From b07b48e206688ab5de28e85e9cf501e0dfc58003 Mon Sep 17 00:00:00 2001
From: Simon McVittie <smcv@collabora.com>
Date: Fri, 12 Apr 2019 18:41:48 +0100
Subject: [PATCH] Skip some tests if we can't use FUSE

On some systems we can't make use of FUSE, especially on the same
locked-down systems where distribution packages are typically built.
For example, official Debian autobuilders (buildds) are configured to
disallow module loading after boot has finished as a form of security
hardening, some build chroots don't have a valid /etc/mtab, and Docker
containers give us uid 0 but not CAP_SYS_ADMIN.

These checks are taken from libostree.

Signed-off-by: Simon McVittie <smcv@collabora.com>

Closes: #2824
Approved by: matthiasclasen
---
 tests/libtest.sh                          | 24 ++++++++++++++++++++++-
 tests/test-build-update-repo.sh           |  1 +
 tests/test-completion.sh                  |  2 ++
 tests/test-info.sh                        |  2 ++
 tests/test-override.sh                    |  2 ++
 tests/test-repo.sh                        |  1 +
 tests/test-run.sh                         |  1 +
 tests/test-unsigned-summaries.sh          |  1 +
 tests/test-update-remote-configuration.sh |  1 +
 9 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/tests/libtest.sh b/tests/libtest.sh
index 546acf85..eb4f1c14 100644
--- a/tests/libtest.sh
+++ b/tests/libtest.sh
@@ -343,12 +343,18 @@ else
     _flatpak_bwrap_works=true
 fi
 
+# Use to skip all of these tests
+skip() {
+    echo "1..0 # SKIP" "$@"
+    exit 0
+}
+
 skip_without_bwrap () {
     if "${_flatpak_bwrap_works}"; then
         return 0
     else
         sed -e 's/^/# /' < bwrap-result
-        echo "1..0 # SKIP Cannot run bwrap"
+        skip "Cannot run bwrap"
         exit 0
     fi
 }
@@ -362,6 +368,22 @@ skip_one_without_bwrap () {
     fi
 }
 
+skip_without_fuse () {
+    fusermount --version >/dev/null 2>&1 || skip "no fusermount"
+
+    capsh --print | grep -q 'Bounding set.*[^a-z]cap_sys_admin' || \
+        skip "No cap_sys_admin in bounding set, can't use FUSE"
+
+    [ -w /dev/fuse ] || skip "no write access to /dev/fuse"
+    [ -e /etc/mtab ] || skip "no /etc/mtab"
+}
+
+skip_revokefs_without_fuse () {
+    if [ "x${USE_SYSTEMDIR-}" = xyes ] && [ "x${FLATPAK_DISABLE_REVOKEFS-}" != xyes ]; then
+        skip_without_fuse
+    fi
+}
+
 sed s#@testdir@#${test_builddir}# ${test_srcdir}/session.conf.in > session.conf
 dbus-daemon --fork --config-file=session.conf --print-address=3 --print-pid=4 \
     3> dbus-session-bus-address 4> dbus-session-bus-pid
diff --git a/tests/test-build-update-repo.sh b/tests/test-build-update-repo.sh
index 99bc994b..e3c2ab53 100755
--- a/tests/test-build-update-repo.sh
+++ b/tests/test-build-update-repo.sh
@@ -25,6 +25,7 @@ set -euo pipefail
 . $(dirname $0)/libtest.sh
 
 skip_without_bwrap
+skip_revokefs_without_fuse
 
 echo "1..5"
 
diff --git a/tests/test-completion.sh b/tests/test-completion.sh
index b90d2713..dae4fd3a 100755
--- a/tests/test-completion.sh
+++ b/tests/test-completion.sh
@@ -22,6 +22,8 @@ set -euo pipefail
 #FLATPAK=flatpak
 . $(dirname $0)/libtest.sh
 
+skip_revokefs_without_fuse
+
 # This test looks for specific localized strings.
 export LC_ALL=C
 
diff --git a/tests/test-info.sh b/tests/test-info.sh
index a1f04630..af17ecaa 100644
--- a/tests/test-info.sh
+++ b/tests/test-info.sh
@@ -4,6 +4,8 @@ set -euo pipefail
 
 . $(dirname $0)/libtest.sh
 
+skip_revokefs_without_fuse
+
 echo "1..7"
 
 setup_repo
diff --git a/tests/test-override.sh b/tests/test-override.sh
index e0c6d9b1..93009ee3 100755
--- a/tests/test-override.sh
+++ b/tests/test-override.sh
@@ -4,6 +4,8 @@ set -euo pipefail
 
 . $(dirname $0)/libtest.sh
 
+skip_revokefs_without_fuse
+
 reset_overrides () {
     ${FLATPAK} override --user --reset org.test.Hello
     ${FLATPAK} override --user --show org.test.Hello > info
diff --git a/tests/test-repo.sh b/tests/test-repo.sh
index 7b72f955..f9bef3a9 100644
--- a/tests/test-repo.sh
+++ b/tests/test-repo.sh
@@ -22,6 +22,7 @@ set -euo pipefail
 . $(dirname $0)/libtest.sh
 
 skip_without_bwrap
+skip_revokefs_without_fuse
 
 echo "1..30"
 
diff --git a/tests/test-run.sh b/tests/test-run.sh
index a6b66814..233df9ad 100644
--- a/tests/test-run.sh
+++ b/tests/test-run.sh
@@ -22,6 +22,7 @@ set -euo pipefail
 . $(dirname $0)/libtest.sh
 
 skip_without_bwrap
+skip_revokefs_without_fuse
 
 echo "1..15"
 
diff --git a/tests/test-unsigned-summaries.sh b/tests/test-unsigned-summaries.sh
index cd5b0a8a..9e6ed537 100755
--- a/tests/test-unsigned-summaries.sh
+++ b/tests/test-unsigned-summaries.sh
@@ -25,6 +25,7 @@ set -euo pipefail
 . $(dirname $0)/libtest.sh
 
 skip_without_bwrap
+skip_revokefs_without_fuse
 
 echo "1..7"
 
diff --git a/tests/test-update-remote-configuration.sh b/tests/test-update-remote-configuration.sh
index 4b8b52dc..3262db5f 100755
--- a/tests/test-update-remote-configuration.sh
+++ b/tests/test-update-remote-configuration.sh
@@ -25,6 +25,7 @@ set -euo pipefail
 . $(dirname $0)/libtest.sh
 
 skip_without_bwrap
+skip_revokefs_without_fuse
 
 echo "1..3"