From ba7253e2c6fe153877882549cc6799144adb5b00 Mon Sep 17 00:00:00 2001
From: joshsiv-mulga <mrk@mulgadc.com>
Date: Tue, 2 Jun 2026 19:45:53 +1000
Subject: [PATCH] ci(e2e): fix Start Packet Capture EACCES + PID-tracking on
 tcpdump (siv-167)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two bugs in afd63ed9:

1. `sudo mkdir` makes /tmp/spinifex-diag root-owned 0755. The
   subsequent `> /tmp/spinifex-diag/tcpdump.log` is performed by
   the calling tf-user shell BEFORE sudo gets the command, failing
   with Permission denied. action shell runs with `set -e` so the
   step aborts.

2. `sudo nohup ... &; echo $!` captures the wrong PID — `$!` is the
   backgrounded sudo, which may exit when its target dies, leaving
   stale tcpdump.pid.

Fixes:
- chmod 0777 on /tmp/spinifex-diag after creating it (next steps'
  redirects from tf-user shell now work).
- Wrap the tcpdump launch in `sudo bash -c '...'` so backgrounding
  and `$!` happen inside the sudo'd shell — `$!` is the actual
  tcpdump PID (nohup execs, sudo bash holds it). Captures stdin
  to /dev/null, stdout/stderr to /tmp/spinifex-diag/tcpdump.log.
- sleep 2 (was 1) — gives tcpdump time to fully init pcap header.
- Hard fail (exit 1) if PID is missing or process dead, so the
  step's failure is visible instead of a silent green.

bash -n verified.
---
 .github/workflows/e2e.yml | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index a10825f37..aadf46b54 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -87,18 +87,24 @@ jobs:
           ssh -o StrictHostKeyChecking=no -i "$SSH_KEY" tf-user@${WAN_IP} 'bash -s' <<'REMOTE'
           set -x
           sudo mkdir -p /tmp/spinifex-diag
-          sudo rm -f /tmp/spinifex-diag/br-wan.pcap /tmp/spinifex-diag/tcpdump.pid
-          sudo nohup tcpdump -i br-wan -nn -s 0 -U \
-            -w /tmp/spinifex-diag/br-wan.pcap \
-            '(tcp port 22 or tcp port 80 or tcp port 443 or tcp port 9999) or arp' \
-            > /tmp/spinifex-diag/tcpdump.log 2>&1 &
-          echo $! | sudo tee /tmp/spinifex-diag/tcpdump.pid
-          sleep 1
-          if sudo kill -0 "$(cat /tmp/spinifex-diag/tcpdump.pid)" 2>/dev/null; then
-            echo "tcpdump running PID=$(cat /tmp/spinifex-diag/tcpdump.pid)"
+          sudo chmod 0777 /tmp/spinifex-diag
+          sudo rm -f /tmp/spinifex-diag/br-wan.pcap /tmp/spinifex-diag/tcpdump.pid /tmp/spinifex-diag/tcpdump.log
+          sudo bash -c '
+            nohup tcpdump -i br-wan -nn -s 0 -U \
+              -w /tmp/spinifex-diag/br-wan.pcap \
+              "(tcp port 22 or tcp port 80 or tcp port 443 or tcp port 9999) or arp" \
+              </dev/null >/tmp/spinifex-diag/tcpdump.log 2>&1 &
+            echo $! > /tmp/spinifex-diag/tcpdump.pid
+          '
+          sleep 2
+          PID=$(cat /tmp/spinifex-diag/tcpdump.pid 2>/dev/null || echo "")
+          if [ -n "$PID" ] && sudo kill -0 "$PID" 2>/dev/null; then
+            echo "tcpdump running PID=$PID"
+            ls -la /tmp/spinifex-diag/
           else
             echo "tcpdump failed to start"
-            sudo cat /tmp/spinifex-diag/tcpdump.log
+            cat /tmp/spinifex-diag/tcpdump.log 2>&1 || true
+            exit 1
           fi
           REMOTE