make our testsuite pass in a podman container with default privs

[poettering]

Our tests so far mostly did a geteuid() == 0 check to guard privileged operations. Podman apparently invokes containers by default with geteuid() == 0 but then takes most caps away, which then means we'll try the privleged operaitons and fail. Let's tweak the conditioning hence.

Fixes: #19746

[yuwata]

LGTM. One minor suggestion, and one question.

[poettering]

Force pushed a new version changing that one check to geteuid(). For the other thing see comment above. Uprgading green label

[mbiebl]

Seems to work fine under Podman. Under Docker, a single test failure remains:

The output from the failed tests:

438/918 test-util                                                                 FAIL           0.32s (killed by signal 6 SIGABRT)

--- command ---
21:35:03 SYSTEMD_LANGUAGE_FALLBACK_MAP='/systemd/src/locale/language-fallback-map' SYSTEMD_KBD_MODEL_MAP='/systemd/src/locale/kbd-model-map' PATH='/systemd/build:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' /systemd/build/test-util
--- stderr ---
/* test_align_power2 */
/* test_max */
/* test_container_of */
/* test_div_round_up */
/* test_u64log2 */
/* test_protect_errno */
/* test_unprotect_errno */
/* test_in_set */
/* test_log2i */
/* test_eqzero */
/* test_raw_clone */
before clone: getpid()→39301
raw_clone: 39302 getpid()→39301 raw_getpid()→39301
raw_clone: 0 getpid()→39302 raw_getpid()→39302
Assertion 'errno == EINVAL' failed at src/test/test-util.c:319, function test_raw_clone(). Aborting.
-------


Summary of Failures:

324/918 udev-test                                                                 SKIP           0.14s
352/918 test-bus-marshal                                                          SKIP           0.02s
356/918 test-bus-chat                                                             SKIP           0.02s
357/918 test-bus-cleanup                                                          SKIP           0.01s
358/918 test-bus-track                                                            SKIP           0.01s
362/918 test-bus-gvariant                                                         SKIP           0.01s
364/918 test-bus-match                                                            SKIP           0.01s
372/918 test-sd-device-monitor                                                    SKIP           0.01s
399/918 test-oomd-util                                                            SKIP           0.01s
417/918 test-boot-timestamps                                                      SKIP           0.02s
438/918 test-util                                                                 FAIL           0.32s (killed by signal 6 SIGABRT)
438/918 test-util                                                                 FAIL           0.32s (killed by signal 6 SIGABRT)
480/918 test-barrier                                                              SKIP           0.01s
482/918 test-namespace                                                            SKIP           0.01s
489/918 test-loop-block                                                           SKIP           0.02s
492/918 test-bpf-devices                                                          SKIP           0.01s
493/918 test-bpf-firewall                                                         SKIP           0.02s
494/918 test-bpf-foreign-programs                                                 SKIP           0.02s
537/918 test-execute                                                              SKIP           0.02s
554/918 test-sd-hwdb                                                              SKIP           0.01s
917/918 check-directives                                                          SKIP           0.01s

Ok:                 898 
Expected Fail:      0   
Fail:               1   
Unexpected Pass:    0   
Skipped:            19  
Timeout:            0   

[poettering]

@mbiebl #19816 — but I didn't test it in Docker myself. Docker still can't deal with cgroupsv2? wtf? Anyway, can you check if it fixes things for you? My educated guess is that it will

[mbiebl]

With #19816 applied:

Ok:                 899 
Expected Fail:      0   
Fail:               0   
Unexpected Pass:    0   
Skipped:            19  
Timeout:            0   

[mbiebl]

Docker still can't deal with cgroupsv2?

In theory it should. At least according to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840829 resp. moby/moby#40360

That said, it's possible that cgroupsv2 support is still buggy.