From 7cf17f56f4373f3fb71eeeb6a7e2c21db862b56a Mon Sep 17 00:00:00 2001
From: eldritch horrors <pennae@lix.systems>
Date: Mon, 22 Dec 2025 23:31:06 +0100
Subject: [PATCH] tests/f2: add marker for tests requiring a full sandbox

Change-Id: Ia96651273510867524814c0ce10b08aa8d655181
---
 tests/functional2/pyproject.toml          |  2 ++
 tests/functional2/testlib/fixtures/nix.py | 14 ++++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/tests/functional2/pyproject.toml b/tests/functional2/pyproject.toml
index 96c20aa91..0904083ed 100644
--- a/tests/functional2/pyproject.toml
+++ b/tests/functional2/pyproject.toml
@@ -6,6 +6,8 @@ requires-python = ">=3.12"
 [tool.pytest.ini_options]
 addopts = "-p no:xonsh"
 
+markers = ["full_sandbox: test requires a fully isolated sandbox"]
+
 # xfail tests should fail when not failing as described
 xfail_strict = true
 
diff --git a/tests/functional2/testlib/fixtures/nix.py b/tests/functional2/testlib/fixtures/nix.py
index 1e8d89a8b..5f17ccbd9 100644
--- a/tests/functional2/testlib/fixtures/nix.py
+++ b/tests/functional2/testlib/fixtures/nix.py
@@ -8,6 +8,7 @@ from textwrap import dedent
 from typing import Any, Literal
 from collections.abc import Callable, Generator
 import shutil
+import subprocess
 import logging
 
 import pytest
@@ -277,6 +278,19 @@ class Nix:
         return res.stdout_plain
 
 
+_fully_sandboxed = (
+    sys.platform == "linux"
+    and Path("/proc/self/ns/user").is_symlink()
+    and subprocess.run(["unshare", "--user", "--mount", "--pid", "true"]).returncode == 0
+)
+
+
+def pytest_runtest_setup(item: Any):
+    for mark in item.iter_markers(name="full_sandbox"):
+        if not _fully_sandboxed:
+            pytest.skip(f"{sys.platform} does not support full sandboxing")
+
+
 @pytest.fixture
 def nix(tmp_path: Path, env: ManagedEnv, logger: logging.Logger) -> Generator[Nix, Any, None]:
     """