Fix sudo usage in cmd-*

[mtalexan]

Sudo is being used directly all over the place, which doesn't work if the user is already root (something the has_privileges function checks for and supports). Add a SUDO and SUDO_W_ENV variable that evaluates to the equivalent sudo command when not root, but is blank when running as root.
Also add a sudo (overlapping) and sudo_w_env alias that map to a fake-root function defined to just run the arguments passed without any actual sudo call. This makes sure any other tools called from the cmd-* shell scripts (like python scripts) won't call real sudo with their hardcoded commands when running as root.

[openshift-ci]

Hi @mtalexan. Thanks for your PR.

I'm waiting for a coreos member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[mtalexan]

Encountered this when running the cosa container with:

podman run ... --user=root --cap-add=SYS_ADMIN ....

---

I still need access to the pkgcache-repo the rpm-ostree compose tree call creates so I can run some custom commands between the cosa fetch and cosa build and populate some things into the overrides folder dynamically based on the contents of the RPMs that were installed. I use the manifest-lock.x86_64.json and the pkgcache-repo to query the contents of what will be installed, and do a dynamic lookup on extra things I need to manually insert.

Apparently the pkgcache-repo is no longer an archive repo it seems, so when the cache/ folder is mounted into the container from the host, a non-root user in the container is unable to set the xattrs on the files in the ostree. Currently this case doesn't occur because an unprivileged container user causes the rpm-ostree compose tree command to run in runvm_with_cache, which that ensures the cache/ folder is actually part of the cache2.qcow2 file instead of mounted directly from the host. This prevents the pkgcache-repo from being accessed outside the runvm_with_cache though.

So to retain access to the pkgcache-repo between the fetch and build commands, I have to run the container as --user=root.