dropping privileges during test suite execution

[Kamil Paral]

InvokingTestsAnsible
<https://fedoraproject.org/wiki/Changes/InvokingTestsAnsible> says:

The playbook and its test suite or test framework:
    SHOULD drop privileges appropriately if the test suite should be run as
non-root.


I'm not clear how you do that. The test suite should not assume any
particular environment. So I can't easily switch to a known non-root user
account, because such account might not exist. Am I expected to switch to a
predefined locked account like 'nobody'? Or is there a different way to
drop privileges?

My envisioned use case: I want to run or develop a very simple test, e.g.
rpmlint. I want to run it locally on my system, because it's the easiest
hassle-free way. I know it's non-destructive and basically harmless, but
the test system mandates it's run as root (according to the spec). I feel
uneasy about running even a harmless test as root, so this test will try to
drop privileges immediately after start. But how exactly does it do that?

Thanks,
Kamil

[Stef Walter]

On 13.06.2017 15:13, Kamil Paral wrote:
>  InvokingTestsAnsible
>  <https://fedoraproject.org/wiki/Changes/InvokingTestsAnsible> says:
>  
>      The playbook and its test suite or test framework:
>          SHOULD drop privileges appropriately if the test suite should be
>      run as non-root.
>  
>  
>  I'm not clear how you do that. The test suite should not assume any
>  particular environment. So I can't easily switch to a known non-root
>  user account, because such account might not exist. Am I expected to
>  switch to a predefined locked account like 'nobody'? Or is there a
>  different way to drop privileges? 
The tests should create a purpose appropriate user.

Various tests may have requirements to do fancy things, hence the
standard interface requires starting off as root, so that they are
enabled to do so.

Merlin is there space in standard-test-roles for a common Ansible role
implementation of creating an unprivileged user, that will cover most
tests conforming to the spec? Is there enough commonality here to create
such a role?

Cheers,

Stef

>  My envisioned use case: I want to run or develop a very simple test,
>  e.g. rpmlint. I want to run it locally on my system, because it's the
>  easiest hassle-free way. I know it's non-destructive and basically
>  harmless, but the test system mandates it's run as root (according to
>  the spec). I feel uneasy about running even a harmless test as root, so
>  this test will try to drop privileges immediately after start. But how
>  exactly does it do that?
>  
>  Thanks,
>  Kamil
>  
>  
>  
>  _______________________________________________
>  CI mailing list -- ci(a)lists.fedoraproject.org
>  To unsubscribe send an email to ci-leave(a)lists.fedoraproject.org
>