fix(supervisor): harden tests for restricted CI container environments

Guard tests against CI-specific constraints: root without CAP_SETPCAP,
UIDs with no /etc/passwd entry, and restricted /proc access.

Signed-off-by: Seth Jennings <sjennings@nvidia.com>
Signed-off-by: Seth Jennings <sjenning@redhat.com>

Author: sjenning

crates/openshell-supervisor-process/src/bypass_monitor/mod.rs

@@ -540,6 +540,18 @@ mod tests {
             }
         }
 
+        if std::fs::read_link(format!("/proc/{child_pid}/exe")).is_err()
+            || std::fs::read_dir(format!("/proc/{child_pid}/fd")).is_err()
+        {
+            #[allow(unsafe_code)]
+            unsafe {
+                libc::kill(child_pid, libc::SIGKILL);
+                libc::waitpid(child_pid, std::ptr::null_mut(), 0);
+            }
+            eprintln!("skipping: cannot read /proc/{child_pid} (restricted /proc)");
+            return;
+        }
+
         let deadline = Instant::now() + Duration::from_secs(2);
         loop {
             if let Ok(link) = std::fs::read_link(format!("/proc/{child_pid}/exe"))

crates/openshell-supervisor-process/src/process.rs

@@ -1599,6 +1599,17 @@ mod tests {
         });
 
         let result = drop_privileges(&policy);
+        #[cfg(target_os = "linux")]
+        {
+            if nix::unistd::geteuid().is_root() && !capability_bounding_set_clear_available() {
+                let msg = format!("{}", result.unwrap_err());
+                assert!(
+                    msg.contains("Failed to clear child capability bounding set"),
+                    "unexpected failure: {msg}"
+                );
+                return;
+            }
+        }
         assert!(result.is_ok(), "drop_privileges failed: {result:?}");
     }
 
@@ -1913,9 +1924,10 @@ mod tests {
             return;
         }
 
-        let current_user = User::from_uid(nix::unistd::geteuid())
-            .unwrap()
-            .expect("current user entry");
+        let Ok(Some(current_user)) = User::from_uid(nix::unistd::geteuid()) else {
+            eprintln!("skipping: current UID has no /etc/passwd entry");
+            return;
+        };
         let restricted_group = Group::from_gid(Gid::from_raw(0))
             .unwrap()
             .expect("gid 0 group entry");