Re: [RFC 1/1] test-container: block sudo usage on rootless

[Zhihang Wei <wzh@ilbers.de>]

On 11/6/26 10:57, Moessbauer, Felix wrote:
> On Wed, 2026-10-21 at 15:45 +0200, Felix Moessbauer wrote:
>> In rootless mode, no sudo calls must be made. However, the kas-container
>> ships passwordless sudo which also works in the container. To catch the
>> cases where sudo is called in rootless mode, we replace it in the
>> container entrypoint of the test container with a stub that emits a
>> meaningfull error message along with a non zero exit code.
> Hi,
>
> IMHO this can be merged. If needed, I can re-send as PATCH instead of
> RFC. Just let me know.
>
> Felix
>

OK, please send it as a patch. Will test and get back to you,

Zhihang

>> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
>> ---
>> A similar approach could be implemented in the gitlab CI executor
>> as well.
>>
>> Felix
>>
>>   testsuite/dockerdata/test-container-entrypoint | 17 ++++++++++++++++-
>>   1 file changed, 16 insertions(+), 1 deletion(-)
>>
>> diff --git a/testsuite/dockerdata/test-container-entrypoint b/testsuite/dockerdata/test-container-entrypoint
>> index d263760d..ba824760 100755
>> --- a/testsuite/dockerdata/test-container-entrypoint
>> +++ b/testsuite/dockerdata/test-container-entrypoint
>> @@ -65,14 +65,16 @@ case "$args" in
>>   	;;
>>   esac
>>   
>> +block_sudo=0
>>   case "$args" in
>>   	*"-p rootless=1"*)
>> +		block_sudo=1
>>   		;;
>>   	*)
>>   		clean_rootless_files=0
>>   		;;
>>   esac
>> -export clean_rootless_files
>> +export clean_rootless_files block_sudo
>>   
>>   mkdir /isar
>>   
>> @@ -109,6 +111,19 @@ mkdir -p ${base_dir}/overlay/work
>>   sudo mount -t overlay overlay -o lowerdir=/repo,upperdir=${base_dir}/overlay/upper,workdir=${base_dir}/overlay/work /isar
>>   sudo mount -o bind ${base_dir} /isar/build
>>   
>> +if [ "${block_sudo}" = 1 ]; then
>> +	blocker=$(mktemp)
>> +	cat <<EOF > "${blocker}"
>> +#!/bin/sh
>> +echo "ERROR: sudo is blocked in rootless test runs: sudo \$*" >&2
>> +exit 1
>> +EOF
>> +	sudo install -m 755 -o root -g root "${blocker}" /usr/bin/sudo.blocked
>> +	rm -f "${blocker}"
>> +	# rename, as the running sudo binary cannot be overwritten in place
>> +	sudo mv -f /usr/bin/sudo.blocked /usr/bin/sudo
>> +fi
>> +
>>   mkdir -p "${HOME}"/.config/avocado
>>   cat <<EOF > "${HOME}"/.config/avocado/avocado.conf
>>   [datadir.paths]
>> -- 
>> 2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/5ac854b8-95ae-43e4-baab-af961d659760%40ilbers.de.