[Change] tests: de-duplicate Dockerfile bake via opt-in helper; issue #485

[Change] tests/helpers/uat-lmd.bash: remove redundant
        scan_ignore_root="0" reset from uat_lmd_install (already
        baked by tests/Dockerfile*); add opt-in
        uat_lmd_disable_root_filter helper so each UAT caller
        explicitly documents its dependency on the override
        (effective value unchanged — Dockerfile bake remains);
        issue #485
[Change] tests/uat/*.bats: migrate 19 callers to invoke
        uat_lmd_disable_root_filter after uat_lmd_install,
        preserving prior test semantics; issue #485

Author: rfxn

CHANGELOG

@@ -86,6 +86,15 @@ v2.0.1 | Mar 25 2026:
 
 [Change] monitor: log filtered-cycle event count when all events dropped by
          tier-2 scan filter (_event_count > 0 but _tot_files == 0); issue #485
+[Change] tests/helpers/uat-lmd.bash: de-duplicate Dockerfile-level
+         scan_ignore_root="0" bake — remove redundant sed from
+         uat_lmd_install and add opt-in uat_lmd_disable_root_filter
+         helper so each UAT caller explicitly documents its
+         dependency on the override; all 19 existing UAT callers
+         migrated (effective value unchanged — still 0 via
+         Dockerfile bake + explicit helper call); unblocks issue-485
+         UAT which re-sets scan_ignore_root=1 to exercise the
+         production default; issue #485
 [Change] Vendored libs synced to canonical: tlog_lib 2.0.6, alert_lib 1.0.7, elog_lib 1.0.6, pkg_lib 1.0.10 (zero functional change)
 [Change] Alert templates: consolidate summary into headers; drop "TOTAL" prefix from
          labels (HITS/CLEANED/QUARANTINED); add quarantine metrics; aligned column spacing

CHANGELOG.RELEASE

@@ -86,6 +86,15 @@ v2.0.1 | Mar 25 2026:
 
 [Change] monitor: log filtered-cycle event count when all events dropped by
          tier-2 scan filter (_event_count > 0 but _tot_files == 0); issue #485
+[Change] tests/helpers/uat-lmd.bash: de-duplicate Dockerfile-level
+         scan_ignore_root="0" bake — remove redundant sed from
+         uat_lmd_install and add opt-in uat_lmd_disable_root_filter
+         helper so each UAT caller explicitly documents its
+         dependency on the override; all 19 existing UAT callers
+         migrated (effective value unchanged — still 0 via
+         Dockerfile bake + explicit helper call); unblocks issue-485
+         UAT which re-sets scan_ignore_root=1 to exercise the
+         production default; issue #485
 [Change] Vendored libs synced to canonical: tlog_lib 2.0.6, alert_lib 1.0.7, elog_lib 1.0.6, pkg_lib 1.0.10 (zero functional change)
 [Change] Alert templates: consolidate summary into headers; drop "TOTAL" prefix from
          labels (HITS/CLEANED/QUARANTINED); add quarantine metrics; aligned column spacing

tests/helpers/uat-lmd.bash

@@ -26,7 +26,6 @@ uat_lmd_install() {
     sed -i 's/^email_alert=.*/email_alert="0"/' "$conf"
     sed -i 's/^scan_clamscan=.*/scan_clamscan="0"/' "$conf"
     sed -i 's/^import_config_url=.*/import_config_url=""/' "$conf"
-    sed -i 's/^scan_ignore_root=.*/scan_ignore_root="0"/' "$conf"
     sed -i 's/^scan_tmpdir_paths=.*/scan_tmpdir_paths=""/' "$conf"
 
     # Save clean config for uat_lmd_reset() if not already saved
@@ -169,3 +168,14 @@ MOCK
 
     echo "$mock_dir"
 }
+
+# uat_lmd_disable_root_filter — Explicit opt-in for scan_ignore_root=0 override.
+# The effective default in the Docker test image is scan_ignore_root=0 (baked
+# by tests/Dockerfile*). This helper de-duplicates the prior uat_lmd_install
+# reset and documents each UAT caller's dependency on that override. Phase 4's
+# issue-#485 UAT explicitly re-sets scan_ignore_root=1 via uat_lmd_set_config
+# to exercise the production default. Issue #485.
+uat_lmd_disable_root_filter() {
+    local conf="${LMD_INSTALL:-/usr/local/maldetect}/conf.maldet"
+    sed -i 's/^scan_ignore_root=.*/scan_ignore_root="0"/' "$conf"
+}

tests/uat/01-scan-quarantine.bats

@@ -12,6 +12,7 @@ TEST_DIR="/tmp/uat-lmd-test/scan-quar"
 setup_file() {
     uat_setup
     uat_lmd_install
+    uat_lmd_disable_root_filter  # preserve prior UAT semantics; issue #485
     uat_lmd_reset
     mkdir -p "$TEST_DIR"
 }

tests/uat/02-quarantine-permissions.bats

@@ -12,6 +12,7 @@ TEST_DIR="/tmp/uat-lmd-test/quar-perms"
 setup_file() {
     uat_setup
     uat_lmd_install
+    uat_lmd_disable_root_filter  # preserve prior UAT semantics; issue #485
     uat_lmd_reset
     mkdir -p "$TEST_DIR"
 }

tests/uat/03-report-management.bats

@@ -12,6 +12,7 @@ TEST_DIR="/tmp/uat-lmd-test/reports"
 setup_file() {
     uat_setup
     uat_lmd_install
+    uat_lmd_disable_root_filter  # preserve prior UAT semantics; issue #485
     uat_lmd_reset
     mkdir -p "$TEST_DIR"
 

tests/uat/04-config-overrides.bats

@@ -12,6 +12,7 @@ TEST_DIR="/tmp/uat-lmd-test/config-override"
 setup_file() {
     uat_setup
     uat_lmd_install
+    uat_lmd_disable_root_filter  # preserve prior UAT semantics; issue #485
     uat_lmd_reset
     mkdir -p "$TEST_DIR"
 }

tests/uat/05-monitor-mode.bats

@@ -15,6 +15,7 @@ MALDET_LOG="$LMD_INSTALL/logs/event_log"
 setup_file() {
     uat_setup
     uat_lmd_install
+    uat_lmd_disable_root_filter  # preserve prior UAT semantics; issue #485
     uat_lmd_reset
 
     # Skip entire file if inotifywait is not available

tests/uat/06-background-scan.bats

@@ -12,6 +12,7 @@ TEST_DIR="/tmp/uat-lmd-test/bg-scan"
 setup_file() {
     uat_setup
     uat_lmd_install
+    uat_lmd_disable_root_filter  # preserve prior UAT semantics; issue #485
     uat_lmd_reset
     mkdir -p "$TEST_DIR"
     uat_lmd_create_eicar "$TEST_DIR"

tests/uat/07-ignore-system.bats

@@ -12,6 +12,7 @@ TEST_DIR="/tmp/uat-lmd-test/ignore"
 setup_file() {
     uat_setup
     uat_lmd_install
+    uat_lmd_disable_root_filter  # preserve prior UAT semantics; issue #485
     uat_lmd_reset
     mkdir -p "$TEST_DIR"
 }