[RFC 1/1] test-container: block sudo usage on rootless

["'Felix Moessbauer' via isar-users" <isar-users@googlegroups.com>]

In rootless mode, no sudo calls must be made. However, the kas-container
ships passwordless sudo which also works in the container. To catch the
cases where sudo is called in rootless mode, we replace it in the
container entrypoint of the test container with a stub that emits a
meaningfull error message along with a non zero exit code.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
A similar approach could be implemented in the gitlab CI executor
as well.

Felix

 testsuite/dockerdata/test-container-entrypoint | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/testsuite/dockerdata/test-container-entrypoint b/testsuite/dockerdata/test-container-entrypoint
index d263760d..ba824760 100755
--- a/testsuite/dockerdata/test-container-entrypoint
+++ b/testsuite/dockerdata/test-container-entrypoint
@@ -65,14 +65,16 @@ case "$args" in
 	;;
 esac
 
+block_sudo=0
 case "$args" in
 	*"-p rootless=1"*)
+		block_sudo=1
 		;;
 	*)
 		clean_rootless_files=0
 		;;
 esac
-export clean_rootless_files
+export clean_rootless_files block_sudo
 
 mkdir /isar
 
@@ -109,6 +111,19 @@ mkdir -p ${base_dir}/overlay/work
 sudo mount -t overlay overlay -o lowerdir=/repo,upperdir=${base_dir}/overlay/upper,workdir=${base_dir}/overlay/work /isar
 sudo mount -o bind ${base_dir} /isar/build
 
+if [ "${block_sudo}" = 1 ]; then
+	blocker=$(mktemp)
+	cat <<EOF > "${blocker}"
+#!/bin/sh
+echo "ERROR: sudo is blocked in rootless test runs: sudo \$*" >&2
+exit 1
+EOF
+	sudo install -m 755 -o root -g root "${blocker}" /usr/bin/sudo.blocked
+	rm -f "${blocker}"
+	# rename, as the running sudo binary cannot be overwritten in place
+	sudo mv -f /usr/bin/sudo.blocked /usr/bin/sudo
+fi
+
 mkdir -p "${HOME}"/.config/avocado
 cat <<EOF > "${HOME}"/.config/avocado/avocado.conf
 [datadir.paths]
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261021134540.331832-1-felix.moessbauer%40siemens.com.