Fix #4233: mkosi runs into permission errors even when running as root

mkosi/sandbox.py

@@ -799,7 +799,7 @@ def acquire_privileges(
         have_effective_cap(CAP_SYS_ADMIN)
         and identity
         and (not foreign or have_effective_cap(CAP_CHOWN))
-        and not delegate
+        and (not delegate or (os.getuid() == 0 and os.getgid() == 0))
         and (not become_root or (os.getuid() == 0 and os.getgid() == 0))
     ):
         return False

tests/test_sandbox.py

@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+from unittest import mock
+
+from mkosi.sandbox import acquire_privileges
+
+
+def test_acquire_privileges_root_with_delegate_skips_userns() -> None:
+    """Running as root with delegate>0 should not enter a user namespace.
+
+    Regression test for https://github.com/systemd/mkosi/issues/4233:
+    when mkosi runs as root, acquire_privileges(foreign=True, delegate=3)
+    must return False (skip namespace entry) so that subsequent calls to
+    ensure_directories_exist() retain host-root filesystem access.
+    """
+    with (
+        mock.patch("mkosi.sandbox.have_effective_cap", return_value=True),
+        mock.patch("os.getuid", return_value=0),
+        mock.patch("os.getgid", return_value=0),
+    ):
+        result = acquire_privileges(foreign=True, delegate=3)
+    assert result is False