first commit

privdrop_test.go

@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// Copyright (C) 2026 Bryan Joshua Pedini
+
+package main
+
+import (
+	"io"
+	"log/slog"
+	"os"
+	"testing"
+)
+
+// TestDropPrivilegesNonRootSkipsDrop covers the non-root half (Phase 6): when
+// the test binary is not running as root (the normal CI/dev case), dropPrivileges
+// must take the skip path — log a warning and return — without calling exit
+// or erroring. The root half (actual setuid/setgid) requires a root-owned
+// process and is exercised at the container level (Phase 6), not here.
+func TestDropPrivilegesNonRootSkipsDrop(t *testing.T) {
+	if os.Getuid() == 0 {
+		t.Skip("this test asserts the non-root skip path; running as root here")
+	}
+
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+
+	// If dropPrivileges took the root path here, it would call
+	// syscall.Setgid/Setuid as non-root, fail, and os.Exit(1) — which would
+	// kill the test binary. Reaching this point at all proves the skip path
+	// was taken, without erroring or exiting.
+	dropPrivileges(logger, 1000, 1000)
+}