From: Eric Curtin <eric.curtin@docker.com>
Date: Wed, 29 Jul 2026 02:46:05 +0000 (+0100)
Subject: test-bpf-restrict-fs: skip if manager startup fails due to lack of privileges (#43202)
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=d47b07d05fd596cb539da01981ae08be141013bd;p=thirdparty%2Fsystemd.git

test-bpf-restrict-fs: skip if manager startup fails due to lack of privileges (#43202)

test-bpf-restrict-fs.c creates a Manager with RUNTIME_SCOPE_SYSTEM, which
tries to set up the real system runtime directory hierarchy (e.g. create
/run/systemd/), and that requires privileges the test process may not
have (e.g. unprivileged sandboxed builders such as OBS).

Previously this was masked because bpf_restrict_fs_supported() did a
trial open/load/attach of the BPF program itself, which also requires
elevated privileges and so failed first, causing the test to skip
before ever reaching manager_new()/manager_startup(). Since
bpf_restrict_fs_supported() no longer does that trial load, the test
now reaches manager_new()/manager_startup() in these unprivileged
environments and hard-fails instead of skipping, e.g.:

  Assertion failed: Expected "manager_startup(m, NULL, NULL, NULL, NULL)"
  to succeed, but got error: -13/EACCES

Use the same manager_errno_skip_test() pattern already used by other
tests (test-engine.c, test-execute.c, test-path.c, ...) to skip
gracefully when manager_new() or manager_startup() fail due to missing
privileges, instead of asserting.

Follow-up for c99678eedaad88defe440d6102952926a61e72cf.
---

diff --git a/src/test/test-bpf-restrict-fs.c b/src/test/test-bpf-restrict-fs.c
index 810f7af02cf..2eba2a9aa91 100644
--- a/src/test/test-bpf-restrict-fs.c
+++ b/src/test/test-bpf-restrict-fs.c
@@ -86,8 +86,15 @@ int main(int argc, char *argv[]) {
         ASSERT_OK(setenv_unit_path(unit_dir));
         ASSERT_NOT_NULL((runtime_dir = setup_fake_runtime_dir()));
 
-        ASSERT_OK(manager_new(RUNTIME_SCOPE_SYSTEM, MANAGER_TEST_RUN_BASIC, &m));
-        ASSERT_OK(manager_startup(m, NULL, NULL, NULL, NULL));
+        r = manager_new(RUNTIME_SCOPE_SYSTEM, MANAGER_TEST_RUN_BASIC, &m);
+        if (manager_errno_skip_test(r))
+                return log_tests_skipped_errno(r, "manager_new");
+        ASSERT_OK(r);
+
+        r = manager_startup(m, NULL, NULL, NULL, NULL);
+        if (manager_errno_skip_test(r))
+                return log_tests_skipped_errno(r, "manager_startup");
+        ASSERT_OK(r);
 
         /* bpf_restrict_fs_supported() above only checks that the BPF LSM hook is enabled in the kernel; it
          * doesn't verify that the LSM BPF program managed to actually attach (e.g. some architectures/older