]>
Commit | Line | Data |
---|---|---|
53e1b683 | 1 | /* SPDX-License-Identifier: LGPL-2.1+ */ |
281e05b6 RC |
2 | /*** |
3 | This file is part of systemd. | |
4 | ||
5 | Copyright 2014 Ronny Chevalier | |
281e05b6 RC |
6 | ***/ |
7 | ||
cc7fa4fb RC |
8 | #include <grp.h> |
9 | #include <pwd.h> | |
ff4ca461 | 10 | #include <stdio.h> |
70d7aea5 | 11 | #include <sys/prctl.h> |
ff4ca461 | 12 | #include <sys/types.h> |
281e05b6 | 13 | |
b7856f92 | 14 | #include "capability-util.h" |
4e79aeaa | 15 | #include "cpu-set-util.h" |
b4891260 | 16 | #include "errno-list.h" |
03bd70dd | 17 | #include "fileio.h" |
f4f15635 | 18 | #include "fs-util.h" |
281e05b6 | 19 | #include "macro.h" |
f4f15635 | 20 | #include "manager.h" |
281e05b6 | 21 | #include "mkdir.h" |
ff4ca461 | 22 | #include "path-util.h" |
c6878637 | 23 | #include "rm-rf.h" |
349cc4a5 | 24 | #if HAVE_SECCOMP |
83f12b27 FS |
25 | #include "seccomp-util.h" |
26 | #endif | |
34b86909 | 27 | #include "stat-util.h" |
8b3aa503 | 28 | #include "test-helper.h" |
cc100a5a | 29 | #include "tests.h" |
f4f15635 | 30 | #include "unit.h" |
57c2efa0 | 31 | #include "user-util.h" |
f4f15635 | 32 | #include "util.h" |
4dd4cb8f | 33 | #include "virt.h" |
281e05b6 RC |
34 | |
35 | typedef void (*test_function_t)(Manager *m); | |
36 | ||
37 | static void check(Manager *m, Unit *unit, int status_expected, int code_expected) { | |
38 | Service *service = NULL; | |
39 | usec_t ts; | |
8adb3d63 | 40 | usec_t timeout = 2 * USEC_PER_MINUTE; |
281e05b6 RC |
41 | |
42 | assert_se(m); | |
43 | assert_se(unit); | |
44 | ||
45 | service = SERVICE(unit); | |
46 | printf("%s\n", unit->id); | |
47 | exec_context_dump(&service->exec_context, stdout, "\t"); | |
48 | ts = now(CLOCK_MONOTONIC); | |
ec2ce0c5 | 49 | while (!IN_SET(service->state, SERVICE_DEAD, SERVICE_FAILED)) { |
281e05b6 RC |
50 | int r; |
51 | usec_t n; | |
52 | ||
53 | r = sd_event_run(m->event, 100 * USEC_PER_MSEC); | |
54 | assert_se(r >= 0); | |
55 | ||
56 | n = now(CLOCK_MONOTONIC); | |
57 | if (ts + timeout < n) { | |
58 | log_error("Test timeout when testing %s", unit->id); | |
59 | exit(EXIT_FAILURE); | |
60 | } | |
61 | } | |
62 | exec_status_dump(&service->main_exec_status, stdout, "\t"); | |
63 | assert_se(service->main_exec_status.status == status_expected); | |
64 | assert_se(service->main_exec_status.code == code_expected); | |
65 | } | |
66 | ||
57c2efa0 YW |
67 | static bool check_nobody_user_and_group(void) { |
68 | static int cache = -1; | |
69 | struct passwd *p; | |
70 | struct group *g; | |
71 | ||
72 | if (cache >= 0) | |
73 | return !!cache; | |
74 | ||
75 | if (!synthesize_nobody()) | |
76 | goto invalid; | |
77 | ||
78 | p = getpwnam(NOBODY_USER_NAME); | |
79 | if (!p || | |
80 | !streq(p->pw_name, NOBODY_USER_NAME) || | |
81 | p->pw_uid != UID_NOBODY || | |
82 | p->pw_gid != GID_NOBODY) | |
83 | goto invalid; | |
84 | ||
85 | p = getpwuid(UID_NOBODY); | |
86 | if (!p || | |
87 | !streq(p->pw_name, NOBODY_USER_NAME) || | |
88 | p->pw_uid != UID_NOBODY || | |
89 | p->pw_gid != GID_NOBODY) | |
90 | goto invalid; | |
91 | ||
92 | g = getgrnam(NOBODY_GROUP_NAME); | |
93 | if (!g || | |
94 | !streq(g->gr_name, NOBODY_GROUP_NAME) || | |
95 | g->gr_gid != GID_NOBODY) | |
96 | goto invalid; | |
97 | ||
98 | g = getgrgid(GID_NOBODY); | |
99 | if (!g || | |
100 | !streq(g->gr_name, NOBODY_GROUP_NAME) || | |
101 | g->gr_gid != GID_NOBODY) | |
102 | goto invalid; | |
103 | ||
104 | cache = 1; | |
105 | return true; | |
106 | ||
107 | invalid: | |
108 | cache = 0; | |
109 | return false; | |
110 | } | |
111 | ||
6086d2da DP |
112 | static bool is_inaccessible_available(void) { |
113 | char *p; | |
114 | ||
115 | FOREACH_STRING(p, | |
116 | "/run/systemd/inaccessible/reg", | |
117 | "/run/systemd/inaccessible/dir", | |
118 | "/run/systemd/inaccessible/chr", | |
119 | "/run/systemd/inaccessible/blk", | |
120 | "/run/systemd/inaccessible/fifo", | |
121 | "/run/systemd/inaccessible/sock" | |
122 | ) { | |
123 | if (access(p, F_OK) < 0) | |
124 | return false; | |
125 | } | |
126 | ||
127 | return true; | |
128 | } | |
129 | ||
281e05b6 RC |
130 | static void test(Manager *m, const char *unit_name, int status_expected, int code_expected) { |
131 | Unit *unit; | |
132 | ||
133 | assert_se(unit_name); | |
134 | ||
ba412430 | 135 | assert_se(manager_load_startable_unit_or_warn(m, unit_name, NULL, &unit) >= 0); |
281e05b6 RC |
136 | assert_se(UNIT_VTABLE(unit)->start(unit) >= 0); |
137 | check(m, unit, status_expected, code_expected); | |
138 | } | |
139 | ||
f0e018e7 YW |
140 | static void test_exec_bindpaths(Manager *m) { |
141 | assert_se(mkdir_p("/tmp/test-exec-bindpaths", 0755) >= 0); | |
142 | assert_se(mkdir_p("/tmp/test-exec-bindreadonlypaths", 0755) >= 0); | |
d053b72b | 143 | |
f0e018e7 | 144 | test(m, "exec-bindpaths.service", 0, CLD_EXITED); |
d053b72b | 145 | |
f0e018e7 YW |
146 | (void) rm_rf("/tmp/test-exec-bindpaths", REMOVE_ROOT|REMOVE_PHYSICAL); |
147 | (void) rm_rf("/tmp/test-exec-bindreadonlypaths", REMOVE_ROOT|REMOVE_PHYSICAL); | |
d053b72b YW |
148 | } |
149 | ||
4e79aeaa YW |
150 | static void test_exec_cpuaffinity(Manager *m) { |
151 | _cleanup_cpu_free_ cpu_set_t *c = NULL; | |
152 | unsigned n; | |
153 | ||
154 | assert_se(c = cpu_set_malloc(&n)); | |
155 | assert_se(sched_getaffinity(0, CPU_ALLOC_SIZE(n), c) >= 0); | |
156 | ||
157 | if (CPU_ISSET_S(0, CPU_ALLOC_SIZE(n), c) == 0) { | |
158 | log_notice("Cannot use CPU 0, skipping %s", __func__); | |
159 | return; | |
160 | } | |
161 | ||
162 | test(m, "exec-cpuaffinity1.service", 0, CLD_EXITED); | |
163 | test(m, "exec-cpuaffinity2.service", 0, CLD_EXITED); | |
164 | ||
165 | if (CPU_ISSET_S(1, CPU_ALLOC_SIZE(n), c) == 0 || | |
166 | CPU_ISSET_S(2, CPU_ALLOC_SIZE(n), c) == 0) { | |
167 | log_notice("Cannot use CPU 1 or 2, skipping remaining tests in %s", __func__); | |
168 | return; | |
169 | } | |
170 | ||
171 | test(m, "exec-cpuaffinity3.service", 0, CLD_EXITED); | |
172 | } | |
173 | ||
281e05b6 RC |
174 | static void test_exec_workingdirectory(Manager *m) { |
175 | assert_se(mkdir_p("/tmp/test-exec_workingdirectory", 0755) >= 0); | |
176 | ||
177 | test(m, "exec-workingdirectory.service", 0, CLD_EXITED); | |
178 | ||
c6878637 | 179 | (void) rm_rf("/tmp/test-exec_workingdirectory", REMOVE_ROOT|REMOVE_PHYSICAL); |
281e05b6 RC |
180 | } |
181 | ||
182 | static void test_exec_personality(Manager *m) { | |
281e05b6 RC |
183 | #if defined(__x86_64__) |
184 | test(m, "exec-personality-x86-64.service", 0, CLD_EXITED); | |
7517f51e HB |
185 | |
186 | #elif defined(__s390__) | |
187 | test(m, "exec-personality-s390.service", 0, CLD_EXITED); | |
188 | ||
12591863 JS |
189 | #elif defined(__powerpc64__) |
190 | # if __BYTE_ORDER == __BIG_ENDIAN | |
191 | test(m, "exec-personality-ppc64.service", 0, CLD_EXITED); | |
192 | # else | |
193 | test(m, "exec-personality-ppc64le.service", 0, CLD_EXITED); | |
194 | # endif | |
195 | ||
196 | #elif defined(__aarch64__) | |
197 | test(m, "exec-personality-aarch64.service", 0, CLD_EXITED); | |
198 | ||
5798eb4c | 199 | #elif defined(__i386__) |
7517f51e | 200 | test(m, "exec-personality-x86.service", 0, CLD_EXITED); |
f0e018e7 YW |
201 | #else |
202 | log_notice("Unknown personality, skipping %s", __func__); | |
281e05b6 RC |
203 | #endif |
204 | } | |
205 | ||
206 | static void test_exec_ignoresigpipe(Manager *m) { | |
207 | test(m, "exec-ignoresigpipe-yes.service", 0, CLD_EXITED); | |
208 | test(m, "exec-ignoresigpipe-no.service", SIGPIPE, CLD_KILLED); | |
209 | } | |
210 | ||
211 | static void test_exec_privatetmp(Manager *m) { | |
212 | assert_se(touch("/tmp/test-exec_privatetmp") >= 0); | |
213 | ||
214 | test(m, "exec-privatetmp-yes.service", 0, CLD_EXITED); | |
215 | test(m, "exec-privatetmp-no.service", 0, CLD_EXITED); | |
216 | ||
217 | unlink("/tmp/test-exec_privatetmp"); | |
218 | } | |
219 | ||
220 | static void test_exec_privatedevices(Manager *m) { | |
f0e018e7 YW |
221 | int r; |
222 | ||
4dd4cb8f | 223 | if (detect_container() > 0) { |
f0e018e7 | 224 | log_notice("Testing in container, skipping %s", __func__); |
4dd4cb8f SM |
225 | return; |
226 | } | |
6086d2da | 227 | if (!is_inaccessible_available()) { |
f0e018e7 | 228 | log_notice("Testing without inaccessible, skipping %s", __func__); |
6086d2da DP |
229 | return; |
230 | } | |
231 | ||
281e05b6 RC |
232 | test(m, "exec-privatedevices-yes.service", 0, CLD_EXITED); |
233 | test(m, "exec-privatedevices-no.service", 0, CLD_EXITED); | |
cfa24ca0 | 234 | test(m, "exec-privatedevices-disabled-by-prefix.service", 0, CLD_EXITED); |
6086d2da | 235 | |
0608ba98 ZJS |
236 | /* We use capsh to test if the capabilities are |
237 | * properly set, so be sure that it exists */ | |
238 | r = find_binary("capsh", NULL); | |
239 | if (r < 0) { | |
5cd33ccc | 240 | log_notice_errno(r, "Could not find capsh binary, skipping remaining tests in %s: %m", __func__); |
6086d2da DP |
241 | return; |
242 | } | |
243 | ||
615a1f4b DH |
244 | test(m, "exec-privatedevices-yes-capability-mknod.service", 0, CLD_EXITED); |
245 | test(m, "exec-privatedevices-no-capability-mknod.service", 0, CLD_EXITED); | |
625d8769 DH |
246 | test(m, "exec-privatedevices-yes-capability-sys-rawio.service", 0, CLD_EXITED); |
247 | test(m, "exec-privatedevices-no-capability-sys-rawio.service", 0, CLD_EXITED); | |
615a1f4b DH |
248 | } |
249 | ||
4982dbcc | 250 | static void test_exec_protectkernelmodules(Manager *m) { |
0608ba98 ZJS |
251 | int r; |
252 | ||
3ae33295 | 253 | if (detect_container() > 0) { |
f0e018e7 | 254 | log_notice("Testing in container, skipping %s", __func__); |
3ae33295 DH |
255 | return; |
256 | } | |
6086d2da | 257 | if (!is_inaccessible_available()) { |
f0e018e7 | 258 | log_notice("Testing without inaccessible, skipping %s", __func__); |
6086d2da DP |
259 | return; |
260 | } | |
3ae33295 | 261 | |
0608ba98 ZJS |
262 | r = find_binary("capsh", NULL); |
263 | if (r < 0) { | |
5cd33ccc | 264 | log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); |
0608ba98 ZJS |
265 | return; |
266 | } | |
267 | ||
3ae33295 DH |
268 | test(m, "exec-protectkernelmodules-no-capabilities.service", 0, CLD_EXITED); |
269 | test(m, "exec-protectkernelmodules-yes-capabilities.service", 0, CLD_EXITED); | |
4982dbcc | 270 | test(m, "exec-protectkernelmodules-yes-mount-propagation.service", 0, CLD_EXITED); |
3ae33295 DH |
271 | } |
272 | ||
f78b36f0 | 273 | static void test_exec_readonlypaths(Manager *m) { |
34b86909 | 274 | |
f0e018e7 YW |
275 | test(m, "exec-readonlypaths-simple.service", 0, CLD_EXITED); |
276 | ||
277 | if (path_is_read_only_fs("/var") > 0) { | |
278 | log_notice("Directory /var is readonly, skipping remaining tests in %s", __func__); | |
34b86909 | 279 | return; |
f0e018e7 | 280 | } |
34b86909 | 281 | |
f78b36f0 | 282 | test(m, "exec-readonlypaths.service", 0, CLD_EXITED); |
cdfbd1fb | 283 | test(m, "exec-readonlypaths-mount-propagation.service", 0, CLD_EXITED); |
23fd04e9 | 284 | test(m, "exec-readonlypaths-with-bindpaths.service", 0, CLD_EXITED); |
cdfbd1fb DH |
285 | } |
286 | ||
287 | static void test_exec_readwritepaths(Manager *m) { | |
34b86909 | 288 | |
f0e018e7 YW |
289 | if (path_is_read_only_fs("/") > 0) { |
290 | log_notice("Root directory is readonly, skipping %s", __func__); | |
34b86909 | 291 | return; |
f0e018e7 | 292 | } |
34b86909 | 293 | |
cdfbd1fb DH |
294 | test(m, "exec-readwritepaths-mount-propagation.service", 0, CLD_EXITED); |
295 | } | |
296 | ||
297 | static void test_exec_inaccessiblepaths(Manager *m) { | |
34b86909 | 298 | |
f0e018e7 YW |
299 | if (!is_inaccessible_available()) { |
300 | log_notice("Testing without inaccessible, skipping %s", __func__); | |
34b86909 | 301 | return; |
f0e018e7 | 302 | } |
34b86909 | 303 | |
f0e018e7 | 304 | test(m, "exec-inaccessiblepaths-proc.service", 0, CLD_EXITED); |
f78b36f0 | 305 | |
f0e018e7 YW |
306 | if (path_is_read_only_fs("/") > 0) { |
307 | log_notice("Root directory is readonly, skipping remaining tests in %s", __func__); | |
af4af186 EV |
308 | return; |
309 | } | |
310 | ||
f0e018e7 | 311 | test(m, "exec-inaccessiblepaths-mount-propagation.service", 0, CLD_EXITED); |
c090d74d TR |
312 | } |
313 | ||
4cac89bd YW |
314 | static void test_exec_temporaryfilesystem(Manager *m) { |
315 | ||
316 | test(m, "exec-temporaryfilesystem-options.service", 0, CLD_EXITED); | |
317 | test(m, "exec-temporaryfilesystem-ro.service", 0, CLD_EXITED); | |
318 | test(m, "exec-temporaryfilesystem-rw.service", 0, CLD_EXITED); | |
319 | test(m, "exec-temporaryfilesystem-usr.service", 0, CLD_EXITED); | |
320 | } | |
321 | ||
281e05b6 | 322 | static void test_exec_systemcallfilter(Manager *m) { |
349cc4a5 | 323 | #if HAVE_SECCOMP |
f0e018e7 YW |
324 | if (!is_seccomp_available()) { |
325 | log_notice("Seccomp not available, skipping %s", __func__); | |
83f12b27 | 326 | return; |
f0e018e7 YW |
327 | } |
328 | ||
281e05b6 RC |
329 | test(m, "exec-systemcallfilter-not-failing.service", 0, CLD_EXITED); |
330 | test(m, "exec-systemcallfilter-not-failing2.service", 0, CLD_EXITED); | |
331 | test(m, "exec-systemcallfilter-failing.service", SIGSYS, CLD_KILLED); | |
332 | test(m, "exec-systemcallfilter-failing2.service", SIGSYS, CLD_KILLED); | |
b4891260 YW |
333 | test(m, "exec-systemcallfilter-with-errno-name.service", errno_from_name("EILSEQ"), CLD_EXITED); |
334 | test(m, "exec-systemcallfilter-with-errno-number.service", 255, CLD_EXITED); | |
281e05b6 RC |
335 | #endif |
336 | } | |
337 | ||
338 | static void test_exec_systemcallerrornumber(Manager *m) { | |
349cc4a5 | 339 | #if HAVE_SECCOMP |
f0e018e7 YW |
340 | if (!is_seccomp_available()) { |
341 | log_notice("Seccomp not available, skipping %s", __func__); | |
7a18854f | 342 | return; |
f0e018e7 YW |
343 | } |
344 | ||
7a18854f YW |
345 | test(m, "exec-systemcallerrornumber-name.service", errno_from_name("EACCES"), CLD_EXITED); |
346 | test(m, "exec-systemcallerrornumber-number.service", 255, CLD_EXITED); | |
281e05b6 RC |
347 | #endif |
348 | } | |
349 | ||
f0e018e7 | 350 | static void test_exec_restrictnamespaces(Manager *m) { |
349cc4a5 | 351 | #if HAVE_SECCOMP |
f0e018e7 YW |
352 | if (!is_seccomp_available()) { |
353 | log_notice("Seccomp not available, skipping %s", __func__); | |
97e60383 | 354 | return; |
f0e018e7 | 355 | } |
97e60383 | 356 | |
f0e018e7 YW |
357 | test(m, "exec-restrictnamespaces-no.service", 0, CLD_EXITED); |
358 | test(m, "exec-restrictnamespaces-yes.service", 1, CLD_EXITED); | |
359 | test(m, "exec-restrictnamespaces-mnt.service", 0, CLD_EXITED); | |
360 | test(m, "exec-restrictnamespaces-mnt-blacklist.service", 1, CLD_EXITED); | |
97e60383 DH |
361 | #endif |
362 | } | |
363 | ||
f0e018e7 | 364 | static void test_exec_systemcallfilter_system(Manager *m) { |
349cc4a5 | 365 | #if HAVE_SECCOMP |
f0e018e7 YW |
366 | if (!is_seccomp_available()) { |
367 | log_notice("Seccomp not available, skipping %s", __func__); | |
83f12b27 | 368 | return; |
f0e018e7 | 369 | } |
57c2efa0 | 370 | |
69b07407 YW |
371 | test(m, "exec-systemcallfilter-system-user.service", 0, CLD_EXITED); |
372 | ||
57c2efa0 | 373 | if (!check_nobody_user_and_group()) { |
5cd33ccc | 374 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
57c2efa0 YW |
375 | return; |
376 | } | |
377 | ||
69b07407 | 378 | if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { |
5cd33ccc | 379 | log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); |
69b07407 YW |
380 | return; |
381 | } | |
382 | ||
383 | test(m, "exec-systemcallfilter-system-user-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); | |
19c0b0b9 RC |
384 | #endif |
385 | } | |
386 | ||
281e05b6 | 387 | static void test_exec_user(Manager *m) { |
69b07407 YW |
388 | test(m, "exec-user.service", 0, CLD_EXITED); |
389 | ||
57c2efa0 | 390 | if (!check_nobody_user_and_group()) { |
5cd33ccc | 391 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
57c2efa0 YW |
392 | return; |
393 | } | |
394 | ||
69b07407 | 395 | if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { |
5cd33ccc | 396 | log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); |
69b07407 YW |
397 | return; |
398 | } | |
399 | ||
400 | test(m, "exec-user-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); | |
281e05b6 RC |
401 | } |
402 | ||
403 | static void test_exec_group(Manager *m) { | |
69b07407 YW |
404 | test(m, "exec-group.service", 0, CLD_EXITED); |
405 | ||
57c2efa0 | 406 | if (!check_nobody_user_and_group()) { |
5cd33ccc | 407 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
57c2efa0 YW |
408 | return; |
409 | } | |
410 | ||
69b07407 | 411 | if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) { |
5cd33ccc | 412 | log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__); |
69b07407 YW |
413 | return; |
414 | } | |
415 | ||
416 | test(m, "exec-group-" NOBODY_GROUP_NAME ".service", 0, CLD_EXITED); | |
281e05b6 RC |
417 | } |
418 | ||
f0e018e7 | 419 | static void test_exec_supplementarygroups(Manager *m) { |
86b838ea | 420 | test(m, "exec-supplementarygroups.service", 0, CLD_EXITED); |
bf9ace96 DH |
421 | test(m, "exec-supplementarygroups-single-group.service", 0, CLD_EXITED); |
422 | test(m, "exec-supplementarygroups-single-group-user.service", 0, CLD_EXITED); | |
50ca7a35 DH |
423 | test(m, "exec-supplementarygroups-multiple-groups-default-group-user.service", 0, CLD_EXITED); |
424 | test(m, "exec-supplementarygroups-multiple-groups-withgid.service", 0, CLD_EXITED); | |
425 | test(m, "exec-supplementarygroups-multiple-groups-withuid.service", 0, CLD_EXITED); | |
86b838ea DH |
426 | } |
427 | ||
f0e018e7 | 428 | static void test_exec_dynamicuser(Manager *m) { |
2b9ac11e DH |
429 | test(m, "exec-dynamicuser-fixeduser.service", 0, CLD_EXITED); |
430 | test(m, "exec-dynamicuser-fixeduser-one-supplementarygroup.service", 0, CLD_EXITED); | |
5c67067f | 431 | test(m, "exec-dynamicuser-supplementarygroups.service", 0, CLD_EXITED); |
f0e018e7 | 432 | test(m, "exec-dynamicuser-statedir.service", 0, CLD_EXITED); |
028f3a7f YW |
433 | |
434 | test(m, "exec-dynamicuser-statedir-migrate-step1.service", 0, CLD_EXITED); | |
435 | test(m, "exec-dynamicuser-statedir-migrate-step2.service", 0, CLD_EXITED); | |
436 | (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL); | |
437 | (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL); | |
438 | (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL); | |
439 | (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL); | |
2b9ac11e DH |
440 | } |
441 | ||
281e05b6 RC |
442 | static void test_exec_environment(Manager *m) { |
443 | test(m, "exec-environment.service", 0, CLD_EXITED); | |
444 | test(m, "exec-environment-multiple.service", 0, CLD_EXITED); | |
445 | test(m, "exec-environment-empty.service", 0, CLD_EXITED); | |
446 | } | |
447 | ||
03bd70dd RC |
448 | static void test_exec_environmentfile(Manager *m) { |
449 | static const char e[] = | |
450 | "VAR1='word1 word2'\n" | |
451 | "VAR2=word3 \n" | |
452 | "# comment1\n" | |
453 | "\n" | |
454 | "; comment2\n" | |
455 | " ; # comment3\n" | |
456 | "line without an equal\n" | |
9b796f35 | 457 | "VAR3='$word 5 6'\n" |
b6887d7a JH |
458 | "VAR4='new\nline'\n" |
459 | "VAR5=password\\with\\backslashes"; | |
03bd70dd RC |
460 | int r; |
461 | ||
462 | r = write_string_file("/tmp/test-exec_environmentfile.conf", e, WRITE_STRING_FILE_CREATE); | |
463 | assert_se(r == 0); | |
464 | ||
465 | test(m, "exec-environmentfile.service", 0, CLD_EXITED); | |
466 | ||
f0e018e7 | 467 | (void) unlink("/tmp/test-exec_environmentfile.conf"); |
03bd70dd RC |
468 | } |
469 | ||
4c80d201 | 470 | static void test_exec_passenvironment(Manager *m) { |
e1abca2e FB |
471 | /* test-execute runs under MANAGER_USER which, by default, forwards all |
472 | * variables present in the environment, but only those that are | |
473 | * present _at the time it is created_! | |
474 | * | |
475 | * So these PassEnvironment checks are still expected to work, since we | |
476 | * are ensuring the variables are not present at manager creation (they | |
477 | * are unset explicitly in main) and are only set here. | |
478 | * | |
479 | * This is still a good approximation of how a test for MANAGER_SYSTEM | |
480 | * would work. | |
481 | */ | |
4c80d201 FB |
482 | assert_se(setenv("VAR1", "word1 word2", 1) == 0); |
483 | assert_se(setenv("VAR2", "word3", 1) == 0); | |
484 | assert_se(setenv("VAR3", "$word 5 6", 1) == 0); | |
9b796f35 | 485 | assert_se(setenv("VAR4", "new\nline", 1) == 0); |
b6887d7a | 486 | assert_se(setenv("VAR5", "passwordwithbackslashes", 1) == 0); |
4c80d201 FB |
487 | test(m, "exec-passenvironment.service", 0, CLD_EXITED); |
488 | test(m, "exec-passenvironment-repeated.service", 0, CLD_EXITED); | |
489 | test(m, "exec-passenvironment-empty.service", 0, CLD_EXITED); | |
490 | assert_se(unsetenv("VAR1") == 0); | |
491 | assert_se(unsetenv("VAR2") == 0); | |
492 | assert_se(unsetenv("VAR3") == 0); | |
9b796f35 | 493 | assert_se(unsetenv("VAR4") == 0); |
b6887d7a | 494 | assert_se(unsetenv("VAR5") == 0); |
4c80d201 FB |
495 | test(m, "exec-passenvironment-absent.service", 0, CLD_EXITED); |
496 | } | |
497 | ||
27c5347c RC |
498 | static void test_exec_umask(Manager *m) { |
499 | test(m, "exec-umask-default.service", 0, CLD_EXITED); | |
500 | test(m, "exec-umask-0177.service", 0, CLD_EXITED); | |
501 | } | |
502 | ||
cc3ddc85 RC |
503 | static void test_exec_runtimedirectory(Manager *m) { |
504 | test(m, "exec-runtimedirectory.service", 0, CLD_EXITED); | |
505 | test(m, "exec-runtimedirectory-mode.service", 0, CLD_EXITED); | |
69b07407 | 506 | test(m, "exec-runtimedirectory-owner.service", 0, CLD_EXITED); |
57c2efa0 YW |
507 | |
508 | if (!check_nobody_user_and_group()) { | |
5cd33ccc | 509 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
69b07407 YW |
510 | return; |
511 | } | |
512 | ||
513 | if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) { | |
5cd33ccc | 514 | log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__); |
57c2efa0 YW |
515 | return; |
516 | } | |
517 | ||
69b07407 | 518 | test(m, "exec-runtimedirectory-owner-" NOBODY_GROUP_NAME ".service", 0, CLD_EXITED); |
ff4ca461 RC |
519 | } |
520 | ||
521 | static void test_exec_capabilityboundingset(Manager *m) { | |
522 | int r; | |
523 | ||
ff4ca461 RC |
524 | r = find_binary("capsh", NULL); |
525 | if (r < 0) { | |
5cd33ccc | 526 | log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); |
ff4ca461 RC |
527 | return; |
528 | } | |
529 | ||
b7856f92 YW |
530 | if (have_effective_cap(CAP_CHOWN) <= 0 || |
531 | have_effective_cap(CAP_FOWNER) <= 0 || | |
532 | have_effective_cap(CAP_KILL) <= 0) { | |
533 | log_notice("Skipping %s, this process does not have enough capabilities", __func__); | |
534 | return; | |
535 | } | |
536 | ||
ff4ca461 RC |
537 | test(m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED); |
538 | test(m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED); | |
539 | test(m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED); | |
540 | test(m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED); | |
cc3ddc85 RC |
541 | } |
542 | ||
5008da1e ZJS |
543 | static void test_exec_basic(Manager *m) { |
544 | test(m, "exec-basic.service", 0, CLD_EXITED); | |
545 | } | |
546 | ||
b6dc25ee | 547 | static void test_exec_ambientcapabilities(Manager *m) { |
70d7aea5 IP |
548 | int r; |
549 | ||
550 | /* Check if the kernel has support for ambient capabilities. Run | |
551 | * the tests only if that's the case. Clearing all ambient | |
552 | * capabilities is fine, since we are expecting them to be unset | |
553 | * in the first place for the tests. */ | |
554 | r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0); | |
f0e018e7 | 555 | if (r < 0 && IN_SET(errno, EINVAL, EOPNOTSUPP, ENOSYS)) { |
5cd33ccc | 556 | log_notice("Skipping %s, the kernel does not support ambient capabilities", __func__); |
f0e018e7 YW |
557 | return; |
558 | } | |
559 | ||
e5ba1d32 | 560 | if (have_effective_cap(CAP_CHOWN) <= 0 || |
b7856f92 YW |
561 | have_effective_cap(CAP_NET_RAW) <= 0) { |
562 | log_notice("Skipping %s, this process does not have enough capabilities", __func__); | |
563 | return; | |
564 | } | |
565 | ||
b6dc25ee YW |
566 | test(m, "exec-ambientcapabilities.service", 0, CLD_EXITED); |
567 | test(m, "exec-ambientcapabilities-merge.service", 0, CLD_EXITED); | |
69b07407 | 568 | |
57c2efa0 | 569 | if (!check_nobody_user_and_group()) { |
5cd33ccc | 570 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
69b07407 YW |
571 | return; |
572 | } | |
573 | ||
574 | if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { | |
5cd33ccc | 575 | log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); |
57c2efa0 YW |
576 | return; |
577 | } | |
578 | ||
b6dc25ee YW |
579 | test(m, "exec-ambientcapabilities-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); |
580 | test(m, "exec-ambientcapabilities-merge-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); | |
70d7aea5 IP |
581 | } |
582 | ||
63447f11 RC |
583 | static void test_exec_privatenetwork(Manager *m) { |
584 | int r; | |
585 | ||
586 | r = find_binary("ip", NULL); | |
587 | if (r < 0) { | |
5cd33ccc | 588 | log_notice_errno(r, "Skipping %s, could not find ip binary: %m", __func__); |
63447f11 RC |
589 | return; |
590 | } | |
591 | ||
592 | test(m, "exec-privatenetwork-yes.service", 0, CLD_EXITED); | |
593 | } | |
594 | ||
c388dfea RC |
595 | static void test_exec_oomscoreadjust(Manager *m) { |
596 | test(m, "exec-oomscoreadjust-positive.service", 0, CLD_EXITED); | |
597 | test(m, "exec-oomscoreadjust-negative.service", 0, CLD_EXITED); | |
598 | } | |
599 | ||
a6226758 RC |
600 | static void test_exec_ioschedulingclass(Manager *m) { |
601 | test(m, "exec-ioschedulingclass-none.service", 0, CLD_EXITED); | |
602 | test(m, "exec-ioschedulingclass-idle.service", 0, CLD_EXITED); | |
603 | test(m, "exec-ioschedulingclass-realtime.service", 0, CLD_EXITED); | |
604 | test(m, "exec-ioschedulingclass-best-effort.service", 0, CLD_EXITED); | |
605 | } | |
606 | ||
f0e018e7 YW |
607 | static void test_exec_unsetenvironment(Manager *m) { |
608 | test(m, "exec-unsetenvironment.service", 0, CLD_EXITED); | |
42cc99d5 LP |
609 | } |
610 | ||
9672b583 LP |
611 | static void test_exec_specifier(Manager *m) { |
612 | test(m, "exec-specifier.service", 0, CLD_EXITED); | |
8b3c4b57 | 613 | test(m, "exec-specifier@foo-bar.service", 0, CLD_EXITED); |
f0e018e7 | 614 | test(m, "exec-specifier-interpolation.service", 0, CLD_EXITED); |
9672b583 LP |
615 | } |
616 | ||
f0e018e7 YW |
617 | static void test_exec_standardinput(Manager *m) { |
618 | test(m, "exec-standardinput-data.service", 0, CLD_EXITED); | |
619 | test(m, "exec-standardinput-file.service", 0, CLD_EXITED); | |
666d7877 LP |
620 | } |
621 | ||
ea9cfad1 LP |
622 | static int run_tests(UnitFileScope scope, const test_function_t *tests) { |
623 | const test_function_t *test = NULL; | |
c70cac54 | 624 | _cleanup_(manager_freep) Manager *m = NULL; |
19c0b0b9 RC |
625 | int r; |
626 | ||
627 | assert_se(tests); | |
628 | ||
e8112e67 | 629 | r = manager_new(scope, MANAGER_TEST_RUN_BASIC, &m); |
19c0b0b9 | 630 | if (MANAGER_SKIP_TEST(r)) { |
2179fd10 | 631 | log_notice_errno(r, "Skipping test: manager_new: %m"); |
19c0b0b9 RC |
632 | return EXIT_TEST_SKIP; |
633 | } | |
634 | assert_se(r >= 0); | |
635 | assert_se(manager_startup(m, NULL, NULL) >= 0); | |
636 | ||
637 | for (test = tests; test && *test; test++) | |
638 | (*test)(m); | |
639 | ||
19c0b0b9 RC |
640 | return 0; |
641 | } | |
642 | ||
281e05b6 | 643 | int main(int argc, char *argv[]) { |
ac1f08b9 | 644 | _cleanup_(rm_rf_physical_and_freep) char *runtime_dir = NULL; |
ea9cfad1 | 645 | static const test_function_t user_tests[] = { |
5008da1e | 646 | test_exec_basic, |
b6dc25ee | 647 | test_exec_ambientcapabilities, |
f0e018e7 | 648 | test_exec_bindpaths, |
f0e018e7 | 649 | test_exec_capabilityboundingset, |
4e79aeaa | 650 | test_exec_cpuaffinity, |
f0e018e7 YW |
651 | test_exec_environment, |
652 | test_exec_environmentfile, | |
653 | test_exec_group, | |
281e05b6 | 654 | test_exec_ignoresigpipe, |
f0e018e7 YW |
655 | test_exec_inaccessiblepaths, |
656 | test_exec_ioschedulingclass, | |
657 | test_exec_oomscoreadjust, | |
658 | test_exec_passenvironment, | |
659 | test_exec_personality, | |
281e05b6 | 660 | test_exec_privatedevices, |
f0e018e7 YW |
661 | test_exec_privatenetwork, |
662 | test_exec_privatetmp, | |
4982dbcc | 663 | test_exec_protectkernelmodules, |
f78b36f0 | 664 | test_exec_readonlypaths, |
cdfbd1fb | 665 | test_exec_readwritepaths, |
f0e018e7 YW |
666 | test_exec_restrictnamespaces, |
667 | test_exec_runtimedirectory, | |
668 | test_exec_standardinput, | |
669 | test_exec_supplementarygroups, | |
281e05b6 | 670 | test_exec_systemcallerrornumber, |
f0e018e7 | 671 | test_exec_systemcallfilter, |
4cac89bd | 672 | test_exec_temporaryfilesystem, |
27c5347c | 673 | test_exec_umask, |
f0e018e7 YW |
674 | test_exec_unsetenvironment, |
675 | test_exec_user, | |
676 | test_exec_workingdirectory, | |
281e05b6 RC |
677 | NULL, |
678 | }; | |
ea9cfad1 | 679 | static const test_function_t system_tests[] = { |
f0e018e7 | 680 | test_exec_dynamicuser, |
9672b583 | 681 | test_exec_specifier, |
f0e018e7 | 682 | test_exec_systemcallfilter_system, |
19c0b0b9 RC |
683 | NULL, |
684 | }; | |
281e05b6 RC |
685 | int r; |
686 | ||
469830d1 | 687 | log_set_max_level(LOG_DEBUG); |
281e05b6 RC |
688 | log_parse_environment(); |
689 | log_open(); | |
690 | ||
2482f88d LP |
691 | (void) unsetenv("USER"); |
692 | (void) unsetenv("LOGNAME"); | |
63d6135f | 693 | (void) unsetenv("SHELL"); |
2482f88d | 694 | |
607ff5f9 DH |
695 | /* It is needed otherwise cgroup creation fails */ |
696 | if (getuid() != 0) { | |
651d47d1 | 697 | puts("Skipping test: not root"); |
607ff5f9 DH |
698 | return EXIT_TEST_SKIP; |
699 | } | |
700 | ||
651d47d1 ZJS |
701 | r = enter_cgroup_subroot(); |
702 | if (r == -ENOMEDIUM) { | |
703 | puts("Skipping test: cgroupfs not available"); | |
704 | return EXIT_TEST_SKIP; | |
705 | } | |
8c759b33 | 706 | |
ac1f08b9 | 707 | assert_se(runtime_dir = setup_fake_runtime_dir()); |
cc100a5a | 708 | assert_se(set_unit_path(get_testdata_dir("/test-execute")) >= 0); |
281e05b6 | 709 | |
e1abca2e FB |
710 | /* Unset VAR1, VAR2 and VAR3 which are used in the PassEnvironment test |
711 | * cases, otherwise (and if they are present in the environment), | |
712 | * `manager_default_environment` will copy them into the default | |
713 | * environment which is passed to each created job, which will make the | |
714 | * tests that expect those not to be present to fail. | |
715 | */ | |
716 | assert_se(unsetenv("VAR1") == 0); | |
717 | assert_se(unsetenv("VAR2") == 0); | |
718 | assert_se(unsetenv("VAR3") == 0); | |
719 | ||
463d0d15 | 720 | r = run_tests(UNIT_FILE_USER, user_tests); |
19c0b0b9 RC |
721 | if (r != 0) |
722 | return r; | |
281e05b6 | 723 | |
463d0d15 | 724 | return run_tests(UNIT_FILE_SYSTEM, system_tests); |
281e05b6 | 725 | } |