tests/f2: add marker for tests requiring a full sandbox

Change-Id: Ia96651273510867524814c0ce10b08aa8d655181

tests/functional2/pyproject.toml

@@ -6,6 +6,8 @@ requires-python = ">=3.12"
 [tool.pytest.ini_options]
 addopts = "-p no:xonsh"
 
+markers = ["full_sandbox: test requires a fully isolated sandbox"]
+
 # xfail tests should fail when not failing as described
 xfail_strict = true
 

tests/functional2/testlib/fixtures/nix.py

@@ -8,6 +8,7 @@ from textwrap import dedent
 from typing import Any, Literal
 from collections.abc import Callable, Generator
 import shutil
+import subprocess
 import logging
 
 import pytest
@@ -277,6 +278,19 @@ class Nix:
         return res.stdout_plain
 
 
+_fully_sandboxed = (
+    sys.platform == "linux"
+    and Path("/proc/self/ns/user").is_symlink()
+    and subprocess.run(["unshare", "--user", "--mount", "--pid", "true"]).returncode == 0
+)
+
+
+def pytest_runtest_setup(item: Any):
+    for mark in item.iter_markers(name="full_sandbox"):
+        if not _fully_sandboxed:
+            pytest.skip(f"{sys.platform} does not support full sandboxing")
+
+
 @pytest.fixture
 def nix(tmp_path: Path, env: ManagedEnv, logger: logging.Logger) -> Generator[Nix, Any, None]:
     """