failure during test setup: chmod on a symlink fails if the symlink's target directory is owned by root

[tungol]

terraform-plugin-testing version

github.com/hashicorp/terraform-plugin-testing v1.3.0

Relevant provider source code

This issue is orthogonal to the actual code of the provider. Minimal reproduction is the bare minimum needed to get a test case to run. What is important is the presence of a directory containing test data,

Terraform Configuration Files

Not applicable.

Expected Behavior

I expect that the tests can run, even if the original files are owned by root and we're not currently running as root. This is indeed the case if no extra directories are present - only read access is needed to the original files, and the tests pass. Adding an extra directory creates a failure unexpectedly.

In a CI environment, it's relatively easy to accidentally create the situation where the files are owned by root but we're running the tests as a different user. This shouldn't cause the acceptance tests to fail.

Actual Behavior

If an additional directory is present, the test setup process will create a symlink to that directory and then try to chmod that symlink. If the original target directory is owned by root, the call to chmod will fail, but it's not clear to me that we couldn't proceed with the test anyway since the read access is there.

Steps to Reproduce

This dockerfile shows the error:

FROM ubuntu:jammy

RUN mkdir /home/ubuntu-user
RUN useradd ubuntu-user
RUN chown ubuntu-user /home/ubuntu-user

RUN apt-get update
RUN apt-get install -y curl
RUN curl -L https://go.dev/dl/go1.20.6.linux-amd64.tar.gz | tar -C /usr/local -xzf -

WORKDIR /home/ubuntu-user
USER ubuntu-user
RUN mkdir tf-test-error
WORKDIR /home/ubuntu-user/tf-test-error
RUN echo 'package main; import ("context"; "github.com/hashicorp/terraform-plugin-framework/datasource"; "github.com/hashicorp/terraform-plugin-framework/provider"; "github.com/hashicorp/terraform-plugin-framework/resource"); type myProvider struct{}; func (p *myProvider) Metadata(_ context.Context, _ provider.MetadataRequest, _ *provider.MetadataResponse) {}; func (p *myProvider) Schema(_ context.Context, _ provider.SchemaRequest, _ *provider.SchemaResponse) {}; func (p *myProvider) Configure(_ context.Context, _ provider.ConfigureRequest, _ *provider.ConfigureResponse) {}; func (p *myProvider) DataSources(_ context.Context) []func() datasource.DataSource {return []func() datasource.DataSource{}}; func (p *myProvider) Resources(_ context.Context) []func() resource.Resource {return []func() resource.Resource{}}' > main.go
RUN echo 'package main; import ("github.com/hashicorp/terraform-plugin-framework/providerserver"; "github.com/hashicorp/terraform-plugin-go/tfprotov6"; "github.com/hashicorp/terraform-plugin-testing/helper/resource"; "testing"); func TestAcc(t *testing.T) {resource.Test(t, resource.TestCase{ProtoV6ProviderFactories: map[string]func() (tfprotov6.ProviderServer, error){"empty": providerserver.NewProtocol6WithError(&myProvider{})}, Steps: []resource.TestStep{{Config: " "}}})}' > main_test.go
RUN mkdir test_data
RUN echo "important stuff" > test_data/datafile
USER root
RUN chown root test_data
USER ubuntu-user
RUN PATH=$PATH:/usr/local/go/bin go mod init test/tf-test-error
RUN PATH=$PATH:/usr/local/go/bin go mod tidy
RUN PATH=$PATH:/usr/local/go/bin TF_ACC=1 go test ./... -v

Building this fails with:

 > [18/18] RUN PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/go/bin TF_ACC=1 go test ./... -v:                                                                                                               
#21 23.33 === RUN   TestAcc                                                                                                                                                                                                                 
#21 25.94     main_test.go:1: failed to create new working directory: unable to symlink directory "/home/ubuntu-user/tf-test-error/test_data" to "/tmp/plugintest744537227/work3117081572/test_data": unable to set "/tmp/plugintest744537227/work3117081572/test_data" permissions: chmod /tmp/plugintest744537227/work3117081572/test_data: operation not permitted                                                                                                                   
#21 25.96 --- FAIL: TestAcc (2.63s)                                                                                                                                                                                                         
#21 25.96 FAIL
#21 25.96 FAIL	test/tf-test-error	2.636s
#21 25.97 FAIL

References