Expand tests to check CAP_MAC_ADMIN absence about osbuild HOT 3 OPEN

@mvo5 I am wondering if this should be maybe more general test - dropping all caps for all stages and expect them to fail?

from osbuild.

I'd quite like if we can move to capabilities being required in stages and reducing the default set of capabilities given. I don't know if that's what you had in mind or if that makes the scope too large?

from osbuild.

I personally would start simple and just inspect tar initially, it seems to test if we need CAP_MAC_ADMIN here we would have to try something like this:

1. ensure we run on both selinux and non-selinux system as they might behave differently. on a non-selinux system CAP_MAC_ADMIN should actually not be needed by tar because it's all just xattrs to them but on selinux enabled hosts this is different
2. create a test dir with dirs/files with "unknown" (to the host) selinux attributes, i.e. not use something like etc_t but maybe randomz_t or something
3. write a stage test to ensure the stage really runs under bwrap so that the cap handling happens
4. check that there are no selinux denials and that the resulting tar archive has correct selinux attributes

I'm afraid it's a bit of work :/

from osbuild.