From 0e2cdf815468e910749c02064249fe921d67619e Mon Sep 17 00:00:00 2001 From: Evan Lezar Date: Thu, 26 Mar 2026 10:14:04 +0100 Subject: [PATCH] fix(sandbox): split drop_privileges test to unblock non-root CI The drop_privileges_succeeds_for_current_user test failed on non-root systems because initgroups(3) requires CAP_SETGID even when switching to the current user. Add a new drop_privileges_succeeds_for_current_group test that omits run_as_user, bypassing initgroups while still exercising setgid() and the GID post-condition verification. Mark the original full-path test with #[ignore] so it can be run explicitly as root. Fixes #622 --- crates/openshell-sandbox/src/process.rs | 27 ++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/crates/openshell-sandbox/src/process.rs b/crates/openshell-sandbox/src/process.rs index b93d125a..e436fcc3 100644 --- a/crates/openshell-sandbox/src/process.rs +++ b/crates/openshell-sandbox/src/process.rs @@ -559,10 +559,31 @@ mod tests { } #[test] + fn drop_privileges_succeeds_for_current_group() { + // Set only run_as_group (no run_as_user) so that initgroups() is not + // called. initgroups(3) requires CAP_SETGID/root even when the target + // is the current user, so it cannot be exercised without elevated + // privileges. This test covers the setgid() + GID post-condition + // verification path without needing root. + let current_group = Group::from_gid(nix::unistd::getegid()) + .expect("getgrgid") + .expect("current group entry"); + + let policy = policy_with_process(ProcessPolicy { + run_as_user: None, + run_as_group: Some(current_group.name), + }); + + assert!(drop_privileges(&policy).is_ok()); + } + + #[test] + #[ignore = "initgroups(3) requires CAP_SETGID; run as root: sudo cargo test -- --ignored"] fn drop_privileges_succeeds_for_current_user() { - // Resolve the current user's name so we can ask drop_privileges to - // "switch" to the user we're already running as. This exercises the - // full verification path (getegid/geteuid checks) without needing root. + // Exercises the full privilege-drop path including initgroups(), + // setgid(), setuid(), and the root-reacquisition check. Requires + // CAP_SETGID (root) because initgroups(3) calls setgroups(2) + // internally. Fixes: https://github.com/NVIDIA/OpenShell/issues/622 let current_user = User::from_uid(nix::unistd::geteuid()) .expect("getpwuid") .expect("current user entry");