User permissions in bazel test

[ouillie]

Motivation: I'm trying to run a test that essentially runs ip addr add 10.0.0.1 dev lo at some point during the test. This fails because you can only run that as the super user (when the system I'm testing is deployed for real, it will run as the super user).

I'm trying to figure out how I can make it work in the Bazel test. Here's what I've tried:

• sudo bazel test does not work (and would feel way too dangerous even if it did). Documentation says "tests must be executed as a non-root user" anyway.
• Setting the setuid bit on the ip binary beforehand (with sudo chmod u+s "$(which ip)") does not work either. This is surprising, because it does mean I can run the ip addr add command from a normal shell and it works fine without sudo. I'm assuming this has something to do with Bazel's linux sandbox. Looking for clarifications if possible.
• Speaking of the linux sandbox, I noticed this fake_root option, but it's unclear how I might set it or if it would even help. I struggled to find much useful documentation about the linux sandbox in general. Can I pass that -R parameter to bazel test somehow?
  • Also, what is the purpose of the required users and groups in tests? "The users root, nobody, and unittest must exist. The groups root, nobody, and eng must exist" but I also struggled to find any information on why or how these users / groups are used.

[ouillie]

For what it's worth, I managed to solve this on Linux. Using block-network combined with requires-fakeroot causes the Linux sandbox to set up a network namespace with apparent root permission, allowing the ip addr add command to succeed.