From f481d2098db6c0b9e5e6547ce469b0fed55fb2f3 Mon Sep 17 00:00:00 2001
From: Jake Petroules <jake.petroules@apple.com>
Date: Fri, 13 Jun 2025 12:11:51 -0700
Subject: [PATCH] Make testSubprocessPlatfomOptionsPreSpawnProcessConfigurator
 more robust

This test requires root since setgid is a privileged operation.

Closes #27
---
 .../SubprocessTests+Linux.swift               | 23 ++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/Tests/SubprocessTests/SubprocessTests+Linux.swift b/Tests/SubprocessTests/SubprocessTests+Linux.swift
index fc801d6..e5f20de 100644
--- a/Tests/SubprocessTests/SubprocessTests+Linux.swift
+++ b/Tests/SubprocessTests/SubprocessTests+Linux.swift
@@ -27,17 +27,34 @@ import Testing
 // MARK: PlatformOption Tests
 @Suite(.serialized)
 struct SubprocessLinuxTests {
-    @Test func testSubprocessPlatformOptionsPreSpawnProcessConfigurator() async throws {
+    @Test(
+        .enabled(
+            if: getgid() == 0,
+            "This test requires root privileges"
+        )
+    )
+    func testSubprocessPlatformOptionsPreSpawnProcessConfigurator() async throws {
         var platformOptions = PlatformOptions()
         platformOptions.preSpawnProcessConfigurator = {
-            setgid(4321)
+            guard setgid(4321) == 0 else {
+                // Returns EPERM when:
+                //   The calling process is not privileged (does not have the
+                //   CAP_SETGID capability in its user namespace), and gid does
+                //   not match the real group ID or saved set-group-ID of the
+                //   calling process.
+                perror("setgid")
+                abort()
+            }
         }
         let idResult = try await Subprocess.run(
             .path("/usr/bin/id"),
             arguments: ["-g"],
             platformOptions: platformOptions,
-            output: .string
+            output: .string,
+            error: .string
         )
+        let error = try #require(idResult.standardError)
+        try #require(error == "")
         #expect(idResult.terminationStatus.isSuccess)
         let id = try #require(idResult.standardOutput)
         #expect(