fix(e2e): verify user bus access

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Author: ericksoa

.github/workflows/e2e.yaml

@@ -1509,8 +1509,8 @@ jobs:
               echo "::error::Qualification systemd user bus socket unit is not active" >&2
               exit 1
             }
-          [[ -S "$runtime_dir/bus" && ! -L "$runtime_dir/bus" && "$(stat -c '%u' "$runtime_dir/bus")" == "$uid" ]] || {
-            echo "::error::Qualification systemd user bus is missing or invalid" >&2
+          sudo -u "$account" /usr/bin/test -S "$runtime_dir/bus" || {
+            echo "::error::Qualification systemd user bus is not accessible to the execution account" >&2
             exit 1
           }
           storage_config_directory="/run/nemoclaw-native-runtime-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${uid}"
@@ -1965,8 +1965,8 @@ jobs:
               echo "::error::Qualification systemd user bus socket unit did not restart after installer isolation" >&2
               exit 1
             }
-          [[ -S "$RUNTIME_DIRECTORY/bus" && ! -L "$RUNTIME_DIRECTORY/bus" && "$(stat -c '%u' "$RUNTIME_DIRECTORY/bus")" == "$ACCOUNT_UID" ]] || {
-            echo "::error::Qualification systemd user bus did not restart after installer isolation" >&2
+          sudo -u "$ACCOUNT" /usr/bin/test -S "$RUNTIME_DIRECTORY/bus" || {
+            echo "::error::Qualification systemd user bus is not accessible after installer isolation" >&2
             exit 1
           }
           sudo test -d "$INSTALLER_RECEIPT_PARENT/receipts" || {

test/e2e/support/native-runtime-qualification-producer-workflow.test.ts

@@ -307,9 +307,11 @@ describe("native runtime qualification producer workflow", () => {
     expect(boundary.run).toContain("/usr/bin/systemctl --user start dbus.socket");
     expect(boundary.run).toContain("/usr/bin/systemctl --user is-active --quiet dbus.socket");
     expect(boundary.run).toContain("Qualification systemd user bus socket unit is not active");
-    expect(boundary.run).toContain("stat -c '%u' \"$runtime_dir/bus\"");
-    expect(boundary.run).not.toContain("stat -c '%u:%g' \"$runtime_dir/bus\"");
-    expect(boundary.run).toContain("Qualification systemd user bus is missing or invalid");
+    expect(boundary.run).toContain('sudo -u "$account" /usr/bin/test -S "$runtime_dir/bus"');
+    expect(boundary.run).not.toContain("stat -c '%u' \"$runtime_dir/bus\"");
+    expect(boundary.run).toContain(
+      "Qualification systemd user bus is not accessible to the execution account",
+    );
     expect(boundary.run).toContain('sudo -u "$account" env -i');
     expect(boundary.run).toContain('CONTAINERS_CONF="$containers_config"');
     expect(boundary.run).toContain('CONTAINERS_STORAGE_CONF="$storage_config"');
@@ -376,8 +378,13 @@ describe("native runtime qualification producer workflow", () => {
     expect(installer.run).toContain('sudo chown "$ACCOUNT_UID:$ACCOUNT_GID"');
     expect(installer.run).toContain("/usr/bin/systemctl --user start dbus.socket");
     expect(installer.run).toContain("Qualification systemd user bus socket unit did not restart");
-    expect(installer.run).toContain("stat -c '%u' \"$RUNTIME_DIRECTORY/bus\"");
-    expect(installer.run).not.toContain("stat -c '%u:%g' \"$RUNTIME_DIRECTORY/bus\"");
+    expect(installer.run).toContain(
+      'sudo -u "$ACCOUNT" /usr/bin/test -S "$RUNTIME_DIRECTORY/bus"',
+    );
+    expect(installer.run).not.toContain("stat -c '%u' \"$RUNTIME_DIRECTORY/bus\"");
+    expect(installer.run).toContain(
+      "Qualification systemd user bus is not accessible after installer isolation",
+    );
     expect(installer.env?.CONTAINERS_CONFIG).toBe(
       "${{ steps.boundary.outputs.containers_config }}",
     );