Skip to content

ci: Run tests as unprivileged user

Patrick Steinhardt requested to merge pks-ci-run-tests-unprivileged into master

The CI tests are currently running as "root" user. It goes without saying that this user has special privileges that other users are lacking, and that in turn means that a test run as root may not reflect what would happen when it were run as a normal user. Most importantly, root users have the CAP_DAC_OVERRIDE capability, which allows them to ovverride permission bits of files and directories. This means that they can open a directory that's lacking the executable-bit, read a file that's missing its readable-bit or write a file that's missing its writeable-bit. And sure enough, we have such a test where we rely on this behaviour.

Let's improve the situation by running tests as unprivileged user. This both ensures that we never write data into the source directory (all data should be written into temporary directories, only), and that we do not have any capabilities which override the basic workings of a Unix system.

Edited by Patrick Steinhardt

Merge request reports