From eae498d84101ac30e5647ab2a673286fadf4d449 Mon Sep 17 00:00:00 2001
From: Srikanth Myakam <374767+SRIKKANTH@users.noreply.github.com>
Date: Tue, 14 Jul 2026 21:03:02 +0530
Subject: [PATCH] Fix: prevent needrestart prompt from hanging CVM attestation
 tool install on Ubuntu 22.04+
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Problem
AzureCVMAttestationTestSuite.verify_azure_cvm_attestation_report fails during tool setup with:

On Ubuntu 22.04+, the tool's install.sh runs apt-get install, which triggers needrestart in interactive mode. It renders a whiptail dialog — "Daemons using outdated libraries — Which services should be restarted?" — that blocks on stdin. Because LISA runs non-interactively (no TTY), the dialog never gets input and the command runs until the 600s timeout, failing the test before any attestation logic executes.

Root cause
The hang is inside AzureCVMAttestationTests._install(), not in the attestation logic. install.sh invokes apt through its own inner sudo, which resets the environment (env_reset in sudoers). This strips process-level mitigations like NEEDRESTART_MODE=a / DEBIAN_FRONTEND=noninteractive, so they don't reach the apt call that spawns needrestart.

Fix
Before running install.sh, force needrestart into automatic mode by appending $nrconf{restart} = "a"; to the end of /etc/needrestart/needrestart.conf. This is read from disk on every needrestart invocation (immune to the inner-sudo env reset), and as a perl config the last assignment wins — guaranteeing the override regardless of the packaged default. Also moved sudo from the inline command string to the sudo=True parameter for consistency with LISA conventions.
---
 .../testsuites/cvm/cvm_attestation_tool.py      | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/lisa/microsoft/testsuites/cvm/cvm_attestation_tool.py b/lisa/microsoft/testsuites/cvm/cvm_attestation_tool.py
index 7f13cb1f2b..d0d8f0fb14 100644
--- a/lisa/microsoft/testsuites/cvm/cvm_attestation_tool.py
+++ b/lisa/microsoft/testsuites/cvm/cvm_attestation_tool.py
@@ -102,9 +102,24 @@ def _clone_repo(self) -> None:
 
     def _install(self) -> bool:
         self._clone_repo()
+        # install.sh runs apt via its own inner `sudo`, which resets the
+        # environment and drops NEEDRESTART_MODE/DEBIAN_FRONTEND. On Ubuntu
+        # 22.04+ that makes needrestart show the interactive "Which services
+        # should be restarted?" dialog, hanging the install until it times out.
+        # Force needrestart into automatic mode by appending the setting to the
+        # end of its config file (last assignment wins in the perl config);
+        # this is read from disk and so survives the inner sudo.
+        needrestart_conf = "/etc/needrestart/needrestart.conf"
         self.node.execute(
-            "sudo ./install.sh",
+            f"test -f {needrestart_conf} && "
+            f"echo '$nrconf{{restart}} = \"a\";' >> {needrestart_conf} || true",
             shell=True,
+            sudo=True,
+        )
+        self.node.execute(
+            "./install.sh",
+            shell=True,
+            sudo=True,
             cwd=self.attestation_dir,
         )
         return self._check_exists()