Lack of support for Non-Local/High-UID identities

[vandah]

Bug Description

My laptop has only one non-privileged user which is my Google user (using authd). This means the username of my user is neither ubuntu, nor is my UID 1000 or 1001. This is the case for all cloud account setups and could also cause issues for users on systems with multiple users.

This issue causes checkbox to fail to identify the non-privileged user and crash. As a consequence, this makes me not able to run checkbox tests through the checkbox-cli unless I use a launcher where I specify my normal user.

I am assuming the non-privileged user detection is happening to avoid running non-privileged jobs as root when checkbox was started as root. If that's the case I'd suggest to only guess the user when UID is 0 or implement a fallback on the current user if none other is found.

Relevant checkbox code:

• Definition of the user guessing function:

  checkbox/checkbox-ng/checkbox_ng/user_utils.py

  Line 30 in 8868528

  def guess_normal_user() -> str:

• Here a check could be added to see if the current user is root:

  checkbox/checkbox-ng/checkbox_ng/launcher/subcommands.py

  Line 655 in 8868528

  "normal_user_provider": self.get_normal_user,

Cert-blocker Test Case

• cert-blocker

To Reproduce

1. Get a system with no ubuntu user and no users with UID 1000 or 1001
2. Run checkbox.checkbox-cli
3. Select any non-root test to run

Expected Result

The test runs as the current user and checkbox doesn't crash.

Actual Result

Checkbox crashes with:

==============[ Bootstrap com.canonical.plainbox::manifest (1/2) ]==============
ERROR:plainbox.bug:Undeclared exception RuntimeError raised from run_job
Traceback (most recent call last):
  File "/snap/checkbox24/current/bin/checkbox-cli", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/snap/checkbox24/current/lib/python3.12/site-packages/checkbox_ng/launcher/checkbox_cli.py", line 185, in main
    return subcmd.invoked(ctx)
           ^^^^^^^^^^^^^^^^^^^
  File "/snap/checkbox24/current/lib/python3.12/site-packages/checkbox_ng/launcher/subcommands.py", line 269, in invoked
    self._select_test_plan_and_continue()
  File "/snap/checkbox24/current/lib/python3.12/site-packages/checkbox_ng/launcher/subcommands.py", line 702, in _select_test_plan_and_continue
    self.bootstrap()
  File "/snap/checkbox24/current/lib/python3.12/site-packages/checkbox_ng/launcher/subcommands.py", line 629, in bootstrap
    self._run_bootstrap_jobs(bs_jobs)
  File "/snap/checkbox24/current/lib/python3.12/site-packages/checkbox_ng/launcher/stages.py", line 443, in _run_bootstrap_jobs
    result_builder = self.sa.run_job(job_id, "piano", False)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/snap/checkbox24/current/lib/python3.12/site-packages/plainbox/impl/decorators.py", line 154, in wrapper
    raise exc
  File "/snap/checkbox24/current/lib/python3.12/site-packages/plainbox/impl/decorators.py", line 146, in wrapper
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/snap/checkbox24/current/lib/python3.12/site-packages/plainbox/impl/session/assistant.py", line 1631, in run_job
    result = self._runner.run_job(
             ^^^^^^^^^^^^^^^^^^^^^
  File "/snap/checkbox24/current/lib/python3.12/site-packages/plainbox/impl/execution.py", line 191, in run_job
    result_builder = self._run_command(job, environ, as_systemd_unit)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/snap/checkbox24/current/lib/python3.12/site-packages/plainbox/impl/execution.py", line 235, in _run_command
    return_code = self.execute_job(
                  ^^^^^^^^^^^^^^^^^
  File "/snap/checkbox24/current/lib/python3.12/site-packages/plainbox/impl/execution.py", line 258, in execute_job
    target_user = job.user or self._user_provider()
                              ^^^^^^^^^^^^^^^^^^^^^
  File "/snap/checkbox24/current/lib/python3.12/site-packages/checkbox_ng/launcher/subcommands.py", line 642, in get_normal_user
    or guess_normal_user()
       ^^^^^^^^^^^^^^^^^^^
  File "/snap/checkbox24/current/lib/python3.12/site-packages/checkbox_ng/user_utils.py", line 54, in guess_normal_user
    raise RuntimeError("Cannot guess which user should run unprivileged jobs!")
RuntimeError: Cannot guess which user should run unprivileged jobs!

Environment

• Ubuntu 25.10
• Checkbox snap 7.1.0-dev26

Relevant log output

Additional context

No response

[syncronize-issues-to-jira]

Thank you for reporting your feedback to us!

The internal ticket has been created: https://warthogs.atlassian.net/browse/CHECKBOX-2185.

This message was autogenerated

[Hook25]

Hello, you can configure the normal user in the launcher, that way it won't be guessed!

I can't think of a better solution to be honest, side note, checkbox has to do this, because non-root jobs are also testing the priviledges of the normal user. If you know another good heuristic we could use to guess the normal user we are all ears!

[vandah]

Hi @Hook25, yeah I did that but I feel like this option should be mentioned more visibly in the docs or the issue fixed in some way. After all, this is something that affects all users with our company laptops.

Here is a simple heuristic that should filter out normal users on Ubuntu:

import pwd

normal_users = []

for entry in pwd.getpwall():
    if entry.pw_uid >= 1000 and entry.pw_shell not in ["/usr/bin/false", "/usr/sbin/nologin"]:
            normal_users.append(entry.pw_name)

print(normal_users)

This could be used to just extend the already existing logic, for example by still preferring ubuntu, 1000 and 1001 but adding a fallback on the current user if it is a normal user or if all else fails, the normal user which has the smallest UID:

import pwd, os

def guess_normal_user():
    current_user = os.environ.get(("USER"))

    normal_users = {}

    for entry in pwd.getpwall():
        if entry.pw_uid >= 1000 and entry.pw_shell not in ["/usr/bin/false", "/usr/sbin/nologin"]:
            normal_users[entry.pw_uid] = entry.pw_name

    if 'ubuntu' in normal_users.values():
        return 'ubuntu'

    user = normal_users.get(1000) or normal_users.get(1001)
    if user is not None:
        return user

    if current_user is not None and current_user in normal_users.values():
        return current_user

    min_uid = min(normal_users.keys())
    user = normal_users.get(min_uid)
    if user is not None:
        return user

    raise RuntimeError("Cannot guess which user should run unprivileged jobs!")

[Hook25]

I agree with this change if you want to push a PR. It is a bit scary but to be honest guessing the normal user always is, so this is better than what we had before. Only thing I would change in the function you proposed is:

1. explain why you are blacklisting those shells (nobody and snap* users I assume)
2. Favour users with shell /bin/bash
3. add a warning when it is used to guestimate the normal user, so that one is not left wondering why the user is weird, you can wrap it with a decorator if you want