test/units/testsuite-50.sh

   1 #!/usr/bin/env bash
   2 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
   3 # ex: ts=8 sw=4 sts=4 et filetype=sh
   4 set -ex
   5 set -o pipefail
   6
   7 export SYSTEMD_LOG_LEVEL=debug
   8
   9 cleanup()
  10 {
  11     if [ -z "${image_dir}" ]; then
  12         return
  13     fi
  14     rm -rf "${image_dir}"
  15 }
  16
  17 cd /tmp
  18
  19 image_dir="$(mktemp -d -t -p /tmp tmp.XXXXXX)"
  20 if [ -z "${image_dir}" ] || [ ! -d "${image_dir}" ]; then
  21     echo "mktemp under /tmp failed"
  22     exit 1
  23 fi
  24
  25 trap cleanup EXIT
  26
  27 cp /usr/share/minimal.* "${image_dir}/"
  28 image="${image_dir}/minimal"
  29 roothash="$(cat ${image}.roothash)"
  30
  31 os_release=$(test -e /etc/os-release && echo /etc/os-release || echo /usr/lib/os-release)
  32
  33 systemd-dissect --json=short ${image}.raw | grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"fstype":"squashfs","architecture":null,"verity":"external"'
  34 systemd-dissect ${image}.raw | grep -q -F "MARKER=1"
  35 systemd-dissect ${image}.raw | grep -q -F -f $os_release
  36
  37 mv ${image}.verity ${image}.fooverity
  38 mv ${image}.roothash ${image}.foohash
  39 systemd-dissect --json=short ${image}.raw --root-hash=${roothash} --verity-data=${image}.fooverity | grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"fstype":"squashfs","architecture":null,"verity":"external"'
  40 systemd-dissect ${image}.raw --root-hash=${roothash} --verity-data=${image}.fooverity | grep -q -F "MARKER=1"
  41 systemd-dissect ${image}.raw --root-hash=${roothash} --verity-data=${image}.fooverity | grep -q -F -f $os_release
  42 mv ${image}.fooverity ${image}.verity
  43 mv ${image}.foohash ${image}.roothash
  44
  45 mkdir -p ${image_dir}/mount ${image_dir}/mount2
  46 systemd-dissect --mount ${image}.raw ${image_dir}/mount
  47 cat ${image_dir}/mount/usr/lib/os-release | grep -q -F -f $os_release
  48 cat ${image_dir}/mount/etc/os-release | grep -q -F -f $os_release
  49 cat ${image_dir}/mount/usr/lib/os-release | grep -q -F "MARKER=1"
  50 # Verity volume should be shared (opened only once)
  51 systemd-dissect --mount ${image}.raw ${image_dir}/mount2
  52 verity_count=$(ls -1 /dev/mapper/ | grep -c verity)
  53 # In theory we should check that count is exactly one. In practice, libdevmapper
  54 # randomly and unpredictably fails with an unhelpful EINVAL when a device is open
  55 # (and even mounted and in use), so best-effort is the most we can do for now
  56 if [ ${verity_count} -lt 1 ]; then
  57     echo "Verity device ${image}.raw not found in /dev/mapper/"
  58     exit 1
  59 fi
  60 umount ${image_dir}/mount
  61 umount ${image_dir}/mount2
  62
  63 systemd-run -t -p RootImage=${image}.raw cat /usr/lib/os-release | grep -q -F "MARKER=1"
  64 mv ${image}.verity ${image}.fooverity
  65 mv ${image}.roothash ${image}.foohash
  66 systemd-run -t -p RootImage=${image}.raw -p RootHash=${image}.foohash -p RootVerity=${image}.fooverity cat /usr/lib/os-release | grep -q -F "MARKER=1"
  67 # Let's use the long option name just here as a test
  68 systemd-run -t --property RootImage=${image}.raw --property RootHash=${roothash} --property RootVerity=${image}.fooverity cat /usr/lib/os-release | grep -q -F "MARKER=1"
  69 mv ${image}.fooverity ${image}.verity
  70 mv ${image}.foohash ${image}.roothash
  71
  72 # Make a GPT disk on the fly, with the squashfs as partition 1 and the verity hash tree as partition 2
  73 machine="$(uname -m)"
  74 if [ "${machine}" = "x86_64" ]; then
  75     root_guid=4f68bce3-e8cd-4db1-96e7-fbcaf984b709
  76     verity_guid=2c7357ed-ebd2-46d9-aec1-23d437ec2bf5
  77 elif [ "${machine}" = "i386" ] || [ "${machine}" = "i686" ] || [ "${machine}" = "x86" ]; then
  78     root_guid=44479540-f297-41b2-9af7-d131d5f0458a
  79     verity_guid=d13c5d3b-b5d1-422a-b29f-9454fdc89d76
  80 elif [ "${machine}" = "aarch64" ] || [ "${machine}" = "aarch64_be" ] || [ "${machine}" = "armv8b" ] || [ "${machine}" = "armv8l" ]; then
  81     root_guid=b921b045-1df0-41c3-af44-4c6f280d3fae
  82     verity_guid=df3300ce-d69f-4c92-978c-9bfb0f38d820
  83 elif [ "${machine}" = "arm" ]; then
  84     root_guid=69dad710-2ce4-4e3c-b16c-21a1d49abed3
  85     verity_guid=7386cdf2-203c-47a9-a498-f2ecce45a2d6
  86 elif [ "${machine}" = "ia64" ]; then
  87     root_guid=993d8d3d-f80e-4225-855a-9daf8ed7ea97
  88     verity_guid=86ed10d5-b607-45bb-8957-d350f23d0571
  89 else
  90     echo "Unexpected uname -m: ${machine} in testsuite-50.sh, please fix me"
  91     exit 1
  92 fi
  93 # du rounds up to block size, which is more helpful for partitioning
  94 root_size="$(du -k ${image}.raw | cut -f1)"
  95 verity_size="$(du -k ${image}.verity | cut -f1)"
  96 # 4MB seems to be the minimum size blkid will accept, below that probing fails
  97 dd if=/dev/zero of=${image}.gpt bs=512 count=$((8192+${root_size}*2+${verity_size}*2))
  98 # sfdisk seems unhappy if the size overflows into the next unit, eg: 1580KiB will be interpreted as 1MiB
  99 # so do some basic rounding up if the minimal image is more than 1 MB
 100 if [ ${root_size} -ge 1024 ]; then
 101     root_size="$((${root_size}/1024 + 1))MiB"
 102 else
 103     root_size="${root_size}KiB"
 104 fi
 105 verity_size="$((${verity_size} * 2))KiB"
 106 uuid="$(head -c 32 ${image}.roothash | cut -c -8)-$(head -c 32 ${image}.roothash | cut -c 9-12)-$(head -c 32 ${image}.roothash | cut -c 13-16)-$(head -c 32 ${image}.roothash | cut -c 17-20)-$(head -c 32 ${image}.roothash | cut -c 21-)"
 107 echo -e "label: gpt\nsize=${root_size}, type=${root_guid}, uuid=${uuid}" | sfdisk ${image}.gpt
 108 uuid="$(tail -c 32 ${image}.roothash | cut -c -8)-$(tail -c 32 ${image}.roothash | cut -c 9-12)-$(tail -c 32 ${image}.roothash | cut -c 13-16)-$(tail -c 32 ${image}.roothash | cut -c 17-20)-$(tail -c 32 ${image}.roothash | cut -c 21-)"
 109 echo -e "size=${verity_size}, type=${verity_guid}, uuid=${uuid}" | sfdisk ${image}.gpt --append
 110 sfdisk --part-label ${image}.gpt 1 "Root Partition"
 111 sfdisk --part-label ${image}.gpt 2 "Verity Partition"
 112 loop="$(losetup --show -P -f ${image}.gpt)"
 113 dd if=${image}.raw of=${loop}p1
 114 dd if=${image}.verity of=${loop}p2
 115 losetup -d ${loop}
 116
 117 # Derive partition UUIDs from root hash, in UUID syntax
 118 ROOT_UUID=$(systemd-id128 -u show $(head -c 32 ${image}.roothash) -u | tail -n 1 | cut -b 6-)
 119 VERITY_UUID=$(systemd-id128 -u show $(tail -c 32 ${image}.roothash) -u | tail -n 1 | cut -b 6-)
 120
 121 systemd-dissect --json=short --root-hash ${roothash} ${image}.gpt | grep -q '{"rw":"ro","designator":"root","partition_uuid":"'$ROOT_UUID'","fstype":"squashfs","architecture":"x86-64","verity":"yes","node":'
 122 systemd-dissect --json=short --root-hash ${roothash} ${image}.gpt | grep -q '{"rw":"ro","designator":"root-verity","partition_uuid":"'$VERITY_UUID'","fstype":"DM_verity_hash","architecture":"x86-64","verity":null,"node":'
 123 systemd-dissect --root-hash ${roothash} ${image}.gpt | grep -q -F "MARKER=1"
 124 systemd-dissect --root-hash ${roothash} ${image}.gpt | grep -q -F -f $os_release
 125
 126 systemd-dissect --root-hash ${roothash} --mount ${image}.gpt ${image_dir}/mount
 127 cat ${image_dir}/mount/usr/lib/os-release | grep -q -F -f $os_release
 128 cat ${image_dir}/mount/etc/os-release | grep -q -F -f $os_release
 129 cat ${image_dir}/mount/usr/lib/os-release | grep -q -F "MARKER=1"
 130 umount ${image_dir}/mount
 131
 132 # add explicit -p MountAPIVFS=yes once to test the parser
 133 systemd-run -t -p RootImage=${image}.gpt -p RootHash=${roothash} -p MountAPIVFS=yes cat /usr/lib/os-release | grep -q -F "MARKER=1"
 134
 135 systemd-run -t -p RootImage=${image}.raw -p RootImageOptions="root:nosuid,dev home:ro,dev ro,noatime" mount | grep -F "squashfs" | grep -q -F "nosuid"
 136 systemd-run -t -p RootImage=${image}.gpt -p RootImageOptions="root:ro,noatime root:ro,dev" mount | grep -F "squashfs" | grep -q -F "noatime"
 137
 138 mkdir -p mkdir -p ${image_dir}/result
 139 cat >/run/systemd/system/testservice-50a.service <<EOF
 140 [Service]
 141 Type=oneshot
 142 ExecStart=bash -c "mount >/run/result/a"
 143 BindPaths=${image_dir}/result:/run/result
 144 TemporaryFileSystem=/run
 145 RootImage=${image}.raw
 146 RootImageOptions=root:ro,noatime home:ro,dev relatime,dev
 147 RootImageOptions=nosuid,dev
 148 EOF
 149 systemctl start testservice-50a.service
 150 grep -F "squashfs" ${image_dir}/result/a | grep -q -F "noatime"
 151 grep -F "squashfs" ${image_dir}/result/a | grep -q -F -v "nosuid"
 152
 153 cat >/run/systemd/system/testservice-50b.service <<EOF
 154 [Service]
 155 Type=oneshot
 156 ExecStart=bash -c "mount >/run/result/b"
 157 BindPaths=${image_dir}/result:/run/result
 158 TemporaryFileSystem=/run
 159 RootImage=${image}.gpt
 160 RootImageOptions=root:ro,noatime,nosuid home:ro,dev nosuid,dev
 161 RootImageOptions=home:ro,dev nosuid,dev,%%foo
 162 # this is the default, but let's specify once to test the parser
 163 MountAPIVFS=yes
 164 EOF
 165 systemctl start testservice-50b.service
 166 grep -F "squashfs" ${image_dir}/result/b | grep -q -F "noatime"
 167
 168 # Check that specifier escape is applied %%foo → %foo
 169 busctl get-property org.freedesktop.systemd1 /org/freedesktop/systemd1/unit/testservice_2d50b_2eservice org.freedesktop.systemd1.Service RootImageOptions | grep -F "nosuid,dev,%foo"
 170
 171 # Now do some checks with MountImages, both by itself, with options and in combination with RootImage, and as single FS or GPT image
 172 systemd-run -t -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /run/img1/usr/lib/os-release | grep -q -F "MARKER=1"
 173 systemd-run -t -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /run/img2/usr/lib/os-release | grep -q -F "MARKER=1"
 174 systemd-run -t -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2:nosuid,dev" mount | grep -F "squashfs" | grep -q -F "nosuid"
 175 systemd-run -t -p MountImages="${image}.gpt:/run/img1:root:nosuid ${image}.raw:/run/img2:home:suid" mount | grep -F "squashfs" | grep -q -F "nosuid"
 176 systemd-run -t -p MountImages="${image}.raw:/run/img2\:3" cat /run/img2:3/usr/lib/os-release | grep -q -F "MARKER=1"
 177 systemd-run -t -p MountImages="${image}.raw:/run/img2\:3:nosuid" mount | grep -F "squashfs" | grep -q -F "nosuid"
 178 systemd-run -t -p TemporaryFileSystem=/run -p RootImage=${image}.raw -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /usr/lib/os-release | grep -q -F "MARKER=1"
 179 systemd-run -t -p TemporaryFileSystem=/run -p RootImage=${image}.raw -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /run/img1/usr/lib/os-release | grep -q -F "MARKER=1"
 180 systemd-run -t -p TemporaryFileSystem=/run -p RootImage=${image}.gpt -p RootHash=${roothash} -p MountImages="${image}.gpt:/run/img1 ${image}.raw:/run/img2" cat /run/img2/usr/lib/os-release | grep -q -F "MARKER=1"
 181 cat >/run/systemd/system/testservice-50c.service <<EOF
 182 [Service]
 183 MountAPIVFS=yes
 184 TemporaryFileSystem=/run
 185 RootImage=${image}.raw
 186 MountImages=${image}.gpt:/run/img1:root:noatime:home:relatime
 187 MountImages=${image}.raw:/run/img2\:3:nosuid
 188 ExecStart=bash -c "cat /run/img1/usr/lib/os-release >/run/result/c"
 189 ExecStart=bash -c "cat /run/img2:3/usr/lib/os-release >>/run/result/c"
 190 ExecStart=bash -c "mount >>/run/result/c"
 191 BindPaths=${image_dir}/result:/run/result
 192 Type=oneshot
 193 EOF
 194 systemctl start testservice-50c.service
 195 grep -q -F "MARKER=1" ${image_dir}/result/c
 196 grep -F "squashfs" ${image_dir}/result/c | grep -q -F "noatime"
 197 grep -F "squashfs" ${image_dir}/result/c | grep -q -F -v "nosuid"
 198
 199 echo OK >/testok
 200
 201 exit 0