Can't run build-time tests in a chroot or unprivileged container

[smcv]

Operating System

Debian unstable

XDG Desktop Portal version

Other

XDG Desktop Portal version (Other)

1.19.0

Desktop Environment

Other

Desktop Environment (Other)

None (non-interactive automated build)

Expected Behavior

Tests either pass, or are skipped

Current Behavior

test-portals-notification fails and times out

Steps to Reproduce

1. Configure with -Dsandboxed-image-validation=enabled
2. Build in a chroot or an unprivileged container. bwrap is present, but cannot be used in this environment, either because as we know it doesn't work in a chroot (Failures in chroot containers/bubblewrap#135) or because CAP_SYS_ADMIN is not in the bounding set (bubblewrap inside unprivileged docker containers/bubblewrap#505)
3. Run build-time tests (meson test)

Anything else we should know?

Debian has historically done all builds as an unprivileged user in a chroot environment, although the official autobuilders are moving towards doing builds in a container as a way to protect the host system better.

Unprivileged containers like Podman generally exclude CAP_SYS_ADMIN from the capability bounding set inside the container, because it is believed that CAP_SYS_ADMIN inside the container is likely to be enough to let the container payload elevate privileges, gaining arbitrary code execution outside the container as the same unprivileged user who started it.