Problem: test_pair_tcp_cap_net_admin requires sudo but is enabled by default in CMake

Solution: add an option to enable it, and default to false. Enable it in
the CI so we don't lose coverage, as it works on Travis.

Fixes #3725

builds/cmake/ci_build.sh

@@ -30,6 +30,7 @@ CMAKE_OPTS+=("-DCMAKE_INSTALL_PREFIX:PATH=${BUILD_PREFIX}")
 CMAKE_OPTS+=("-DCMAKE_PREFIX_PATH:PATH=${BUILD_PREFIX}")
 CMAKE_OPTS+=("-DCMAKE_LIBRARY_PATH:PATH=${BUILD_PREFIX}/lib")
 CMAKE_OPTS+=("-DCMAKE_INCLUDE_PATH:PATH=${BUILD_PREFIX}/include")
+CMAKE_OPTS+=("-DENABLE_CAPSH=ON")
 
 if [ "$CLANG_FORMAT" != "" ] ; then
     CMAKE_OPTS+=("-DCLANG_FORMAT=${CLANG_FORMAT}")

tests/CMakeLists.txt

@@ -85,14 +85,17 @@ if(ZMQ_HAVE_CURVE)
     test_security_curve)
 endif()
 
-find_program(CAPSH_PROGRAM NAMES capsh)
+option(ENABLE_CAPSH "Run tests that require sudo and capsh (for cap_net_admin)" OFF)
+if(ENABLE_CAPSH)
+  find_program(CAPSH_PROGRAM NAMES capsh)
 
-if (CAPSH_PROGRAM)
-    list(APPEND tests
-        test_pair_tcp_cap_net_admin
-        )
-else()
-    message(STATUS "capsh not found, skipping tests that require CAP_NET_ADMIN")
+  if (CAPSH_PROGRAM)
+      list(APPEND tests
+          test_pair_tcp_cap_net_admin
+          )
+  else()
+      message(STATUS "capsh not found, skipping tests that require CAP_NET_ADMIN")
+  endif()
 endif()
 
 if(ZMQ_HAVE_IPC)