: [RFC 1/1] test-container: block sudo usage on rootless

[Zhihang Wei]

On 11/6/26 10:57, Moessbauer, Felix wrote:
> On Wed, 2026-10-21 at 15:45 +0200, Felix Moessbauer wrote:
>> In rootless mode, no sudo calls must be made. However, the kas-container
>> ships passwordless sudo which also works in the container. To catch the
>> cases where sudo is called in rootless mode, we replace it in the
>> container entrypoint of the test container with a stub that emits a
>> meaningfull error message along with a non zero exit code.
> Hi,
>
> IMHO this can be merged. If needed, I can re-send as PATCH instead of
> RFC. Just let me know.
>
> Felix
>

OK, please send it as a patch. Will test and get back to you,

Zhihang

>> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
>> ---
>> A similar approach could be implemented in the gitlab CI executor
>> as well.
>>
>> Felix
>>
>>   testsuite/dockerdata/test-container-entrypoint | 17 ++++++++++++++++-
>>   1 file changed, 16 insertions(+), 1 deletion(-)
>>
>> diff --git a/testsuite/dockerdata/test-container-entrypoint b/testsuite/dockerdata/test-container-entrypoint
>> index d263760d..ba824760 100755
>> --- a/testsuite/dockerdata/test-container-entrypoint
>> +++ b/testsuite/dockerdata/test-container-entrypoint
>> @@ -65,14 +65,16 @@ case "$args" in
>>   	;;
>>   esac
>>   
>> +block_sudo=0
>>   case "$args" in
>>   	*"-p rootless=1"*)
>> +		block_sudo=1
>>   		;;
>>   	*)
>>   		clean_rootless_files=0
>>   		;;
>>   esac
>> -export clean_rootless_files
>> +export clean_rootless_files block_sudo
>>   
>>   mkdir /isar
>>   
>> @@ -109,6 +111,19 @@ mkdir -p ${base_dir}/overlay/work
>>   sudo mount -t overlay overlay -o lowerdir=/repo,upperdir=${base_dir}/overlay/upper,workdir=${base_dir}/overlay/work /isar
>>   sudo mount -o bind ${base_dir} /isar/build
>>   
>> +if [ "${block_sudo}" = 1 ]; then
>> +	blocker=$(mktemp)
>> +	cat <<EOF > "${blocker}"
>> +#!/bin/sh
>> +echo "ERROR: sudo is blocked in rootless test runs: sudo \$*" >&2
>> +exit 1
>> +EOF
>> +	sudo install -m 755 -o root -g root "${blocker}" /usr/bin/sudo.blocked
>> +	rm -f "${blocker}"
>> +	# rename, as the running sudo binary cannot be overwritten in place
>> +	sudo mv -f /usr/bin/sudo.blocked /usr/bin/sudo
>> +fi
>> +
>>   mkdir -p "${HOME}"/.config/avocado
>>   cat <<EOF > "${HOME}"/.config/avocado/avocado.conf
>>   [datadir.paths]
>> -- 
>> 2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/5ac854b8-95ae-43e4-baab-af961d659760%40ilbers.de.