run nft tests in netns

.github/workflows/rust.yml

@@ -26,5 +26,5 @@ jobs:
     - name: Run tests
       run: cargo test --verbose
     - name: Run tests (rootful)
-      run: nft --version; sudo -E $(which cargo) test --verbose -- --ignored
+      run: sudo -E env "PATH=$PATH" $(which cargo) test --verbose -- --ignored
 

tests/run_nft_tests.sh

@@ -0,0 +1,18 @@
+#!/bin/sh -e
+NETNS=nft-$(cat /proc/sys/kernel/random/uuid)
+
+function nsexec {
+  ip netns exec $NETNS $@
+}
+
+function cleanup {
+  ip netns delete "$NETNS"
+  exit 0
+}
+trap cleanup EXIT
+
+# create net namespace
+(ip netns ls | grep -Fx "$NETNS" 2>/dev/null) || ip netns add "$NETNS"
+
+nft --version;
+nsexec cargo test --verbose -- --ignored