From 589b06b63d3e378ed4fd96d0ae9f80de9cede61a Mon Sep 17 00:00:00 2001 From: naiba Date: Mon, 20 Jul 2026 14:15:10 +0000 Subject: [PATCH] test(agentcompat): probe credential execution support Co-authored-by: naiba/CloudCode --- .../agentcompat/internal/process/supervisor_test.go | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/integration/agentcompat/internal/process/supervisor_test.go b/integration/agentcompat/internal/process/supervisor_test.go index fa4b3a2a..1fa46387 100644 --- a/integration/agentcompat/internal/process/supervisor_test.go +++ b/integration/agentcompat/internal/process/supervisor_test.go @@ -41,11 +41,22 @@ func TestSupervisor_RunsChildWithConfiguredCredential(t *testing.T) { requireNoError(t, err) executablePath := filepath.Join(credentialDirectory, "process-helper") requireNoError(t, os.WriteFile(executablePath, testBinary, 0o755)) + uncredentialed := newHelperSupervisor(t.Context(), "credential", []string{helperMarkerEnv + "=" + marker}) + uncredentialed.spec.Path = executablePath + requireNoError(t, uncredentialed.Start()) + requireNoError(t, uncredentialed.Wait(t.Context())) + requireNoError(t, os.Remove(marker)) + supervisor.spec.Path = executablePath supervisor.spec.Credential = &syscall.Credential{Uid: 65534, Gid: 65534} // When - requireNoError(t, supervisor.Start()) + if err := supervisor.Start(); err != nil { + if errors.Is(err, syscall.EPERM) { + t.Skipf("credentialed helper execution is not permitted: %v", err) + } + t.Fatalf("start credentialed helper: %v", err) + } requireNoError(t, supervisor.Wait(t.Context())) // Then