The test does potentially destructive operations to the OS, via augenrules --load, touching the kernel audit subsystem. Even though we backup/restore the audit rules, if something fails (the load after restore seems to fail on CentOS Stream), the OS is damaged for any subsequent tests.
Further, touching kernel auditing subsystem is not really compatible with containers, it talks directly to the un-namespaced kernel.
For the same reasons as #658 and #657, the test should just use a VM -- a generic snapshotted VM is fine (reused from other tests), so the test is still fast, but safe and compatible.
The test does potentially destructive operations to the OS, via
augenrules --load, touching the kernel audit subsystem. Even though we backup/restore the audit rules, if something fails (the load after restore seems to fail on CentOS Stream), the OS is damaged for any subsequent tests.Further, touching kernel auditing subsystem is not really compatible with containers, it talks directly to the un-namespaced kernel.
For the same reasons as #658 and #657, the test should just use a VM -- a generic snapshotted VM is fine (reused from other tests), so the test is still fast, but safe and compatible.