src/test/test-execute.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <stdio.h>
   4 #include <sys/prctl.h>
   5 #include <sys/types.h>
   6
   7 #include "capability-util.h"
   8 #include "cpu-set-util.h"
   9 #include "errno-list.h"
  10 #include "fileio.h"
  11 #include "fs-util.h"
  12 #include "macro.h"
  13 #include "manager.h"
  14 #include "missing_prctl.h"
  15 #include "mkdir.h"
  16 #include "path-util.h"
  17 #include "rm-rf.h"
  18 #if HAVE_SECCOMP
  19 #include "seccomp-util.h"
  20 #endif
  21 #include "service.h"
  22 #include "stat-util.h"
  23 #include "tests.h"
  24 #include "unit.h"
  25 #include "user-util.h"
  26 #include "util.h"
  27 #include "virt.h"
  28
  29 static bool can_unshare;
  30
  31 typedef void (*test_function_t)(Manager *m);
  32
  33 static int cld_dumped_to_killed(int code) {
  34         /* Depending on the system, seccomp version, … some signals might result in dumping, others in plain
  35          * killing. Let's ignore the difference here, and map both cases to CLD_KILLED */
  36         return code == CLD_DUMPED ? CLD_KILLED : code;
  37 }
  38
  39 static void wait_for_service_finish(Manager *m, Unit *unit) {
  40         Service *service = NULL;
  41         usec_t ts;
  42         usec_t timeout = 2 * USEC_PER_MINUTE;
  43
  44         assert_se(m);
  45         assert_se(unit);
  46
  47         service = SERVICE(unit);
  48         printf("%s\n", unit->id);
  49         exec_context_dump(&service->exec_context, stdout, "\t");
  50         ts = now(CLOCK_MONOTONIC);
  51         while (!IN_SET(service->state, SERVICE_DEAD, SERVICE_FAILED)) {
  52                 int r;
  53                 usec_t n;
  54
  55                 r = sd_event_run(m->event, 100 * USEC_PER_MSEC);
  56                 assert_se(r >= 0);
  57
  58                 n = now(CLOCK_MONOTONIC);
  59                 if (ts + timeout < n) {
  60                         log_error("Test timeout when testing %s", unit->id);
  61                         r = unit_kill(unit, KILL_ALL, SIGKILL, NULL);
  62                         if (r < 0)
  63                                 log_error_errno(r, "Failed to kill %s: %m", unit->id);
  64                         exit(EXIT_FAILURE);
  65                 }
  66         }
  67 }
  68
  69 static void check_main_result(const char *file, unsigned line, const char *func,
  70                               Manager *m, Unit *unit, int status_expected, int code_expected) {
  71         Service *service = NULL;
  72
  73         assert_se(m);
  74         assert_se(unit);
  75
  76         wait_for_service_finish(m, unit);
  77
  78         service = SERVICE(unit);
  79         exec_status_dump(&service->main_exec_status, stdout, "\t");
  80
  81         if (cld_dumped_to_killed(service->main_exec_status.code) != cld_dumped_to_killed(code_expected)) {
  82                 log_error("%s:%u:%s %s: exit code %d, expected %d",
  83                           file, line, func,
  84                           unit->id,
  85                           service->main_exec_status.code, code_expected);
  86                 abort();
  87         }
  88
  89         if (service->main_exec_status.status != status_expected) {
  90                 log_error("%s:%u:%s: %s: exit status %d, expected %d",
  91                           file, line, func, unit->id,
  92                           service->main_exec_status.status, status_expected);
  93                 abort();
  94         }
  95 }
  96
  97 static void check_service_result(const char *file, unsigned line, const char *func,
  98                                  Manager *m, Unit *unit, ServiceResult result_expected) {
  99         Service *service = NULL;
 100
 101         assert_se(m);
 102         assert_se(unit);
 103
 104         wait_for_service_finish(m, unit);
 105
 106         service = SERVICE(unit);
 107
 108         if (service->result != result_expected) {
 109                 log_error("%s:%u:%s: %s: service end result %s, expected %s",
 110                           file, line, func,
 111                           unit->id,
 112                           service_result_to_string(service->result),
 113                           service_result_to_string(result_expected));
 114                 abort();
 115         }
 116 }
 117
 118 static bool check_nobody_user_and_group(void) {
 119         static int cache = -1;
 120         struct passwd *p;
 121         struct group *g;
 122
 123         if (cache >= 0)
 124                 return !!cache;
 125
 126         if (!synthesize_nobody())
 127                 goto invalid;
 128
 129         p = getpwnam(NOBODY_USER_NAME);
 130         if (!p ||
 131             !streq(p->pw_name, NOBODY_USER_NAME) ||
 132             p->pw_uid != UID_NOBODY ||
 133             p->pw_gid != GID_NOBODY)
 134                 goto invalid;
 135
 136         p = getpwuid(UID_NOBODY);
 137         if (!p ||
 138             !streq(p->pw_name, NOBODY_USER_NAME) ||
 139             p->pw_uid != UID_NOBODY ||
 140             p->pw_gid != GID_NOBODY)
 141                 goto invalid;
 142
 143         g = getgrnam(NOBODY_GROUP_NAME);
 144         if (!g ||
 145             !streq(g->gr_name, NOBODY_GROUP_NAME) ||
 146             g->gr_gid != GID_NOBODY)
 147                 goto invalid;
 148
 149         g = getgrgid(GID_NOBODY);
 150         if (!g ||
 151             !streq(g->gr_name, NOBODY_GROUP_NAME) ||
 152             g->gr_gid != GID_NOBODY)
 153                 goto invalid;
 154
 155         cache = 1;
 156         return true;
 157
 158 invalid:
 159         cache = 0;
 160         return false;
 161 }
 162
 163 static bool check_user_has_group_with_same_name(const char *name) {
 164         struct passwd *p;
 165         struct group *g;
 166
 167         assert(name);
 168
 169         p = getpwnam(name);
 170         if (!p ||
 171             !streq(p->pw_name, name))
 172                 return false;
 173
 174         g = getgrgid(p->pw_gid);
 175         if (!g ||
 176             !streq(g->gr_name, name))
 177                 return false;
 178
 179         return true;
 180 }
 181
 182 static bool is_inaccessible_available(void) {
 183         const char *p;
 184
 185         FOREACH_STRING(p,
 186                 "/run/systemd/inaccessible/reg",
 187                 "/run/systemd/inaccessible/dir",
 188                 "/run/systemd/inaccessible/chr",
 189                 "/run/systemd/inaccessible/blk",
 190                 "/run/systemd/inaccessible/fifo",
 191                 "/run/systemd/inaccessible/sock"
 192         ) {
 193                 if (access(p, F_OK) < 0)
 194                         return false;
 195         }
 196
 197         return true;
 198 }
 199
 200 static void _test(const char *file, unsigned line, const char *func,
 201                   Manager *m, const char *unit_name, int status_expected, int code_expected) {
 202         Unit *unit;
 203
 204         assert_se(unit_name);
 205
 206         assert_se(manager_load_startable_unit_or_warn(m, unit_name, NULL, &unit) >= 0);
 207         assert_se(unit_start(unit) >= 0);
 208         check_main_result(file, line, func, m, unit, status_expected, code_expected);
 209 }
 210 #define test(m, unit_name, status_expected, code_expected) \
 211         _test(PROJECT_FILE, __LINE__, __func__, m, unit_name, status_expected, code_expected)
 212
 213 static void _test_service(const char *file, unsigned line, const char *func,
 214                           Manager *m, const char *unit_name, ServiceResult result_expected) {
 215         Unit *unit;
 216
 217         assert_se(unit_name);
 218
 219         assert_se(manager_load_startable_unit_or_warn(m, unit_name, NULL, &unit) >= 0);
 220         assert_se(unit_start(unit) >= 0);
 221         check_service_result(file, line, func, m, unit, result_expected);
 222 }
 223 #define test_service(m, unit_name, result_expected) \
 224         _test_service(PROJECT_FILE, __LINE__, __func__, m, unit_name, result_expected)
 225
 226 static void test_exec_bindpaths(Manager *m) {
 227         assert_se(mkdir_p("/tmp/test-exec-bindpaths", 0755) >= 0);
 228         assert_se(mkdir_p("/tmp/test-exec-bindreadonlypaths", 0755) >= 0);
 229
 230         test(m, "exec-bindpaths.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 231
 232         (void) rm_rf("/tmp/test-exec-bindpaths", REMOVE_ROOT|REMOVE_PHYSICAL);
 233         (void) rm_rf("/tmp/test-exec-bindreadonlypaths", REMOVE_ROOT|REMOVE_PHYSICAL);
 234 }
 235
 236 static void test_exec_cpuaffinity(Manager *m) {
 237         _cleanup_(cpu_set_reset) CPUSet c = {};
 238
 239         assert_se(cpu_set_realloc(&c, 8192) >= 0); /* just allocate the maximum possible size */
 240         assert_se(sched_getaffinity(0, c.allocated, c.set) >= 0);
 241
 242         if (!CPU_ISSET_S(0, c.allocated, c.set)) {
 243                 log_notice("Cannot use CPU 0, skipping %s", __func__);
 244                 return;
 245         }
 246
 247         test(m, "exec-cpuaffinity1.service", 0, CLD_EXITED);
 248         test(m, "exec-cpuaffinity2.service", 0, CLD_EXITED);
 249
 250         if (!CPU_ISSET_S(1, c.allocated, c.set) ||
 251             !CPU_ISSET_S(2, c.allocated, c.set)) {
 252                 log_notice("Cannot use CPU 1 or 2, skipping remaining tests in %s", __func__);
 253                 return;
 254         }
 255
 256         test(m, "exec-cpuaffinity3.service", 0, CLD_EXITED);
 257 }
 258
 259 static void test_exec_workingdirectory(Manager *m) {
 260         assert_se(mkdir_p("/tmp/test-exec_workingdirectory", 0755) >= 0);
 261
 262         test(m, "exec-workingdirectory.service", 0, CLD_EXITED);
 263         test(m, "exec-workingdirectory-trailing-dot.service", 0, CLD_EXITED);
 264
 265         (void) rm_rf("/tmp/test-exec_workingdirectory", REMOVE_ROOT|REMOVE_PHYSICAL);
 266 }
 267
 268 static void test_exec_personality(Manager *m) {
 269 #if defined(__x86_64__)
 270         test(m, "exec-personality-x86-64.service", 0, CLD_EXITED);
 271
 272 #elif defined(__s390__)
 273         test(m, "exec-personality-s390.service", 0, CLD_EXITED);
 274
 275 #elif defined(__powerpc64__)
 276 #  if __BYTE_ORDER == __BIG_ENDIAN
 277         test(m, "exec-personality-ppc64.service", 0, CLD_EXITED);
 278 #  else
 279         test(m, "exec-personality-ppc64le.service", 0, CLD_EXITED);
 280 #  endif
 281
 282 #elif defined(__aarch64__)
 283         test(m, "exec-personality-aarch64.service", 0, CLD_EXITED);
 284
 285 #elif defined(__i386__)
 286         test(m, "exec-personality-x86.service", 0, CLD_EXITED);
 287 #else
 288         log_notice("Unknown personality, skipping %s", __func__);
 289 #endif
 290 }
 291
 292 static void test_exec_ignoresigpipe(Manager *m) {
 293         test(m, "exec-ignoresigpipe-yes.service", 0, CLD_EXITED);
 294         test(m, "exec-ignoresigpipe-no.service", SIGPIPE, CLD_KILLED);
 295 }
 296
 297 static void test_exec_privatetmp(Manager *m) {
 298         assert_se(touch("/tmp/test-exec_privatetmp") >= 0);
 299
 300         test(m, "exec-privatetmp-yes.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 301         test(m, "exec-privatetmp-no.service", 0, CLD_EXITED);
 302         test(m, "exec-privatetmp-disabled-by-prefix.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 303
 304         unlink("/tmp/test-exec_privatetmp");
 305 }
 306
 307 static void test_exec_privatedevices(Manager *m) {
 308         int r;
 309
 310         if (detect_container() > 0) {
 311                 log_notice("Testing in container, skipping %s", __func__);
 312                 return;
 313         }
 314         if (!is_inaccessible_available()) {
 315                 log_notice("Testing without inaccessible, skipping %s", __func__);
 316                 return;
 317         }
 318
 319         test(m, "exec-privatedevices-yes.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 320         test(m, "exec-privatedevices-no.service", 0, CLD_EXITED);
 321         test(m, "exec-privatedevices-disabled-by-prefix.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 322         test(m, "exec-privatedevices-yes-with-group.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 323
 324         /* We use capsh to test if the capabilities are
 325          * properly set, so be sure that it exists */
 326         r = find_executable("capsh", NULL);
 327         if (r < 0) {
 328                 log_notice_errno(r, "Could not find capsh binary, skipping remaining tests in %s: %m", __func__);
 329                 return;
 330         }
 331
 332         test(m, "exec-privatedevices-yes-capability-mknod.service", 0, CLD_EXITED);
 333         test(m, "exec-privatedevices-no-capability-mknod.service", 0, CLD_EXITED);
 334         test(m, "exec-privatedevices-yes-capability-sys-rawio.service", 0, CLD_EXITED);
 335         test(m, "exec-privatedevices-no-capability-sys-rawio.service", 0, CLD_EXITED);
 336 }
 337
 338 static void test_exec_protecthome(Manager *m) {
 339         if (!can_unshare) {
 340                 log_notice("Cannot reliably unshare, skipping %s", __func__);
 341                 return;
 342         }
 343
 344         test(m, "exec-protecthome-tmpfs-vs-protectsystem-strict.service", 0, CLD_EXITED);
 345 }
 346
 347 static void test_exec_protectkernelmodules(Manager *m) {
 348         int r;
 349
 350         if (detect_container() > 0) {
 351                 log_notice("Testing in container, skipping %s", __func__);
 352                 return;
 353         }
 354         if (!is_inaccessible_available()) {
 355                 log_notice("Testing without inaccessible, skipping %s", __func__);
 356                 return;
 357         }
 358
 359         r = find_executable("capsh", NULL);
 360         if (r < 0) {
 361                 log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
 362                 return;
 363         }
 364
 365         test(m, "exec-protectkernelmodules-no-capabilities.service", 0, CLD_EXITED);
 366         test(m, "exec-protectkernelmodules-yes-capabilities.service", 0, CLD_EXITED);
 367         test(m, "exec-protectkernelmodules-yes-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 368 }
 369
 370 static void test_exec_readonlypaths(Manager *m) {
 371
 372         test(m, "exec-readonlypaths-simple.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 373
 374         if (path_is_read_only_fs("/var") > 0) {
 375                 log_notice("Directory /var is readonly, skipping remaining tests in %s", __func__);
 376                 return;
 377         }
 378
 379         test(m, "exec-readonlypaths.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 380         test(m, "exec-readonlypaths-with-bindpaths.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 381         test(m, "exec-readonlypaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 382 }
 383
 384 static void test_exec_readwritepaths(Manager *m) {
 385
 386         if (path_is_read_only_fs("/") > 0) {
 387                 log_notice("Root directory is readonly, skipping %s", __func__);
 388                 return;
 389         }
 390
 391         test(m, "exec-readwritepaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 392 }
 393
 394 static void test_exec_inaccessiblepaths(Manager *m) {
 395
 396         if (!is_inaccessible_available()) {
 397                 log_notice("Testing without inaccessible, skipping %s", __func__);
 398                 return;
 399         }
 400
 401         test(m, "exec-inaccessiblepaths-sys.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 402
 403         if (path_is_read_only_fs("/") > 0) {
 404                 log_notice("Root directory is readonly, skipping remaining tests in %s", __func__);
 405                 return;
 406         }
 407
 408         test(m, "exec-inaccessiblepaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 409 }
 410
 411 static void test_exec_noexecpaths(Manager *m) {
 412
 413         test(m, "exec-noexecpaths-simple.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 414 }
 415
 416 static void test_exec_temporaryfilesystem(Manager *m) {
 417
 418         test(m, "exec-temporaryfilesystem-options.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 419         test(m, "exec-temporaryfilesystem-ro.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 420         test(m, "exec-temporaryfilesystem-rw.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 421         test(m, "exec-temporaryfilesystem-usr.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 422 }
 423
 424 static void test_exec_systemcallfilter(Manager *m) {
 425 #if HAVE_SECCOMP
 426         int r;
 427
 428         if (!is_seccomp_available()) {
 429                 log_notice("Seccomp not available, skipping %s", __func__);
 430                 return;
 431         }
 432
 433         test(m, "exec-systemcallfilter-not-failing.service", 0, CLD_EXITED);
 434         test(m, "exec-systemcallfilter-not-failing2.service", 0, CLD_EXITED);
 435         test(m, "exec-systemcallfilter-failing.service", SIGSYS, CLD_KILLED);
 436         test(m, "exec-systemcallfilter-failing2.service", SIGSYS, CLD_KILLED);
 437
 438         r = find_executable("python3", NULL);
 439         if (r < 0) {
 440                 log_notice_errno(r, "Skipping remaining tests in %s, could not find python3 binary: %m", __func__);
 441                 return;
 442         }
 443
 444         test(m, "exec-systemcallfilter-with-errno-name.service", errno_from_name("EILSEQ"), CLD_EXITED);
 445         test(m, "exec-systemcallfilter-with-errno-number.service", 255, CLD_EXITED);
 446         test(m, "exec-systemcallfilter-with-errno-multi.service", errno_from_name("EILSEQ"), CLD_EXITED);
 447         test(m, "exec-systemcallfilter-with-errno-in-allow-list.service", errno_from_name("EILSEQ"), CLD_EXITED);
 448         test(m, "exec-systemcallfilter-override-error-action.service", SIGSYS, CLD_KILLED);
 449         test(m, "exec-systemcallfilter-override-error-action2.service", errno_from_name("EILSEQ"), CLD_EXITED);
 450 #endif
 451 }
 452
 453 static void test_exec_systemcallerrornumber(Manager *m) {
 454 #if HAVE_SECCOMP
 455         int r;
 456
 457         if (!is_seccomp_available()) {
 458                 log_notice("Seccomp not available, skipping %s", __func__);
 459                 return;
 460         }
 461
 462         r = find_executable("python3", NULL);
 463         if (r < 0) {
 464                 log_notice_errno(r, "Skipping %s, could not find python3 binary: %m", __func__);
 465                 return;
 466         }
 467
 468         test(m, "exec-systemcallerrornumber-name.service", errno_from_name("EACCES"), CLD_EXITED);
 469         test(m, "exec-systemcallerrornumber-number.service", 255, CLD_EXITED);
 470 #endif
 471 }
 472
 473 static void test_exec_restrictnamespaces(Manager *m) {
 474 #if HAVE_SECCOMP
 475         if (!is_seccomp_available()) {
 476                 log_notice("Seccomp not available, skipping %s", __func__);
 477                 return;
 478         }
 479
 480         test(m, "exec-restrictnamespaces-no.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 481         test(m, "exec-restrictnamespaces-yes.service", 1, CLD_EXITED);
 482         test(m, "exec-restrictnamespaces-mnt.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 483         test(m, "exec-restrictnamespaces-mnt-deny-list.service", 1, CLD_EXITED);
 484         test(m, "exec-restrictnamespaces-merge-and.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 485         test(m, "exec-restrictnamespaces-merge-or.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 486         test(m, "exec-restrictnamespaces-merge-all.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 487 #endif
 488 }
 489
 490 static void test_exec_systemcallfilter_system(Manager *m) {
 491 /* Skip this particular test case when running under ASan, as
 492  * LSan intermittently segfaults when accessing memory right
 493  * after the test finishes. Generally, ASan & LSan don't like
 494  * the seccomp stuff.
 495  */
 496 #if HAVE_SECCOMP && !HAS_FEATURE_ADDRESS_SANITIZER
 497         if (!is_seccomp_available()) {
 498                 log_notice("Seccomp not available, skipping %s", __func__);
 499                 return;
 500         }
 501
 502         test(m, "exec-systemcallfilter-system-user.service", 0, CLD_EXITED);
 503
 504         if (!check_nobody_user_and_group()) {
 505                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 506                 return;
 507         }
 508
 509         if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) {
 510                 log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__);
 511                 return;
 512         }
 513
 514         test(m, "exec-systemcallfilter-system-user-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 515 #endif
 516 }
 517
 518 static void test_exec_user(Manager *m) {
 519         test(m, "exec-user.service", 0, CLD_EXITED);
 520
 521         if (!check_nobody_user_and_group()) {
 522                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 523                 return;
 524         }
 525
 526         if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) {
 527                 log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__);
 528                 return;
 529         }
 530
 531         test(m, "exec-user-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 532 }
 533
 534 static void test_exec_group(Manager *m) {
 535         test(m, "exec-group.service", 0, CLD_EXITED);
 536
 537         if (!check_nobody_user_and_group()) {
 538                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 539                 return;
 540         }
 541
 542         if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) {
 543                 log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__);
 544                 return;
 545         }
 546
 547         test(m, "exec-group-" NOBODY_GROUP_NAME ".service", 0, CLD_EXITED);
 548 }
 549
 550 static void test_exec_supplementarygroups(Manager *m) {
 551         test(m, "exec-supplementarygroups.service", 0, CLD_EXITED);
 552         test(m, "exec-supplementarygroups-single-group.service", 0, CLD_EXITED);
 553         test(m, "exec-supplementarygroups-single-group-user.service", 0, CLD_EXITED);
 554         test(m, "exec-supplementarygroups-multiple-groups-default-group-user.service", 0, CLD_EXITED);
 555         test(m, "exec-supplementarygroups-multiple-groups-withgid.service", 0, CLD_EXITED);
 556         test(m, "exec-supplementarygroups-multiple-groups-withuid.service", 0, CLD_EXITED);
 557 }
 558
 559 static char* private_directory_bad(Manager *m) {
 560         /* This mirrors setup_exec_directory(). */
 561
 562         for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
 563                 _cleanup_free_ char *p = NULL;
 564                 struct stat st;
 565
 566                 assert_se(p = path_join(m->prefix[dt], "private"));
 567
 568                 if (stat(p, &st) >= 0 &&
 569                     (st.st_mode & (S_IRWXG|S_IRWXO)))
 570                         return TAKE_PTR(p);
 571         }
 572
 573         return NULL;
 574 }
 575
 576 static void test_exec_dynamicuser(Manager *m) {
 577         _cleanup_free_ char *bad = private_directory_bad(m);
 578         if (bad) {
 579                 log_warning("%s: %s has bad permissions, skipping test.", __func__, bad);
 580                 return;
 581         }
 582
 583         if (strstr_ptr(ci_environment(), "github-actions")) {
 584                 log_notice("%s: skipping test on GH Actions because of systemd/systemd#10337", __func__);
 585                 return;
 586         }
 587
 588         test(m, "exec-dynamicuser-fixeduser.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 589         if (check_user_has_group_with_same_name("adm"))
 590                 test(m, "exec-dynamicuser-fixeduser-adm.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 591         if (check_user_has_group_with_same_name("games"))
 592                 test(m, "exec-dynamicuser-fixeduser-games.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 593         test(m, "exec-dynamicuser-fixeduser-one-supplementarygroup.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 594         test(m, "exec-dynamicuser-supplementarygroups.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 595         test(m, "exec-dynamicuser-statedir.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 596
 597         (void) rm_rf("/var/lib/quux", REMOVE_ROOT|REMOVE_PHYSICAL);
 598         (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 599         (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 600         (void) rm_rf("/var/lib/waldo", REMOVE_ROOT|REMOVE_PHYSICAL);
 601         (void) rm_rf("/var/lib/private/quux", REMOVE_ROOT|REMOVE_PHYSICAL);
 602         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 603         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 604         (void) rm_rf("/var/lib/private/waldo", REMOVE_ROOT|REMOVE_PHYSICAL);
 605
 606         test(m, "exec-dynamicuser-statedir-migrate-step1.service", 0, CLD_EXITED);
 607         test(m, "exec-dynamicuser-statedir-migrate-step2.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 608         test(m, "exec-dynamicuser-statedir-migrate-step1.service", 0, CLD_EXITED);
 609
 610         (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 611         (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 612         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 613         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 614
 615         test(m, "exec-dynamicuser-runtimedirectory1.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 616         test(m, "exec-dynamicuser-runtimedirectory2.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 617         test(m, "exec-dynamicuser-runtimedirectory3.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 618 }
 619
 620 static void test_exec_environment(Manager *m) {
 621         test(m, "exec-environment-no-substitute.service", 0, CLD_EXITED);
 622         test(m, "exec-environment.service", 0, CLD_EXITED);
 623         test(m, "exec-environment-multiple.service", 0, CLD_EXITED);
 624         test(m, "exec-environment-empty.service", 0, CLD_EXITED);
 625 }
 626
 627 static void test_exec_environmentfile(Manager *m) {
 628         static const char e[] =
 629                 "VAR1='word1 word2'\n"
 630                 "VAR2=word3 \n"
 631                 "# comment1\n"
 632                 "\n"
 633                 "; comment2\n"
 634                 " ; # comment3\n"
 635                 "line without an equal\n"
 636                 "VAR3='$word 5 6'\n"
 637                 "VAR4='new\nline'\n"
 638                 "VAR5=password\\with\\backslashes";
 639         int r;
 640
 641         r = write_string_file("/tmp/test-exec_environmentfile.conf", e, WRITE_STRING_FILE_CREATE);
 642         assert_se(r == 0);
 643
 644         test(m, "exec-environmentfile.service", 0, CLD_EXITED);
 645
 646         (void) unlink("/tmp/test-exec_environmentfile.conf");
 647 }
 648
 649 static void test_exec_passenvironment(Manager *m) {
 650         /* test-execute runs under MANAGER_USER which, by default, forwards all
 651          * variables present in the environment, but only those that are
 652          * present _at the time it is created_!
 653          *
 654          * So these PassEnvironment checks are still expected to work, since we
 655          * are ensuring the variables are not present at manager creation (they
 656          * are unset explicitly in main) and are only set here.
 657          *
 658          * This is still a good approximation of how a test for MANAGER_SYSTEM
 659          * would work.
 660          */
 661         assert_se(setenv("VAR1", "word1 word2", 1) == 0);
 662         assert_se(setenv("VAR2", "word3", 1) == 0);
 663         assert_se(setenv("VAR3", "$word 5 6", 1) == 0);
 664         assert_se(setenv("VAR4", "new\nline", 1) == 0);
 665         assert_se(setenv("VAR5", "passwordwithbackslashes", 1) == 0);
 666         test(m, "exec-passenvironment.service", 0, CLD_EXITED);
 667         test(m, "exec-passenvironment-repeated.service", 0, CLD_EXITED);
 668         test(m, "exec-passenvironment-empty.service", 0, CLD_EXITED);
 669         assert_se(unsetenv("VAR1") == 0);
 670         assert_se(unsetenv("VAR2") == 0);
 671         assert_se(unsetenv("VAR3") == 0);
 672         assert_se(unsetenv("VAR4") == 0);
 673         assert_se(unsetenv("VAR5") == 0);
 674         test(m, "exec-passenvironment-absent.service", 0, CLD_EXITED);
 675 }
 676
 677 static void test_exec_umask(Manager *m) {
 678         test(m, "exec-umask-default.service", 0, CLD_EXITED);
 679         test(m, "exec-umask-0177.service", 0, CLD_EXITED);
 680 }
 681
 682 static void test_exec_runtimedirectory(Manager *m) {
 683         test(m, "exec-runtimedirectory.service", 0, CLD_EXITED);
 684         test(m, "exec-runtimedirectory-mode.service", 0, CLD_EXITED);
 685         test(m, "exec-runtimedirectory-owner.service", 0, CLD_EXITED);
 686
 687         if (!check_nobody_user_and_group()) {
 688                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 689                 return;
 690         }
 691
 692         if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) {
 693                 log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__);
 694                 return;
 695         }
 696
 697         test(m, "exec-runtimedirectory-owner-" NOBODY_GROUP_NAME ".service", 0, CLD_EXITED);
 698 }
 699
 700 static void test_exec_capabilityboundingset(Manager *m) {
 701         int r;
 702
 703         r = find_executable("capsh", NULL);
 704         if (r < 0) {
 705                 log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
 706                 return;
 707         }
 708
 709         if (have_effective_cap(CAP_CHOWN) <= 0 ||
 710             have_effective_cap(CAP_FOWNER) <= 0 ||
 711             have_effective_cap(CAP_KILL) <= 0) {
 712                 log_notice("Skipping %s, this process does not have enough capabilities", __func__);
 713                 return;
 714         }
 715
 716         test(m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED);
 717         test(m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED);
 718         test(m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED);
 719         test(m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED);
 720 }
 721
 722 static void test_exec_basic(Manager *m) {
 723         test(m, "exec-basic.service", 0, CLD_EXITED);
 724 }
 725
 726 static void test_exec_ambientcapabilities(Manager *m) {
 727         int r;
 728
 729         /* Check if the kernel has support for ambient capabilities. Run
 730          * the tests only if that's the case. Clearing all ambient
 731          * capabilities is fine, since we are expecting them to be unset
 732          * in the first place for the tests. */
 733         r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
 734         if (r < 0 && IN_SET(errno, EINVAL, EOPNOTSUPP, ENOSYS)) {
 735                 log_notice("Skipping %s, the kernel does not support ambient capabilities", __func__);
 736                 return;
 737         }
 738
 739         if (have_effective_cap(CAP_CHOWN) <= 0 ||
 740             have_effective_cap(CAP_NET_RAW) <= 0) {
 741                 log_notice("Skipping %s, this process does not have enough capabilities", __func__);
 742                 return;
 743         }
 744
 745         test(m, "exec-ambientcapabilities.service", 0, CLD_EXITED);
 746         test(m, "exec-ambientcapabilities-merge.service", 0, CLD_EXITED);
 747
 748         if (!check_nobody_user_and_group()) {
 749                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 750                 return;
 751         }
 752
 753         if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) {
 754                 log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__);
 755                 return;
 756         }
 757
 758         test(m, "exec-ambientcapabilities-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 759         test(m, "exec-ambientcapabilities-merge-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 760 }
 761
 762 static void test_exec_privatenetwork(Manager *m) {
 763         int r;
 764
 765         r = find_executable("ip", NULL);
 766         if (r < 0) {
 767                 log_notice_errno(r, "Skipping %s, could not find ip binary: %m", __func__);
 768                 return;
 769         }
 770
 771         test(m, "exec-privatenetwork-yes.service", can_unshare ? 0 : EXIT_NETWORK, CLD_EXITED);
 772 }
 773
 774 static void test_exec_oomscoreadjust(Manager *m) {
 775         test(m, "exec-oomscoreadjust-positive.service", 0, CLD_EXITED);
 776
 777         if (detect_container() > 0) {
 778                 log_notice("Testing in container, skipping remaining tests in %s", __func__);
 779                 return;
 780         }
 781         test(m, "exec-oomscoreadjust-negative.service", 0, CLD_EXITED);
 782 }
 783
 784 static void test_exec_ioschedulingclass(Manager *m) {
 785         test(m, "exec-ioschedulingclass-none.service", 0, CLD_EXITED);
 786         test(m, "exec-ioschedulingclass-idle.service", 0, CLD_EXITED);
 787         test(m, "exec-ioschedulingclass-best-effort.service", 0, CLD_EXITED);
 788
 789         if (detect_container() > 0) {
 790                 log_notice("Testing in container, skipping remaining tests in %s", __func__);
 791                 return;
 792         }
 793         test(m, "exec-ioschedulingclass-realtime.service", 0, CLD_EXITED);
 794 }
 795
 796 static void test_exec_unsetenvironment(Manager *m) {
 797         test(m, "exec-unsetenvironment.service", 0, CLD_EXITED);
 798 }
 799
 800 static void test_exec_specifier(Manager *m) {
 801         test(m, "exec-specifier.service", 0, CLD_EXITED);
 802         test(m, "exec-specifier@foo-bar.service", 0, CLD_EXITED);
 803         test(m, "exec-specifier-interpolation.service", 0, CLD_EXITED);
 804 }
 805
 806 static void test_exec_standardinput(Manager *m) {
 807         test(m, "exec-standardinput-data.service", 0, CLD_EXITED);
 808         test(m, "exec-standardinput-file.service", 0, CLD_EXITED);
 809         test(m, "exec-standardinput-file-cat.service", 0, CLD_EXITED);
 810 }
 811
 812 static void test_exec_standardoutput(Manager *m) {
 813         test(m, "exec-standardoutput-file.service", 0, CLD_EXITED);
 814 }
 815
 816 static void test_exec_standardoutput_append(Manager *m) {
 817         test(m, "exec-standardoutput-append.service", 0, CLD_EXITED);
 818 }
 819
 820 static void test_exec_standardoutput_truncate(Manager *m) {
 821         test(m, "exec-standardoutput-truncate.service", 0, CLD_EXITED);
 822 }
 823
 824 static void test_exec_condition(Manager *m) {
 825         test_service(m, "exec-condition-failed.service", SERVICE_FAILURE_EXIT_CODE);
 826         test_service(m, "exec-condition-skip.service", SERVICE_SKIP_CONDITION);
 827 }
 828
 829 typedef struct test_entry {
 830         test_function_t f;
 831         const char *name;
 832 } test_entry;
 833
 834 #define entry(x) {x, #x}
 835
 836 static int run_tests(UnitFileScope scope, const test_entry tests[], char **patterns) {
 837         _cleanup_(manager_freep) Manager *m = NULL;
 838         int r;
 839
 840         assert_se(tests);
 841
 842         r = manager_new(scope, MANAGER_TEST_RUN_BASIC, &m);
 843         m->default_std_output = EXEC_OUTPUT_NULL; /* don't rely on host journald */
 844         if (manager_errno_skip_test(r))
 845                 return log_tests_skipped_errno(r, "manager_new");
 846         assert_se(r >= 0);
 847         assert_se(manager_startup(m, NULL, NULL) >= 0);
 848
 849         for (const test_entry *test = tests; test->f; test++)
 850                 if (strv_fnmatch_or_empty(patterns, test->name, FNM_NOESCAPE))
 851                         test->f(m);
 852                 else
 853                         log_info("Skipping %s because it does not match any pattern.", test->name);
 854
 855         return 0;
 856 }
 857
 858 int main(int argc, char *argv[]) {
 859         _cleanup_(rm_rf_physical_and_freep) char *runtime_dir = NULL;
 860
 861         static const test_entry user_tests[] = {
 862                 entry(test_exec_basic),
 863                 entry(test_exec_ambientcapabilities),
 864                 entry(test_exec_bindpaths),
 865                 entry(test_exec_capabilityboundingset),
 866                 entry(test_exec_condition),
 867                 entry(test_exec_cpuaffinity),
 868                 entry(test_exec_environment),
 869                 entry(test_exec_environmentfile),
 870                 entry(test_exec_group),
 871                 entry(test_exec_ignoresigpipe),
 872                 entry(test_exec_inaccessiblepaths),
 873                 entry(test_exec_ioschedulingclass),
 874                 entry(test_exec_noexecpaths),
 875                 entry(test_exec_oomscoreadjust),
 876                 entry(test_exec_passenvironment),
 877                 entry(test_exec_personality),
 878                 entry(test_exec_privatedevices),
 879                 entry(test_exec_privatenetwork),
 880                 entry(test_exec_privatetmp),
 881                 entry(test_exec_protecthome),
 882                 entry(test_exec_protectkernelmodules),
 883                 entry(test_exec_readonlypaths),
 884                 entry(test_exec_readwritepaths),
 885                 entry(test_exec_restrictnamespaces),
 886                 entry(test_exec_runtimedirectory),
 887                 entry(test_exec_standardinput),
 888                 entry(test_exec_standardoutput),
 889                 entry(test_exec_standardoutput_append),
 890                 entry(test_exec_standardoutput_truncate),
 891                 entry(test_exec_supplementarygroups),
 892                 entry(test_exec_systemcallerrornumber),
 893                 entry(test_exec_systemcallfilter),
 894                 entry(test_exec_temporaryfilesystem),
 895                 entry(test_exec_umask),
 896                 entry(test_exec_unsetenvironment),
 897                 entry(test_exec_user),
 898                 entry(test_exec_workingdirectory),
 899                 {},
 900         };
 901         static const test_entry system_tests[] = {
 902                 entry(test_exec_dynamicuser),
 903                 entry(test_exec_specifier),
 904                 entry(test_exec_systemcallfilter_system),
 905                 {},
 906         };
 907         int r;
 908
 909         test_setup_logging(LOG_DEBUG);
 910
 911 #if HAS_FEATURE_ADDRESS_SANITIZER
 912         if (strstr_ptr(ci_environment(), "travis") || strstr_ptr(ci_environment(), "github-actions")) {
 913                 log_notice("Running on Travis CI/GH Actions under ASan, skipping, see https://github.com/systemd/systemd/issues/10696");
 914                 return EXIT_TEST_SKIP;
 915         }
 916 #endif
 917
 918         assert_se(unsetenv("USER") == 0);
 919         assert_se(unsetenv("LOGNAME") == 0);
 920         assert_se(unsetenv("SHELL") == 0);
 921         assert_se(unsetenv("HOME") == 0);
 922         assert_se(unsetenv("TMPDIR") == 0);
 923
 924         can_unshare = have_namespaces();
 925
 926         /* It is needed otherwise cgroup creation fails */
 927         if (getuid() != 0)
 928                 return log_tests_skipped("not root");
 929
 930         r = enter_cgroup_subroot(NULL);
 931         if (r == -ENOMEDIUM)
 932                 return log_tests_skipped("cgroupfs not available");
 933
 934         _cleanup_free_ char *unit_dir = NULL;
 935         assert_se(get_testdata_dir("test-execute/", &unit_dir) >= 0);
 936         assert_se(set_unit_path(unit_dir) >= 0);
 937         assert_se(runtime_dir = setup_fake_runtime_dir());
 938
 939         /* Unset VAR1, VAR2 and VAR3 which are used in the PassEnvironment test
 940          * cases, otherwise (and if they are present in the environment),
 941          * `manager_default_environment` will copy them into the default
 942          * environment which is passed to each created job, which will make the
 943          * tests that expect those not to be present to fail.
 944          */
 945         assert_se(unsetenv("VAR1") == 0);
 946         assert_se(unsetenv("VAR2") == 0);
 947         assert_se(unsetenv("VAR3") == 0);
 948
 949         r = run_tests(UNIT_FILE_USER, user_tests, argv + 1);
 950         if (r != 0)
 951                 return r;
 952
 953         r = run_tests(UNIT_FILE_SYSTEM, system_tests, argv + 1);
 954         if (r != 0)
 955                 return r;
 956
 957 #if HAVE_SECCOMP
 958         /* The following tests are for 1beab8b0d0ff2d7d1436b52d4a0c3d56dc908962. */
 959         if (!is_seccomp_available()) {
 960                 log_notice("Seccomp not available, skipping unshare() filtered tests.");
 961                 return 0;
 962         }
 963
 964         _cleanup_hashmap_free_ Hashmap *s = NULL;
 965         assert_se(s = hashmap_new(NULL));
 966         r = seccomp_syscall_resolve_name("unshare");
 967         assert_se(r != __NR_SCMP_ERROR);
 968         assert_se(hashmap_put(s, UINT32_TO_PTR(r + 1), INT_TO_PTR(-1)) >= 0);
 969         assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EOPNOTSUPP), true) >= 0);
 970         assert_se(unshare(CLONE_NEWNS) < 0);
 971         assert_se(errno == EOPNOTSUPP);
 972
 973         can_unshare = false;
 974
 975         r = run_tests(UNIT_FILE_USER, user_tests, argv + 1);
 976         if (r != 0)
 977                 return r;
 978
 979         return run_tests(UNIT_FILE_SYSTEM, system_tests, argv + 1);
 980 #else
 981         return 0;
 982 #endif
 983 }