fix(supervisor): harden tests for restricted CI container environments

Guard tests against CI-specific constraints: root without CAP_SETPCAP,
UIDs with no /etc/passwd entry, and restricted /proc access.

Signed-off-by: Seth Jennings <sjennings@nvidia.com>
Signed-off-by: Seth Jennings <sjenning@redhat.com>

Author: sjenning

crates/openshell-supervisor-process/src/bypass_monitor/mod.rs

@@ -554,6 +554,17 @@ mod tests {
             std::thread::sleep(Duration::from_millis(20));
         }
 
+        let child_fd_dir = format!("/proc/{child_pid}/fd");
+        if std::fs::read_dir(&child_fd_dir).is_err() {
+            #[allow(unsafe_code)]
+            unsafe {
+                libc::kill(child_pid, libc::SIGKILL);
+                libc::waitpid(child_pid, std::ptr::null_mut(), 0);
+            }
+            eprintln!("skipping: cannot read {child_fd_dir} (restricted /proc)");
+            return;
+        }
+
         let (binary, pid, ancestors) = resolve_process_identity(std::process::id(), peer_port);
 
         // libc/syscall FFI requires unsafe

crates/openshell-supervisor-process/src/process.rs

@@ -1599,6 +1599,17 @@ mod tests {
         });
 
         let result = drop_privileges(&policy);
+        #[cfg(target_os = "linux")]
+        {
+            if nix::unistd::geteuid().is_root() && !capability_bounding_set_clear_available() {
+                let msg = format!("{}", result.unwrap_err());
+                assert!(
+                    msg.contains("Failed to clear child capability bounding set"),
+                    "unexpected failure: {msg}"
+                );
+                return;
+            }
+        }
         assert!(result.is_ok(), "drop_privileges failed: {result:?}");
     }
 
@@ -1913,9 +1924,13 @@ mod tests {
             return;
         }
 
-        let current_user = User::from_uid(nix::unistd::geteuid())
-            .unwrap()
-            .expect("current user entry");
+        let current_user = match User::from_uid(nix::unistd::geteuid()) {
+            Ok(Some(u)) => u,
+            _ => {
+                eprintln!("skipping: current UID has no /etc/passwd entry");
+                return;
+            }
+        };
         let restricted_group = Group::from_gid(Gid::from_raw(0))
             .unwrap()
             .expect("gid 0 group entry");