From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Fri, 06 Nov 2026 17:03:43 +0100 X-Sieve: CMU Sieve 2.4 Received: from mail-lf1-f57.google.com (mail-lf1-f57.google.com [209.85.167.57]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 6A6G3fLi012792 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 6 Nov 2026 17:03:42 +0100 Received: by mail-lf1-f57.google.com with SMTP id 2adb3069b0e04-5bfc68400e8sf529046e87.2 for ; Fri, 06 Nov 2026 08:03:42 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1793981016; cv=pass; d=google.com; s=arc-20260327; b=QDJzJWqhjYZ360ITm+6yP2g5G+Fzzh18dm119cGdlYNCwmyVKrnlnZmdYmlyhP+pqN ++fChpNNcydftjkxqNHE1bcASQQ5KKYUceV0It+0bGxBfGa7jX67VBlvlPmxCpp8WeZ/ gH0c+qc3LUmdHngjQVim5x7tI23IcJ/eOsDsnc2pcViIkg7aZGrMsjQ6PJ8Ku++Bzib1 rELzKfnhACv9lSyAmY+sdk6iFaZ9UN3xyo14lhwX2qU2TQfXTXejQaAAULvO5Dj/1M79 NP30mPZ1zrQyGwyao1rXBYp4j4JrJBvXISXOiz3IYf62qBW5CJUcIM3VL9I5i3fpuyUy idLQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :sender:dkim-signature; bh=BxOuGl47qVI22NJtaQHU1jpmlWMH2gmZ3SP0jQFhNzA=; fh=koRGMVWaxRrbBeIwNp/znTdjq37aSrlNXxNAAsWUVxo=; b=TKgqbj4Coe8zPm2a6QlOPeGgkQiYVDTthPFWDGr0w7A5l27DVglXof5zcQT/rbXP2W P0em7hOWLMLDXG1vQmwoy48RWPy+PX0mK9s6o/lKtdcmcySd2y4LGiJByx3RFpJIUnsk W+d1fM10s0zDFNz/stgQHQPa8QG4P4gnVxSm5p1Z+QJjnDdtP2mjQRANvZHJ4zlw07Ka os6w96GC0W7rPMwuj7/sVBW4TsLJZnSCw7DmdL8lDGetNfBd+M0xtSeVsylDicybJePx 1RqAI4aKnsajW+3662agscqikm5uY/UD3FCGa+Fr1uYkbLJvre+0fi8vDqlmeFDGQG5M N9pA==; darn=ilbers.de ARC-Authentication-Results: i=2; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20260707; t=1793981016; x=1794585816; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:content-type:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :sender:from:to:cc:subject:date:message-id:reply-to:content-type; bh=BxOuGl47qVI22NJtaQHU1jpmlWMH2gmZ3SP0jQFhNzA=; b=mDGLD2xen7wywMVVF9/YjGTu/YAjdmcuV4+KpY/qPQJdwaW1HHRCnxjXT40MZ6LoFy Szlatk0cbvJhZ8pqPky34+2c+hllU/RKg1ZVwNMvLTVg4bvCE1hMTxgVSsdOmTDDO4VC Pa/wf4seaumT1nVSobGtmmRGnu8xjhIhi2Oew1YJDvm3ovTePqI3Hf9+jOEMCxEmxk3K 0G+VnEXDahWCuvoHys4aQnjoJyUnBsYp8QvOrYw1jmmd9ALWu4O/WnmVS7vbwWzqbzNg Nvz9O6LRSAtiCtjYe33gGTHVDZHlO8W0B7OxuWyTDNCwdtjXtLU1ljlphOmFJnSzhEiv g0Og== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793981016; x=1794585816; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender:content-type :in-reply-to:from:content-language:references:cc:to:subject :user-agent:mime-version:date:message-id:x-beenthere :x-gm-message-state:sender:from:to:cc:subject:date:message-id :reply-to:content-type; bh=BxOuGl47qVI22NJtaQHU1jpmlWMH2gmZ3SP0jQFhNzA=; b=EicI8lbmpSSHK11EedxWU6I2jFZ3xCiQF/QP8Avhi67VdOU8cdcnf3zHcipAOw6ygs xVKVsZcAAE6ny2F9+euolOB7RS/TEzLwoK0O/JRhxHXtYojyrWE4bfcN5lHVAjnWEJ/f 0Fa5tRANU/Xxbz2lYjolKRMH1AmuzBRrPFXwBPDq1xkx+dpVFcob/IREi1O6IR+RBIcY akQhBRePw2sUUfwzDOMeumjak34wKtNXnv8rONa5xSFpP9vuSV5ofzwrjJ+VsNFZiYNt nYtmQzz+pZZr6PCmwuyZOCdok7lXG2cYmtN4VCQb9QU55iX/ljzCKS3Mqe+Nj6kLFcgP GSiQ== Sender: isar-users@googlegroups.com X-Forwarded-Encrypted: i=2; AKwUvBza+ehWqNZg1Gb7WrU2rT+xIou1jQsSBZ2cgVsl8h5LLtBJ6qRKnwBrZCRKCRKgIuGe2Z3O@ilbers.de X-Gm-Message-State: APuU4Z+TOUS9eRuGkKyvBgURQGBWdrQDCRX2Pl/AnSBPJ8U9z00gx+oZ caI36I++IcKXjHraYOmOIWKXh+mte00Am0SWWtnAzg5DDUwXkVr50Sv7 X-Received: by 2002:ac2:5690:0:b0:5be:50f5:abc2 with SMTP id 2adb3069b0e04-5c003ac3aadmr999215e87.20.1793981016121; Fri, 06 Nov 2026 08:03:36 -0800 (PST) X-BeenThere: isar-users@googlegroups.com; h="ATskLdec8GFEL45qZzz+2we4bebWPpzX4bhLF6mrvzyoct9Qzw==" Received: by 2002:ac2:4f14:0:b0:5bf:f561:4291 with SMTP id 2adb3069b0e04-5c00282c33dls455344e87.0.-pod-prod-09-eu; Fri, 06 Nov 2026 08:03:34 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBwA71POcJN7f3zXDor9sao7GKYzcvXqgomC4hHcfTlAyfRygHNbi6V7aExJCiYlSPJjfBOSBgu7hcRw@googlegroups.com X-Received: by 2002:a05:6512:131c:b0:5bf:c3e2:be3a with SMTP id 2adb3069b0e04-5c003c11366mr918825e87.37.1793981013589; Fri, 06 Nov 2026 08:03:33 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793981013; cv=none; d=google.com; s=arc-20260327; b=XwSkAp5lNBw96LQG7DiRDDjPyv09lOfl0sq6IXD0PrqIgx645bvEjeWmNeE6awgDDV z8tLBf7xrg0NQfdtkG9V3gS/lNScb2t6ho/YuWewvsWFnHe10GVINeToFVcn1ISiEo+h b8fgMUZqkYgRpB547Vu8zX08j4HX+xMnUSS1E/S1BEsaGhRsLRgRTAHF5xIfEotunm7z bBZWdkNIxI781cEM7+QDeDfLFu0gVWteNIfbDBr3sC5BnnOv3ZewS2ydMZNfL8091+g1 7Ss0PFEo1kBwEy+4NgN+3cAb1Us6Ct5EpjnqXllmA5CcN8p97RLQ5r92eXTBebKISkVB CUYg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id; bh=0SpD8RF0H1IY/WcOXB4dzyy7K3sfM0L8rY8kNIhstZk=; fh=whQi/MkmnBu+Oc4HmhrEb0UUJSNzAw8DXW61D7aqE8Q=; b=UgvV3vMvmAlaBxdkt5yT0n2duJTFV3kfZTv8XDkpr53UroHSzAiyfWNVcXkW8HicsM D3CPY4CIg46WJjM9OA9H2UIRa62/xyJMV0LoDg+ICaRLR9SmzUIhyGLNyUffW4d86sXR +se3IrNAeku763ZEbqYNABEtH11I8wp5tgZC89iUReaJOcfAJqPw6ALFP235b9K9dDYC xLAElM2EgKCN3VWiR+paExFS09ePYWgF61UCJ8IUPPZLJBNk0xQVbl3H8INTTuwk4p72 kdEg/5WX6tetUx+r1onGuec7bCkNfBScsVfiTUljwoYiNOWEnsnrPSc+YuP/G++unwJF komA==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Received: from shymkent.ilbers.de (shymkent.ilbers.de. [85.214.156.166]) by gmr-mx.google.com with ESMTPS id 2adb3069b0e04-5c00a5a637csi542e87.13.2026.11.06.08.03.33 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Nov 2026 08:03:33 -0800 (PST) Received-SPF: pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) client-ip=85.214.156.166; Received: from [192.168.178.24] (dslb-188-101-247-215.188.101.pools.vodafone-ip.de [188.101.247.215]) (authenticated bits=0) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPSA id 6A6G1VZP012693 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 6 Nov 2026 17:01:32 +0100 Message-ID: <5ac854b8-95ae-43e4-baab-af961d659760@ilbers.de> Date: Fri, 6 Nov 2026 17:01:31 +0100 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [RFC 1/1] test-container: block sudo usage on rootless To: "Moessbauer, Felix" Cc: "Kowalsky, Clara" , "isar-users@googlegroups.com" References: <20261021134540.331832-1-felix.moessbauer@siemens.com> <9d5951d1d2a3c41267a5c6700f17397786966f10.camel@siemens.com> Content-Language: en-US From: Zhihang Wei In-Reply-To: <9d5951d1d2a3c41267a5c6700f17397786966f10.camel@siemens.com> Content-Type: text/plain; charset="UTF-8"; format=flowed X-Spam-Status: No, score=-4.6 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-Original-Sender: wzh@ilbers.de X-Original-Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-TUID: WJdn0StV+KKr On 11/6/26 10:57, Moessbauer, Felix wrote: > On Wed, 2026-10-21 at 15:45 +0200, Felix Moessbauer wrote: >> In rootless mode, no sudo calls must be made. However, the kas-container >> ships passwordless sudo which also works in the container. To catch the >> cases where sudo is called in rootless mode, we replace it in the >> container entrypoint of the test container with a stub that emits a >> meaningfull error message along with a non zero exit code. > Hi, > > IMHO this can be merged. If needed, I can re-send as PATCH instead of > RFC. Just let me know. > > Felix > OK, please send it as a patch. Will test and get back to you, Zhihang >> Signed-off-by: Felix Moessbauer >> --- >> A similar approach could be implemented in the gitlab CI executor >> as well. >> >> Felix >> >> testsuite/dockerdata/test-container-entrypoint | 17 ++++++++++++++++- >> 1 file changed, 16 insertions(+), 1 deletion(-) >> >> diff --git a/testsuite/dockerdata/test-container-entrypoint b/testsuite/dockerdata/test-container-entrypoint >> index d263760d..ba824760 100755 >> --- a/testsuite/dockerdata/test-container-entrypoint >> +++ b/testsuite/dockerdata/test-container-entrypoint >> @@ -65,14 +65,16 @@ case "$args" in >> ;; >> esac >> >> +block_sudo=0 >> case "$args" in >> *"-p rootless=1"*) >> + block_sudo=1 >> ;; >> *) >> clean_rootless_files=0 >> ;; >> esac >> -export clean_rootless_files >> +export clean_rootless_files block_sudo >> >> mkdir /isar >> >> @@ -109,6 +111,19 @@ mkdir -p ${base_dir}/overlay/work >> sudo mount -t overlay overlay -o lowerdir=/repo,upperdir=${base_dir}/overlay/upper,workdir=${base_dir}/overlay/work /isar >> sudo mount -o bind ${base_dir} /isar/build >> >> +if [ "${block_sudo}" = 1 ]; then >> + blocker=$(mktemp) >> + cat < "${blocker}" >> +#!/bin/sh >> +echo "ERROR: sudo is blocked in rootless test runs: sudo \$*" >&2 >> +exit 1 >> +EOF >> + sudo install -m 755 -o root -g root "${blocker}" /usr/bin/sudo.blocked >> + rm -f "${blocker}" >> + # rename, as the running sudo binary cannot be overwritten in place >> + sudo mv -f /usr/bin/sudo.blocked /usr/bin/sudo >> +fi >> + >> mkdir -p "${HOME}"/.config/avocado >> cat < "${HOME}"/.config/avocado/avocado.conf >> [datadir.paths] >> -- >> 2.55.0 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/5ac854b8-95ae-43e4-baab-af961d659760%40ilbers.de.