cmdmod: fix runas and group in run_chroot

salt/modules/cmdmod.py

@@ -3132,14 +3132,20 @@ def run_chroot(
 
     if isinstance(cmd, (list, tuple)):
         cmd = " ".join([six.text_type(i) for i in cmd])
-    cmd = "chroot {0} {1} -c {2}".format(root, sh_, _cmd_quote(cmd))
+
+    # If runas and group are provided, we expect that the user lives
+    # inside the chroot, not outside.
+    if runas:
+        userspec = "--userspec {}:{}".format(runas, group if group else "")
+    else:
+        userspec = ""
+
+    cmd = "chroot {} {} {} -c {}".format(userspec, root, sh_, _cmd_quote(cmd))
 
     run_func = __context__.pop("cmd.run_chroot.func", run_all)
 
     ret = run_func(
         cmd,
-        runas=runas,
-        group=group,
         cwd=cwd,
         stdin=stdin,
         shell=shell,

tests/unit/modules/test_cmdmod.py

@@ -452,6 +452,21 @@ def test_run_cwd_doesnt_exist_issue_7154(self):
         else:
             raise RuntimeError
 
+    @skipIf(salt.utils.platform.is_windows(), "Do not run on Windows")
+    @skipIf(salt.utils.platform.is_darwin(), "Do not run on MacOS")
+    def test_run_cwd_in_combination_with_runas(self):
+        """
+        cmd.run executes command in the cwd directory
+        when the runas parameter is specified
+        """
+        cmd = "pwd"
+        cwd = "/tmp"
+        runas = os.getlogin()
+
+        with patch.dict(cmdmod.__grains__, {"os": "Darwin", "os_family": "Solaris"}):
+            stdout = cmdmod._run(cmd, cwd=cwd, runas=runas).get("stdout")
+        self.assertEqual(stdout, cwd)
+
     def test_run_all_binary_replace(self):
         """
         Test for failed decoding of binary data, for instance when doing
@@ -605,3 +620,38 @@ def test_run_chroot_mount_bind(self):
                 cmdmod.run_chroot("/mnt", "cmd", binds=["/var"])
                 self.assertEqual(mock_mount.call_count, 4)
                 self.assertEqual(mock_umount.call_count, 4)
+
+    @skipIf(salt.utils.platform.is_windows(), "Skip test on Windows")
+    def test_run_chroot_runas(self):
+        """
+        Test run_chroot when a runas parameter is provided
+        """
+        with patch.dict(
+            cmdmod.__salt__, {"mount.mount": MagicMock(), "mount.umount": MagicMock()}
+        ):
+            with patch("salt.modules.cmdmod.run_all") as run_all_mock:
+                cmdmod.run_chroot("/mnt", "ls", runas="foobar")
+        run_all_mock.assert_called_with(
+            "chroot --userspec foobar: /mnt /bin/sh -c ls",
+            bg=False,
+            clean_env=False,
+            cwd=None,
+            env=None,
+            ignore_retcode=False,
+            log_callback=None,
+            output_encoding=None,
+            output_loglevel="quiet",
+            pillar=None,
+            pillarenv=None,
+            python_shell=True,
+            reset_system_locale=True,
+            rstrip=True,
+            saltenv="base",
+            shell="/bin/bash",
+            stdin=None,
+            success_retcodes=None,
+            template=None,
+            timeout=None,
+            umask=None,
+            use_vt=False,
+        )