Capture stderr when removing app data (#7321)

remove_data ran rm without capturing stderr, so on a CalledProcessError
procerr.stderr was None and calling strip() on it raised an
AttributeError instead of logging the error. This aborted app
uninstall and backup restore with an unexpected exception.

Pipe stderr and use a clean environment, as remove_folder already does.

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mrueg

supervisor/apps/utils.py

@@ -15,6 +15,7 @@
     SECURITY_PROFILE,
 )
 from ..docker.const import Capabilities
+from ..utils import clean_env
 
 if TYPE_CHECKING:
     from .model import AppModel
@@ -103,7 +104,12 @@ def remove_data(folder: Path) -> None:
     """
     try:
         subprocess.run(
-            ["rm", "-rf", str(folder)], stdout=subprocess.DEVNULL, text=True, check=True
+            ["rm", "-rf", str(folder)],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.PIPE,
+            env=clean_env(),
+            text=True,
+            check=True,
         )
     except OSError as err:
         error_msg = str(err)

tests/apps/test_utils.py

@@ -1,11 +1,14 @@
 """Test app utility functions."""
 
-from unittest.mock import MagicMock
+from pathlib import Path
+import subprocess
+from typing import Any
+from unittest.mock import MagicMock, patch
 
 import pytest
 
 from supervisor.apps.model import AppModel
-from supervisor.apps.utils import rating_security
+from supervisor.apps.utils import rating_security, remove_data
 from supervisor.const import ATTR_PORTS, ROLE_DEFAULT, SECURITY_DEFAULT
 
 
@@ -44,3 +47,23 @@ def test_rating_security_network_exposure(
     app.with_full_access = False
 
     assert rating_security(app) == expected
+
+
+def test_remove_data_process_error(
+    caplog: pytest.LogCaptureFixture, tmp_path: Path
+) -> None:
+    """Test remove data logs the rm error output instead of raising."""
+
+    def mock_run(args: list[str], **kwargs: Any) -> None:
+        # Like subprocess.run, stderr is only captured when piped
+        stderr = (
+            "rm: cannot remove: Busy\n"
+            if kwargs.get("stderr") == subprocess.PIPE
+            else None
+        )
+        raise subprocess.CalledProcessError(1, args, stderr=stderr)
+
+    with patch("supervisor.apps.utils.subprocess.run", side_effect=mock_run):
+        remove_data(tmp_path)
+
+    assert "Can't remove app data: rm: cannot remove: Busy" in caplog.text