2 files changed, 27 insertions, 2 deletions

diff --git a/debian/changelog b/debian/changelog
index e9b297f26..ea47c39ad 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -136,6 +136,8 @@ openssh (1:7.4p1-1) UNRELEASED; urgency=medium
     the upstream default), and document that setting ServerAliveInterval to
     300 by default if BatchMode is set is Debian-specific (closes: #765630).
   * Build gnome-ssh-askpass with GTK+ 3 (LP: #801187).
+  * When running regression tests under autopkgtest, use a non-root user
+    with passwordless sudo.
 
  -- Colin Watson <cjwatson@debian.org>  Mon, 05 Dec 2016 19:31:33 +0000
 
diff --git a/debian/tests/regress b/debian/tests/regress
index 253541ad5..846482d62 100755
--- a/debian/tests/regress
+++ b/debian/tests/regress
@@ -1,10 +1,33 @@
 #! /bin/sh
 set -e
 
+if [ "$(id -un)" != openssh-tests ]; then
+        TMP="$ADTTMP/user"
+
+        cleanup () {
+                rm -rf "$TMP"
+                rm -f /etc/sudoers.d/openssh-tests
+                if id openssh-tests >/dev/null 2>&1; then
+                        deluser --remove-home openssh-tests
+                fi
+        }
+        trap cleanup EXIT
+
+        adduser --disabled-password --gecos 'OpenSSH tests' openssh-tests
+        cat >/etc/sudoers.d/openssh-tests <<EOF
+openssh-tests ALL = (ALL:ALL) NOPASSWD: ALL
+EOF
+        chmod 440 /etc/sudoers.d/openssh-tests
+        mkdir -p "$TMP"
+        chown openssh-tests:openssh-tests "$TMP"
+        sudo -u openssh-tests env TMP="$TMP" "$0" "$@"
+        exit "$?"
+fi
+
 # Don't use "make tests"; we want to test the installed version.
 
-cp -a . "$ADTTMP/tree"
-cd "$ADTTMP/tree"
+cp -a . "$TMP/tree"
+cd "$TMP/tree"
 
 # We aren't actually going to use most of this build, but we need a basic
 # build tree in place in order to be able to build the regression tests.