]>
Commit | Line | Data |
---|---|---|
281e05b6 RC |
1 | /*** |
2 | This file is part of systemd. | |
3 | ||
4 | Copyright 2014 Ronny Chevalier | |
5 | ||
6 | systemd is free software; you can redistribute it and/or modify it | |
7 | under the terms of the GNU Lesser General Public License as published by | |
8 | the Free Software Foundation; either version 2.1 of the License, or | |
9 | (at your option) any later version. | |
10 | ||
11 | systemd is distributed in the hope that it will be useful, but | |
12 | WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
14 | Lesser General Public License for more details. | |
15 | ||
16 | You should have received a copy of the GNU Lesser General Public License | |
17 | along with systemd; If not, see <http://www.gnu.org/licenses/>. | |
18 | ***/ | |
19 | ||
cc7fa4fb RC |
20 | #include <grp.h> |
21 | #include <pwd.h> | |
ff4ca461 | 22 | #include <stdio.h> |
70d7aea5 | 23 | #include <sys/prctl.h> |
ff4ca461 | 24 | #include <sys/types.h> |
281e05b6 | 25 | |
03bd70dd | 26 | #include "fileio.h" |
f4f15635 | 27 | #include "fs-util.h" |
281e05b6 | 28 | #include "macro.h" |
f4f15635 | 29 | #include "manager.h" |
281e05b6 | 30 | #include "mkdir.h" |
ff4ca461 | 31 | #include "path-util.h" |
c6878637 | 32 | #include "rm-rf.h" |
8b3aa503 | 33 | #include "test-helper.h" |
f4f15635 LP |
34 | #include "unit.h" |
35 | #include "util.h" | |
4dd4cb8f | 36 | #include "virt.h" |
281e05b6 RC |
37 | |
38 | typedef void (*test_function_t)(Manager *m); | |
39 | ||
40 | static void check(Manager *m, Unit *unit, int status_expected, int code_expected) { | |
41 | Service *service = NULL; | |
42 | usec_t ts; | |
43 | usec_t timeout = 2 * USEC_PER_SEC; | |
44 | ||
45 | assert_se(m); | |
46 | assert_se(unit); | |
47 | ||
48 | service = SERVICE(unit); | |
49 | printf("%s\n", unit->id); | |
50 | exec_context_dump(&service->exec_context, stdout, "\t"); | |
51 | ts = now(CLOCK_MONOTONIC); | |
52 | while (service->state != SERVICE_DEAD && service->state != SERVICE_FAILED) { | |
53 | int r; | |
54 | usec_t n; | |
55 | ||
56 | r = sd_event_run(m->event, 100 * USEC_PER_MSEC); | |
57 | assert_se(r >= 0); | |
58 | ||
59 | n = now(CLOCK_MONOTONIC); | |
60 | if (ts + timeout < n) { | |
61 | log_error("Test timeout when testing %s", unit->id); | |
62 | exit(EXIT_FAILURE); | |
63 | } | |
64 | } | |
65 | exec_status_dump(&service->main_exec_status, stdout, "\t"); | |
66 | assert_se(service->main_exec_status.status == status_expected); | |
67 | assert_se(service->main_exec_status.code == code_expected); | |
68 | } | |
69 | ||
70 | static void test(Manager *m, const char *unit_name, int status_expected, int code_expected) { | |
71 | Unit *unit; | |
72 | ||
73 | assert_se(unit_name); | |
74 | ||
75 | assert_se(manager_load_unit(m, unit_name, NULL, NULL, &unit) >= 0); | |
76 | assert_se(UNIT_VTABLE(unit)->start(unit) >= 0); | |
77 | check(m, unit, status_expected, code_expected); | |
78 | } | |
79 | ||
80 | static void test_exec_workingdirectory(Manager *m) { | |
81 | assert_se(mkdir_p("/tmp/test-exec_workingdirectory", 0755) >= 0); | |
82 | ||
83 | test(m, "exec-workingdirectory.service", 0, CLD_EXITED); | |
84 | ||
c6878637 | 85 | (void) rm_rf("/tmp/test-exec_workingdirectory", REMOVE_ROOT|REMOVE_PHYSICAL); |
281e05b6 RC |
86 | } |
87 | ||
88 | static void test_exec_personality(Manager *m) { | |
281e05b6 RC |
89 | #if defined(__x86_64__) |
90 | test(m, "exec-personality-x86-64.service", 0, CLD_EXITED); | |
7517f51e HB |
91 | |
92 | #elif defined(__s390__) | |
93 | test(m, "exec-personality-s390.service", 0, CLD_EXITED); | |
94 | ||
5798eb4c | 95 | #elif defined(__i386__) |
7517f51e | 96 | test(m, "exec-personality-x86.service", 0, CLD_EXITED); |
281e05b6 RC |
97 | #endif |
98 | } | |
99 | ||
100 | static void test_exec_ignoresigpipe(Manager *m) { | |
101 | test(m, "exec-ignoresigpipe-yes.service", 0, CLD_EXITED); | |
102 | test(m, "exec-ignoresigpipe-no.service", SIGPIPE, CLD_KILLED); | |
103 | } | |
104 | ||
105 | static void test_exec_privatetmp(Manager *m) { | |
106 | assert_se(touch("/tmp/test-exec_privatetmp") >= 0); | |
107 | ||
108 | test(m, "exec-privatetmp-yes.service", 0, CLD_EXITED); | |
109 | test(m, "exec-privatetmp-no.service", 0, CLD_EXITED); | |
110 | ||
111 | unlink("/tmp/test-exec_privatetmp"); | |
112 | } | |
113 | ||
114 | static void test_exec_privatedevices(Manager *m) { | |
4dd4cb8f SM |
115 | if (detect_container() > 0) { |
116 | log_notice("testing in container, skipping private device tests"); | |
117 | return; | |
118 | } | |
281e05b6 RC |
119 | test(m, "exec-privatedevices-yes.service", 0, CLD_EXITED); |
120 | test(m, "exec-privatedevices-no.service", 0, CLD_EXITED); | |
121 | } | |
122 | ||
123 | static void test_exec_systemcallfilter(Manager *m) { | |
124 | #ifdef HAVE_SECCOMP | |
125 | test(m, "exec-systemcallfilter-not-failing.service", 0, CLD_EXITED); | |
126 | test(m, "exec-systemcallfilter-not-failing2.service", 0, CLD_EXITED); | |
127 | test(m, "exec-systemcallfilter-failing.service", SIGSYS, CLD_KILLED); | |
128 | test(m, "exec-systemcallfilter-failing2.service", SIGSYS, CLD_KILLED); | |
129 | #endif | |
130 | } | |
131 | ||
132 | static void test_exec_systemcallerrornumber(Manager *m) { | |
133 | #ifdef HAVE_SECCOMP | |
134 | test(m, "exec-systemcallerrornumber.service", 1, CLD_EXITED); | |
135 | #endif | |
136 | } | |
137 | ||
19c0b0b9 RC |
138 | static void test_exec_systemcall_system_mode_with_user(Manager *m) { |
139 | #ifdef HAVE_SECCOMP | |
140 | if (getpwnam("nobody")) | |
141 | test(m, "exec-systemcallfilter-system-user.service", 0, CLD_EXITED); | |
50f130c2 RC |
142 | else if (getpwnam("nfsnobody")) |
143 | test(m, "exec-systemcallfilter-system-user-nfsnobody.service", 0, CLD_EXITED); | |
19c0b0b9 | 144 | else |
50f130c2 | 145 | log_error_errno(errno, "Skipping test_exec_systemcall_system_mode_with_user, could not find nobody/nfsnobody user: %m"); |
19c0b0b9 RC |
146 | #endif |
147 | } | |
148 | ||
281e05b6 | 149 | static void test_exec_user(Manager *m) { |
cc7fa4fb RC |
150 | if (getpwnam("nobody")) |
151 | test(m, "exec-user.service", 0, CLD_EXITED); | |
50f130c2 RC |
152 | else if (getpwnam("nfsnobody")) |
153 | test(m, "exec-user-nfsnobody.service", 0, CLD_EXITED); | |
ff4ca461 | 154 | else |
50f130c2 | 155 | log_error_errno(errno, "Skipping test_exec_user, could not find nobody/nfsnobody user: %m"); |
281e05b6 RC |
156 | } |
157 | ||
158 | static void test_exec_group(Manager *m) { | |
cc7fa4fb RC |
159 | if (getgrnam("nobody")) |
160 | test(m, "exec-group.service", 0, CLD_EXITED); | |
50f130c2 RC |
161 | else if (getgrnam("nfsnobody")) |
162 | test(m, "exec-group-nfsnobody.service", 0, CLD_EXITED); | |
ff4ca461 | 163 | else |
50f130c2 | 164 | log_error_errno(errno, "Skipping test_exec_group, could not find nobody/nfsnobody group: %m"); |
281e05b6 RC |
165 | } |
166 | ||
167 | static void test_exec_environment(Manager *m) { | |
168 | test(m, "exec-environment.service", 0, CLD_EXITED); | |
169 | test(m, "exec-environment-multiple.service", 0, CLD_EXITED); | |
170 | test(m, "exec-environment-empty.service", 0, CLD_EXITED); | |
171 | } | |
172 | ||
03bd70dd RC |
173 | static void test_exec_environmentfile(Manager *m) { |
174 | static const char e[] = | |
175 | "VAR1='word1 word2'\n" | |
176 | "VAR2=word3 \n" | |
177 | "# comment1\n" | |
178 | "\n" | |
179 | "; comment2\n" | |
180 | " ; # comment3\n" | |
181 | "line without an equal\n" | |
182 | "VAR3='$word 5 6'\n"; | |
183 | int r; | |
184 | ||
185 | r = write_string_file("/tmp/test-exec_environmentfile.conf", e, WRITE_STRING_FILE_CREATE); | |
186 | assert_se(r == 0); | |
187 | ||
188 | test(m, "exec-environmentfile.service", 0, CLD_EXITED); | |
189 | ||
190 | unlink("/tmp/test-exec_environmentfile.conf"); | |
191 | } | |
192 | ||
4c80d201 | 193 | static void test_exec_passenvironment(Manager *m) { |
e1abca2e FB |
194 | /* test-execute runs under MANAGER_USER which, by default, forwards all |
195 | * variables present in the environment, but only those that are | |
196 | * present _at the time it is created_! | |
197 | * | |
198 | * So these PassEnvironment checks are still expected to work, since we | |
199 | * are ensuring the variables are not present at manager creation (they | |
200 | * are unset explicitly in main) and are only set here. | |
201 | * | |
202 | * This is still a good approximation of how a test for MANAGER_SYSTEM | |
203 | * would work. | |
204 | */ | |
4c80d201 FB |
205 | assert_se(setenv("VAR1", "word1 word2", 1) == 0); |
206 | assert_se(setenv("VAR2", "word3", 1) == 0); | |
207 | assert_se(setenv("VAR3", "$word 5 6", 1) == 0); | |
208 | test(m, "exec-passenvironment.service", 0, CLD_EXITED); | |
209 | test(m, "exec-passenvironment-repeated.service", 0, CLD_EXITED); | |
210 | test(m, "exec-passenvironment-empty.service", 0, CLD_EXITED); | |
211 | assert_se(unsetenv("VAR1") == 0); | |
212 | assert_se(unsetenv("VAR2") == 0); | |
213 | assert_se(unsetenv("VAR3") == 0); | |
214 | test(m, "exec-passenvironment-absent.service", 0, CLD_EXITED); | |
215 | } | |
216 | ||
27c5347c RC |
217 | static void test_exec_umask(Manager *m) { |
218 | test(m, "exec-umask-default.service", 0, CLD_EXITED); | |
219 | test(m, "exec-umask-0177.service", 0, CLD_EXITED); | |
220 | } | |
221 | ||
cc3ddc85 RC |
222 | static void test_exec_runtimedirectory(Manager *m) { |
223 | test(m, "exec-runtimedirectory.service", 0, CLD_EXITED); | |
224 | test(m, "exec-runtimedirectory-mode.service", 0, CLD_EXITED); | |
cc7fa4fb RC |
225 | if (getgrnam("nobody")) |
226 | test(m, "exec-runtimedirectory-owner.service", 0, CLD_EXITED); | |
50f130c2 RC |
227 | else if (getgrnam("nfsnobody")) |
228 | test(m, "exec-runtimedirectory-owner-nfsnobody.service", 0, CLD_EXITED); | |
ff4ca461 | 229 | else |
50f130c2 | 230 | log_error_errno(errno, "Skipping test_exec_runtimedirectory-owner, could not find nobody/nfsnobody group: %m"); |
ff4ca461 RC |
231 | } |
232 | ||
233 | static void test_exec_capabilityboundingset(Manager *m) { | |
234 | int r; | |
235 | ||
236 | /* We use capsh to test if the capabilities are | |
237 | * properly set, so be sure that it exists */ | |
238 | r = find_binary("capsh", NULL); | |
239 | if (r < 0) { | |
240 | log_error_errno(r, "Skipping test_exec_capabilityboundingset, could not find capsh binary: %m"); | |
241 | return; | |
242 | } | |
243 | ||
244 | test(m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED); | |
245 | test(m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED); | |
246 | test(m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED); | |
247 | test(m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED); | |
cc3ddc85 RC |
248 | } |
249 | ||
70d7aea5 IP |
250 | static void test_exec_capabilityambientset(Manager *m) { |
251 | int r; | |
252 | ||
253 | /* Check if the kernel has support for ambient capabilities. Run | |
254 | * the tests only if that's the case. Clearing all ambient | |
255 | * capabilities is fine, since we are expecting them to be unset | |
256 | * in the first place for the tests. */ | |
257 | r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0); | |
258 | if (r >= 0 || errno != EINVAL) { | |
50f130c2 | 259 | if (getpwnam("nobody")) { |
50f130c2 RC |
260 | test(m, "exec-capabilityambientset.service", 0, CLD_EXITED); |
261 | test(m, "exec-capabilityambientset-merge.service", 0, CLD_EXITED); | |
34f5ff46 RC |
262 | } else if (getpwnam("nfsnobody")) { |
263 | test(m, "exec-capabilityambientset-nfsnobody.service", 0, CLD_EXITED); | |
264 | test(m, "exec-capabilityambientset-merge-nfsnobody.service", 0, CLD_EXITED); | |
50f130c2 RC |
265 | } else |
266 | log_error_errno(errno, "Skipping test_exec_capabilityambientset, could not find nobody/nfsnobody user: %m"); | |
267 | } else | |
268 | log_error_errno(errno, "Skipping test_exec_capabilityambientset, the kernel does not support ambient capabilities: %m"); | |
70d7aea5 IP |
269 | } |
270 | ||
63447f11 RC |
271 | static void test_exec_privatenetwork(Manager *m) { |
272 | int r; | |
273 | ||
274 | r = find_binary("ip", NULL); | |
275 | if (r < 0) { | |
276 | log_error_errno(r, "Skipping test_exec_privatenetwork, could not find ip binary: %m"); | |
277 | return; | |
278 | } | |
279 | ||
280 | test(m, "exec-privatenetwork-yes.service", 0, CLD_EXITED); | |
281 | } | |
282 | ||
c388dfea RC |
283 | static void test_exec_oomscoreadjust(Manager *m) { |
284 | test(m, "exec-oomscoreadjust-positive.service", 0, CLD_EXITED); | |
285 | test(m, "exec-oomscoreadjust-negative.service", 0, CLD_EXITED); | |
286 | } | |
287 | ||
a6226758 RC |
288 | static void test_exec_ioschedulingclass(Manager *m) { |
289 | test(m, "exec-ioschedulingclass-none.service", 0, CLD_EXITED); | |
290 | test(m, "exec-ioschedulingclass-idle.service", 0, CLD_EXITED); | |
291 | test(m, "exec-ioschedulingclass-realtime.service", 0, CLD_EXITED); | |
292 | test(m, "exec-ioschedulingclass-best-effort.service", 0, CLD_EXITED); | |
293 | } | |
294 | ||
25254999 EV |
295 | static void test_exec_spec_interpolation(Manager *m) { |
296 | test(m, "exec-spec-interpolation.service", 0, CLD_EXITED); | |
297 | } | |
298 | ||
463d0d15 | 299 | static int run_tests(UnitFileScope scope, test_function_t *tests) { |
19c0b0b9 RC |
300 | test_function_t *test = NULL; |
301 | Manager *m = NULL; | |
302 | int r; | |
303 | ||
304 | assert_se(tests); | |
305 | ||
463d0d15 | 306 | r = manager_new(scope, true, &m); |
19c0b0b9 RC |
307 | if (MANAGER_SKIP_TEST(r)) { |
308 | printf("Skipping test: manager_new: %s\n", strerror(-r)); | |
309 | return EXIT_TEST_SKIP; | |
310 | } | |
311 | assert_se(r >= 0); | |
312 | assert_se(manager_startup(m, NULL, NULL) >= 0); | |
313 | ||
314 | for (test = tests; test && *test; test++) | |
315 | (*test)(m); | |
316 | ||
317 | manager_free(m); | |
318 | ||
319 | return 0; | |
320 | } | |
321 | ||
281e05b6 | 322 | int main(int argc, char *argv[]) { |
19c0b0b9 | 323 | test_function_t user_tests[] = { |
281e05b6 RC |
324 | test_exec_workingdirectory, |
325 | test_exec_personality, | |
326 | test_exec_ignoresigpipe, | |
327 | test_exec_privatetmp, | |
328 | test_exec_privatedevices, | |
63447f11 | 329 | test_exec_privatenetwork, |
281e05b6 RC |
330 | test_exec_systemcallfilter, |
331 | test_exec_systemcallerrornumber, | |
332 | test_exec_user, | |
333 | test_exec_group, | |
334 | test_exec_environment, | |
03bd70dd | 335 | test_exec_environmentfile, |
4c80d201 | 336 | test_exec_passenvironment, |
27c5347c | 337 | test_exec_umask, |
cc3ddc85 | 338 | test_exec_runtimedirectory, |
ff4ca461 | 339 | test_exec_capabilityboundingset, |
70d7aea5 | 340 | test_exec_capabilityambientset, |
c388dfea | 341 | test_exec_oomscoreadjust, |
a6226758 | 342 | test_exec_ioschedulingclass, |
25254999 | 343 | test_exec_spec_interpolation, |
281e05b6 RC |
344 | NULL, |
345 | }; | |
19c0b0b9 RC |
346 | test_function_t system_tests[] = { |
347 | test_exec_systemcall_system_mode_with_user, | |
348 | NULL, | |
349 | }; | |
281e05b6 RC |
350 | int r; |
351 | ||
352 | log_parse_environment(); | |
353 | log_open(); | |
354 | ||
607ff5f9 DH |
355 | /* It is needed otherwise cgroup creation fails */ |
356 | if (getuid() != 0) { | |
357 | printf("Skipping test: not root\n"); | |
358 | return EXIT_TEST_SKIP; | |
359 | } | |
360 | ||
cc3ddc85 | 361 | assert_se(setenv("XDG_RUNTIME_DIR", "/tmp/", 1) == 0); |
ac400816 | 362 | assert_se(set_unit_path(TEST_DIR "/test-execute/") >= 0); |
281e05b6 | 363 | |
e1abca2e FB |
364 | /* Unset VAR1, VAR2 and VAR3 which are used in the PassEnvironment test |
365 | * cases, otherwise (and if they are present in the environment), | |
366 | * `manager_default_environment` will copy them into the default | |
367 | * environment which is passed to each created job, which will make the | |
368 | * tests that expect those not to be present to fail. | |
369 | */ | |
370 | assert_se(unsetenv("VAR1") == 0); | |
371 | assert_se(unsetenv("VAR2") == 0); | |
372 | assert_se(unsetenv("VAR3") == 0); | |
373 | ||
463d0d15 | 374 | r = run_tests(UNIT_FILE_USER, user_tests); |
19c0b0b9 RC |
375 | if (r != 0) |
376 | return r; | |
281e05b6 | 377 | |
463d0d15 | 378 | return run_tests(UNIT_FILE_SYSTEM, system_tests); |
281e05b6 | 379 | } |