From 2973d906700f81b033de5c9629b62b85349b5601 Mon Sep 17 00:00:00 2001
From: Alex Willmer <alex@moreati.org.uk>
Date: Mon, 4 Mar 2024 16:02:18 +0000
Subject: [PATCH] tests: Enable su tests under vanilla Ansible >= 2.11

cwd_show was useful when debugging these tests, worth keeping around.
---
 tests/ansible/files/cwd_show                  | 22 ++++++++++
 .../integration/become/su_password.yml        | 41 +++++++++++++++++--
 2 files changed, 59 insertions(+), 4 deletions(-)
 create mode 100755 tests/ansible/files/cwd_show

diff --git a/tests/ansible/files/cwd_show b/tests/ansible/files/cwd_show
new file mode 100755
index 00000000..42ef3194
--- /dev/null
+++ b/tests/ansible/files/cwd_show
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+# Show permissions and identities that impact the current working directory.
+# On macOS libc cwd() can return EACCES after su or sudo.
+# See also
+#   - https://github.com/ansible/ansible/pull/7078
+#   - https://github.com/python/cpython/issues/115911
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+whoami
+groups
+pwd
+
+d=$(pwd)
+while [[ "$d" != "/" && -n "$d" ]]; do
+    ls -ld "$d"
+    d=$(dirname "$d")
+done
+ls -ld /
diff --git a/tests/ansible/integration/become/su_password.yml b/tests/ansible/integration/become/su_password.yml
index bd6a0aee..52d420db 100644
--- a/tests/ansible/integration/become/su_password.yml
+++ b/tests/ansible/integration/become/su_password.yml
@@ -1,5 +1,4 @@
 # Verify passwordful su behaviour
-  # Ansible can't handle this on OS X. I don't care why.
 
 - name: integration/become/su_password.yml
   hosts: test-targets
@@ -44,20 +43,54 @@
         fail_msg: out={{out}}
       when: is_mitogen
 
-    - name: Ensure password su succeeds.
+    - name: Ensure password su with chdir succeeds
       shell: whoami
+      args:
+        chdir: ~mitogen__user1
       become: true
       become_user: mitogen__user1
       register: out
       vars:
         ansible_become_pass: user1_password
-      when: is_mitogen
+      when:
+        # https://github.com/ansible/ansible/pull/70785
+        - ansible_facts.distribution not in ["MacOSX"]
+          or ansible_version.full is version("2.11", ">=", strict=True)
+          or is_mitogen
 
     - assert:
         that:
           - out.stdout == 'mitogen__user1'
         fail_msg: out={{out}}
-      when: is_mitogen
+      when:
+        # https://github.com/ansible/ansible/pull/70785
+        - ansible_facts.distribution not in ["MacOSX"]
+          or ansible_version.full is version("2.11", ">=", strict=True)
+          or is_mitogen
+
+    - name: Ensure password su without chdir succeeds
+      shell: whoami
+      become: true
+      become_user: mitogen__user1
+      register: out
+      vars:
+        ansible_become_pass: user1_password
+      when:
+        # https://github.com/ansible/ansible/pull/70785
+        - ansible_facts.distribution not in ["MacOSX"]
+          or ansible_version.full is version("2.11", ">=", strict=True)
+          or is_mitogen
+
+    - assert:
+        that:
+          - out.stdout == 'mitogen__user1'
+        fail_msg: out={{out}}
+      when:
+        # https://github.com/ansible/ansible/pull/70785
+        - ansible_facts.distribution not in ["MacOSX"]
+          or ansible_version.full is version("2.11", ">=", strict=True)
+          or is_mitogen
+
   tags:
     - su
     - su_password