Skip some tests if we can't use FUSE

On some systems we can't make use of FUSE, especially on the same
locked-down systems where distribution packages are typically built.
For example, official Debian autobuilders (buildds) are configured to
disallow module loading after boot has finished as a form of security
hardening, some build chroots don't have a valid /etc/mtab, and Docker
containers give us uid 0 but not CAP_SYS_ADMIN.

These checks are taken from libostree.

Signed-off-by: Simon McVittie <smcv@collabora.com>

Closes: #2824
Approved by: matthiasclasen

tests/libtest.sh

@@ -343,12 +343,18 @@ else
     _flatpak_bwrap_works=true
 fi
 
+# Use to skip all of these tests
+skip() {
+    echo "1..0 # SKIP" "$@"
+    exit 0
+}
+
 skip_without_bwrap () {
     if "${_flatpak_bwrap_works}"; then
         return 0
     else
         sed -e 's/^/# /' < bwrap-result
-        echo "1..0 # SKIP Cannot run bwrap"
+        skip "Cannot run bwrap"
         exit 0
     fi
 }
@@ -362,6 +368,22 @@ skip_one_without_bwrap () {
     fi
 }
 
+skip_without_fuse () {
+    fusermount --version >/dev/null 2>&1 || skip "no fusermount"
+
+    capsh --print | grep -q 'Bounding set.*[^a-z]cap_sys_admin' || \
+        skip "No cap_sys_admin in bounding set, can't use FUSE"
+
+    [ -w /dev/fuse ] || skip "no write access to /dev/fuse"
+    [ -e /etc/mtab ] || skip "no /etc/mtab"
+}
+
+skip_revokefs_without_fuse () {
+    if [ "x${USE_SYSTEMDIR-}" = xyes ] && [ "x${FLATPAK_DISABLE_REVOKEFS-}" != xyes ]; then
+        skip_without_fuse
+    fi
+}
+
 sed s#@testdir@#${test_builddir}# ${test_srcdir}/session.conf.in > session.conf
 dbus-daemon --fork --config-file=session.conf --print-address=3 --print-pid=4 \
     3> dbus-session-bus-address 4> dbus-session-bus-pid

tests/test-build-update-repo.sh

@@ -25,6 +25,7 @@ set -euo pipefail
 . $(dirname $0)/libtest.sh
 
 skip_without_bwrap
+skip_revokefs_without_fuse
 
 echo "1..5"
 

tests/test-completion.sh

@@ -22,6 +22,8 @@ set -euo pipefail
 #FLATPAK=flatpak
 . $(dirname $0)/libtest.sh
 
+skip_revokefs_without_fuse
+
 # This test looks for specific localized strings.
 export LC_ALL=C
 

tests/test-info.sh

@@ -4,6 +4,8 @@ set -euo pipefail
 
 . $(dirname $0)/libtest.sh
 
+skip_revokefs_without_fuse
+
 echo "1..7"
 
 setup_repo

tests/test-override.sh

@@ -4,6 +4,8 @@ set -euo pipefail
 
 . $(dirname $0)/libtest.sh
 
+skip_revokefs_without_fuse
+
 reset_overrides () {
     ${FLATPAK} override --user --reset org.test.Hello
     ${FLATPAK} override --user --show org.test.Hello > info

tests/test-repo.sh

@@ -22,6 +22,7 @@ set -euo pipefail
 . $(dirname $0)/libtest.sh
 
 skip_without_bwrap
+skip_revokefs_without_fuse
 
 echo "1..30"
 

tests/test-run.sh

@@ -22,6 +22,7 @@ set -euo pipefail
 . $(dirname $0)/libtest.sh
 
 skip_without_bwrap
+skip_revokefs_without_fuse
 
 echo "1..15"
 

tests/test-unsigned-summaries.sh

@@ -25,6 +25,7 @@ set -euo pipefail
 . $(dirname $0)/libtest.sh
 
 skip_without_bwrap
+skip_revokefs_without_fuse
 
 echo "1..7"
 

tests/test-update-remote-configuration.sh

@@ -25,6 +25,7 @@ set -euo pipefail
 . $(dirname $0)/libtest.sh
 
 skip_without_bwrap
+skip_revokefs_without_fuse
 
 echo "1..3"