test: Add integration test for cockpit-desktop starting a privileged …

…bridge

Reproduces https://bugzilla.redhat.com/show_bug.cgi?id=1820538 and
verifies the fix.

Closes #14324

test/verify/check-connection

@@ -661,6 +661,25 @@ G_MESSAGES_DEBUG=all XDG_CONFIG_DIRS=/usr/local %s -p 9999 -a 127.0.0.90 --local
                 # should clean up processes
                 self.assertEqual(m.execute("! pgrep -a cockpit-ws && ! pgrep -a cockpit-bridge"), "")
 
+        if m.image != "rhel-8-3-distropkg":  # fixed in PR #14324
+            # cockpit-desktop can start a privileged bridge through polkit
+            # we don't have an agent, so just allow the privilege without interactive authentication
+            m.write("/etc/polkit-1/localauthority/50-local.d/test.pkla", r"""
+[Testing without an agent]
+Identity=unix-user:admin
+Action=org.cockpit-project.cockpit.root-bridge
+ResultAny=yes
+ResultInactive=yes
+ResultActive=yes""")
+            m.write(r"/tmp/browser.sh", """#!/bin/sh -e
+curl --silent --compressed -o /tmp/out.html "$@"
+# wait until privileged bridge starts
+until pgrep -f cockpit-bridge.*--privileged; do sleep 1; done
+""")
+            m.execute("chmod 755 /tmp/browser.sh")
+            m.execute("su - -c 'BROWSER=/tmp/browser.sh %s system' admin" % cockpit_desktop)
+            self.assertIn('id="overview"', m.execute("cat /tmp/out.html"))
+
         self.allow_journal_messages("couldn't register polkit authentication agent.*")
         self.allow_journal_messages("Refusing to render service to dead parents.")
         self.allow_journal_messages(".*No authentication agent found.*")