From ce42337ba4dbadb692d01637feabb74de70d6563 Mon Sep 17 00:00:00 2001 From: Matthew DeGuzman <91019033+matt-dz@users.noreply.github.com> Date: Wed, 28 Oct 2026 15:08:36 -0400 Subject: [PATCH] test(head): don't pass the runner's environment to the unprivileged child TestHeadPermissionDenied re-runs itself as UID 65534 when the parent is root and passed the parent's whole environment to that child. Under Bazel coverage, as root, the environment includes COVERAGE_OUTPUT_FILE, XML_OUTPUT_FILE and TEST_SRCDIR, all pointing at root-owned paths, so the child exits 2 trying to write its coverage profile. Give the child only PATH and its own TMPDIR. Plain `go test` is not affected (Go's coverage runtime only warns when GOCOVERDIR is unwritable); this keeps rshell in sync with the copy in datadog-agent (DataDog/datadog-agent#58502), where it broke CI. Environment: Datadog workspace Co-Authored-By: Claude Sonnet 5.5 --- builtins/head/head_unix_test.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/builtins/head/head_unix_test.go b/builtins/head/head_unix_test.go index f94d66fea..b9b72a6a4 100644 --- a/builtins/head/head_unix_test.go +++ b/builtins/head/head_unix_test.go @@ -70,7 +70,9 @@ func TestHeadPermissionDenied(t *testing.T) { command := exec.Command(childExecutable, "-test.run=^TestHeadPermissionDenied$", "-test.v") command.Dir = dir - command.Env = append(os.Environ(), "TMPDIR="+dir) + // Don't inherit the test runner's environment: under Bazel it points the + // child at root-owned coverage, XML report and runfiles paths. + command.Env = []string{"PATH=" + os.Getenv("PATH"), "TMPDIR=" + dir} command.SysProcAttr = &syscall.SysProcAttr{ Credential: &syscall.Credential{Uid: 65534, Gid: 65534}, }