sudo fixes

src/utils.jl

@@ -234,10 +234,10 @@ function sudo_cmd()
     if getuid() == 0
         # If we're already root, don't use any kind of sudo program
         _sudo_cmd = String[]
-    elseif Sys.which("sudo") !== nothing success(`sudo -V`)
+    elseif Sys.which("sudo") !== nothing && success(`sudo -V`)
         # If `sudo` is available, use that
         _sudo_cmd = ["sudo"]
-    elseif Sys.which("su") !== nothing
+    elseif Sys.which("su") !== nothing && success(`su --version`)
         # Fall back to `su` if all else fails
         _sudo_cmd = ["su", "root", "-c"]
     else

test/Multiarch.jl

@@ -40,7 +40,7 @@ using Test, Sandbox, Base.BinaryPlatforms, LazyArtifacts
         multiarch_executors = Sandbox.SandboxExecutor[]
     elseif Sys.islinux()
         # On Linux, we need passwordless sudo to be able to register things
-        if !success(`sudo -k -n true`)
+        if Sys.which("sudo") !== nothing && !success(`sudo -k -n true`)
             @warn("Refusing to test multiarch on a system without passwordless sudo!")
             multiarch_executors = Sandbox.SandboxExecutor[]
         end

test/Sandbox.jl

@@ -3,9 +3,12 @@ using Test, Sandbox, SHA, Base.BinaryPlatforms
 all_executors = Sandbox.all_executors
 
 # Can we run `sudo` without a password?  If not, don't attempt to test the privileged runner
-if !success(`sudo -k -n true`)
+if Sys.which("sudo") !== nothing && !success(`sudo -k -n true`)
     all_executors = filter(exe -> exe != PrivilegedUserNamespacesExecutor, all_executors)
 end
+if Sandbox.getuid() == 0
+    all_executors = filter(exe -> exe != UnprivilegedUserNamespacesExecutor, all_executors)
+end
 
 function print_if_nonempty(stderr::Vector{UInt8})
     if !isempty(stderr)

test/UserNamespaces.jl

@@ -100,7 +100,7 @@ else
 end
 
 # Only test privileged runner if sudo doesn't require a password
-if success(`sudo -k -n true`)
+if Sys.which("sudo") !== nothing && success(`sudo -k -n true`)
     if executor_available(PrivilegedUserNamespacesExecutor)
         @testset "PrivilegedUserNamespacesExecutor" begin
             @test_logs (:info, "Testing Privileged User Namespaces Executor (read-only, read-write)") match_mode=:any begin

test/runtests.jl

@@ -38,7 +38,7 @@ end
 
 # Ensure we're not running as root; that breaks unprivileged user namespaces testing
 if Sandbox.getuid() == 0
-    error("Cannot run Sandbox.jl tests as root!")
+    @warn("You are running Sandbox.jl tests as root!  This cannot test unprivileged namespaces!")
 end
 
 include("SandboxConfig.jl")