]>
Commit | Line | Data |
---|---|---|
281e05b6 RC |
1 | /*** |
2 | This file is part of systemd. | |
3 | ||
4 | Copyright 2014 Ronny Chevalier | |
5 | ||
6 | systemd is free software; you can redistribute it and/or modify it | |
7 | under the terms of the GNU Lesser General Public License as published by | |
8 | the Free Software Foundation; either version 2.1 of the License, or | |
9 | (at your option) any later version. | |
10 | ||
11 | systemd is distributed in the hope that it will be useful, but | |
12 | WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
14 | Lesser General Public License for more details. | |
15 | ||
16 | You should have received a copy of the GNU Lesser General Public License | |
17 | along with systemd; If not, see <http://www.gnu.org/licenses/>. | |
18 | ***/ | |
19 | ||
cc7fa4fb RC |
20 | #include <grp.h> |
21 | #include <pwd.h> | |
ff4ca461 | 22 | #include <stdio.h> |
70d7aea5 | 23 | #include <sys/prctl.h> |
ff4ca461 | 24 | #include <sys/types.h> |
281e05b6 | 25 | |
03bd70dd | 26 | #include "fileio.h" |
f4f15635 | 27 | #include "fs-util.h" |
281e05b6 | 28 | #include "macro.h" |
f4f15635 | 29 | #include "manager.h" |
281e05b6 | 30 | #include "mkdir.h" |
ff4ca461 | 31 | #include "path-util.h" |
c6878637 | 32 | #include "rm-rf.h" |
349cc4a5 | 33 | #if HAVE_SECCOMP |
83f12b27 FS |
34 | #include "seccomp-util.h" |
35 | #endif | |
34b86909 | 36 | #include "stat-util.h" |
8b3aa503 | 37 | #include "test-helper.h" |
cc100a5a | 38 | #include "tests.h" |
f4f15635 LP |
39 | #include "unit.h" |
40 | #include "util.h" | |
4dd4cb8f | 41 | #include "virt.h" |
281e05b6 RC |
42 | |
43 | typedef void (*test_function_t)(Manager *m); | |
44 | ||
45 | static void check(Manager *m, Unit *unit, int status_expected, int code_expected) { | |
46 | Service *service = NULL; | |
47 | usec_t ts; | |
8adb3d63 | 48 | usec_t timeout = 2 * USEC_PER_MINUTE; |
281e05b6 RC |
49 | |
50 | assert_se(m); | |
51 | assert_se(unit); | |
52 | ||
53 | service = SERVICE(unit); | |
54 | printf("%s\n", unit->id); | |
55 | exec_context_dump(&service->exec_context, stdout, "\t"); | |
56 | ts = now(CLOCK_MONOTONIC); | |
ec2ce0c5 | 57 | while (!IN_SET(service->state, SERVICE_DEAD, SERVICE_FAILED)) { |
281e05b6 RC |
58 | int r; |
59 | usec_t n; | |
60 | ||
61 | r = sd_event_run(m->event, 100 * USEC_PER_MSEC); | |
62 | assert_se(r >= 0); | |
63 | ||
64 | n = now(CLOCK_MONOTONIC); | |
65 | if (ts + timeout < n) { | |
66 | log_error("Test timeout when testing %s", unit->id); | |
67 | exit(EXIT_FAILURE); | |
68 | } | |
69 | } | |
70 | exec_status_dump(&service->main_exec_status, stdout, "\t"); | |
71 | assert_se(service->main_exec_status.status == status_expected); | |
72 | assert_se(service->main_exec_status.code == code_expected); | |
73 | } | |
74 | ||
6086d2da DP |
75 | static bool is_inaccessible_available(void) { |
76 | char *p; | |
77 | ||
78 | FOREACH_STRING(p, | |
79 | "/run/systemd/inaccessible/reg", | |
80 | "/run/systemd/inaccessible/dir", | |
81 | "/run/systemd/inaccessible/chr", | |
82 | "/run/systemd/inaccessible/blk", | |
83 | "/run/systemd/inaccessible/fifo", | |
84 | "/run/systemd/inaccessible/sock" | |
85 | ) { | |
86 | if (access(p, F_OK) < 0) | |
87 | return false; | |
88 | } | |
89 | ||
90 | return true; | |
91 | } | |
92 | ||
281e05b6 RC |
93 | static void test(Manager *m, const char *unit_name, int status_expected, int code_expected) { |
94 | Unit *unit; | |
95 | ||
96 | assert_se(unit_name); | |
97 | ||
98 | assert_se(manager_load_unit(m, unit_name, NULL, NULL, &unit) >= 0); | |
99 | assert_se(UNIT_VTABLE(unit)->start(unit) >= 0); | |
100 | check(m, unit, status_expected, code_expected); | |
101 | } | |
102 | ||
d053b72b YW |
103 | static void test_exec_bind_paths(Manager *m) { |
104 | assert_se(mkdir_p("/tmp/test-exec_bind_paths", 0755) >= 0); | |
105 | assert_se(mkdir_p("/tmp/test-exec_bind_readonly_paths", 0755) >= 0); | |
106 | ||
107 | test(m, "exec-bind-paths.service", 0, CLD_EXITED); | |
108 | ||
109 | (void) rm_rf("/tmp/test-exec_bind_paths", REMOVE_ROOT|REMOVE_PHYSICAL); | |
110 | (void) rm_rf("/tmp/test-exec_bind_readonly_paths", REMOVE_ROOT|REMOVE_PHYSICAL); | |
111 | } | |
112 | ||
281e05b6 RC |
113 | static void test_exec_workingdirectory(Manager *m) { |
114 | assert_se(mkdir_p("/tmp/test-exec_workingdirectory", 0755) >= 0); | |
115 | ||
116 | test(m, "exec-workingdirectory.service", 0, CLD_EXITED); | |
117 | ||
c6878637 | 118 | (void) rm_rf("/tmp/test-exec_workingdirectory", REMOVE_ROOT|REMOVE_PHYSICAL); |
281e05b6 RC |
119 | } |
120 | ||
121 | static void test_exec_personality(Manager *m) { | |
281e05b6 RC |
122 | #if defined(__x86_64__) |
123 | test(m, "exec-personality-x86-64.service", 0, CLD_EXITED); | |
7517f51e HB |
124 | |
125 | #elif defined(__s390__) | |
126 | test(m, "exec-personality-s390.service", 0, CLD_EXITED); | |
127 | ||
12591863 JS |
128 | #elif defined(__powerpc64__) |
129 | # if __BYTE_ORDER == __BIG_ENDIAN | |
130 | test(m, "exec-personality-ppc64.service", 0, CLD_EXITED); | |
131 | # else | |
132 | test(m, "exec-personality-ppc64le.service", 0, CLD_EXITED); | |
133 | # endif | |
134 | ||
135 | #elif defined(__aarch64__) | |
136 | test(m, "exec-personality-aarch64.service", 0, CLD_EXITED); | |
137 | ||
5798eb4c | 138 | #elif defined(__i386__) |
7517f51e | 139 | test(m, "exec-personality-x86.service", 0, CLD_EXITED); |
281e05b6 RC |
140 | #endif |
141 | } | |
142 | ||
143 | static void test_exec_ignoresigpipe(Manager *m) { | |
144 | test(m, "exec-ignoresigpipe-yes.service", 0, CLD_EXITED); | |
145 | test(m, "exec-ignoresigpipe-no.service", SIGPIPE, CLD_KILLED); | |
146 | } | |
147 | ||
148 | static void test_exec_privatetmp(Manager *m) { | |
149 | assert_se(touch("/tmp/test-exec_privatetmp") >= 0); | |
150 | ||
151 | test(m, "exec-privatetmp-yes.service", 0, CLD_EXITED); | |
152 | test(m, "exec-privatetmp-no.service", 0, CLD_EXITED); | |
153 | ||
154 | unlink("/tmp/test-exec_privatetmp"); | |
155 | } | |
156 | ||
157 | static void test_exec_privatedevices(Manager *m) { | |
4dd4cb8f | 158 | if (detect_container() > 0) { |
303c0bf8 | 159 | log_notice("testing in container, skipping %s", __func__); |
4dd4cb8f SM |
160 | return; |
161 | } | |
6086d2da | 162 | if (!is_inaccessible_available()) { |
303c0bf8 | 163 | log_notice("testing without inaccessible, skipping %s", __func__); |
6086d2da DP |
164 | return; |
165 | } | |
166 | ||
281e05b6 RC |
167 | test(m, "exec-privatedevices-yes.service", 0, CLD_EXITED); |
168 | test(m, "exec-privatedevices-no.service", 0, CLD_EXITED); | |
169 | } | |
170 | ||
615a1f4b | 171 | static void test_exec_privatedevices_capabilities(Manager *m) { |
0608ba98 ZJS |
172 | int r; |
173 | ||
615a1f4b | 174 | if (detect_container() > 0) { |
303c0bf8 | 175 | log_notice("testing in container, skipping %s", __func__); |
615a1f4b DH |
176 | return; |
177 | } | |
6086d2da | 178 | if (!is_inaccessible_available()) { |
303c0bf8 | 179 | log_notice("testing without inaccessible, skipping %s", __func__); |
6086d2da DP |
180 | return; |
181 | } | |
182 | ||
0608ba98 ZJS |
183 | /* We use capsh to test if the capabilities are |
184 | * properly set, so be sure that it exists */ | |
185 | r = find_binary("capsh", NULL); | |
186 | if (r < 0) { | |
187 | log_error_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); | |
6086d2da DP |
188 | return; |
189 | } | |
190 | ||
615a1f4b DH |
191 | test(m, "exec-privatedevices-yes-capability-mknod.service", 0, CLD_EXITED); |
192 | test(m, "exec-privatedevices-no-capability-mknod.service", 0, CLD_EXITED); | |
625d8769 DH |
193 | test(m, "exec-privatedevices-yes-capability-sys-rawio.service", 0, CLD_EXITED); |
194 | test(m, "exec-privatedevices-no-capability-sys-rawio.service", 0, CLD_EXITED); | |
615a1f4b DH |
195 | } |
196 | ||
4982dbcc | 197 | static void test_exec_protectkernelmodules(Manager *m) { |
0608ba98 ZJS |
198 | int r; |
199 | ||
3ae33295 | 200 | if (detect_container() > 0) { |
303c0bf8 | 201 | log_notice("testing in container, skipping %s", __func__); |
3ae33295 DH |
202 | return; |
203 | } | |
6086d2da | 204 | if (!is_inaccessible_available()) { |
303c0bf8 | 205 | log_notice("testing without inaccessible, skipping %s", __func__); |
6086d2da DP |
206 | return; |
207 | } | |
3ae33295 | 208 | |
0608ba98 ZJS |
209 | r = find_binary("capsh", NULL); |
210 | if (r < 0) { | |
211 | log_error_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); | |
212 | return; | |
213 | } | |
214 | ||
215 | ||
3ae33295 DH |
216 | test(m, "exec-protectkernelmodules-no-capabilities.service", 0, CLD_EXITED); |
217 | test(m, "exec-protectkernelmodules-yes-capabilities.service", 0, CLD_EXITED); | |
4982dbcc | 218 | test(m, "exec-protectkernelmodules-yes-mount-propagation.service", 0, CLD_EXITED); |
3ae33295 DH |
219 | } |
220 | ||
f78b36f0 | 221 | static void test_exec_readonlypaths(Manager *m) { |
34b86909 LP |
222 | |
223 | if (path_is_read_only_fs("/var") > 0) | |
224 | return; | |
225 | ||
f78b36f0 | 226 | test(m, "exec-readonlypaths.service", 0, CLD_EXITED); |
cdfbd1fb | 227 | test(m, "exec-readonlypaths-mount-propagation.service", 0, CLD_EXITED); |
23fd04e9 | 228 | test(m, "exec-readonlypaths-with-bindpaths.service", 0, CLD_EXITED); |
cdfbd1fb DH |
229 | } |
230 | ||
231 | static void test_exec_readwritepaths(Manager *m) { | |
34b86909 LP |
232 | |
233 | if (path_is_read_only_fs("/") > 0) | |
234 | return; | |
235 | ||
cdfbd1fb DH |
236 | test(m, "exec-readwritepaths-mount-propagation.service", 0, CLD_EXITED); |
237 | } | |
238 | ||
239 | static void test_exec_inaccessiblepaths(Manager *m) { | |
34b86909 LP |
240 | |
241 | if (path_is_read_only_fs("/") > 0) | |
242 | return; | |
243 | ||
cdfbd1fb | 244 | test(m, "exec-inaccessiblepaths-mount-propagation.service", 0, CLD_EXITED); |
f78b36f0 DH |
245 | } |
246 | ||
c090d74d | 247 | static void test_exec_inaccessiblepaths_proc(Manager *m) { |
af4af186 EV |
248 | if (!is_inaccessible_available()) { |
249 | log_notice("testing without inaccessible, skipping %s", __func__); | |
250 | return; | |
251 | } | |
252 | ||
c090d74d TR |
253 | test(m, "exec-inaccessiblepaths-proc.service", 0, CLD_EXITED); |
254 | } | |
255 | ||
281e05b6 | 256 | static void test_exec_systemcallfilter(Manager *m) { |
349cc4a5 | 257 | #if HAVE_SECCOMP |
83f12b27 FS |
258 | if (!is_seccomp_available()) |
259 | return; | |
281e05b6 RC |
260 | test(m, "exec-systemcallfilter-not-failing.service", 0, CLD_EXITED); |
261 | test(m, "exec-systemcallfilter-not-failing2.service", 0, CLD_EXITED); | |
262 | test(m, "exec-systemcallfilter-failing.service", SIGSYS, CLD_KILLED); | |
263 | test(m, "exec-systemcallfilter-failing2.service", SIGSYS, CLD_KILLED); | |
83f12b27 | 264 | |
281e05b6 RC |
265 | #endif |
266 | } | |
267 | ||
268 | static void test_exec_systemcallerrornumber(Manager *m) { | |
349cc4a5 | 269 | #if HAVE_SECCOMP |
83f12b27 FS |
270 | if (is_seccomp_available()) |
271 | test(m, "exec-systemcallerrornumber.service", 1, CLD_EXITED); | |
281e05b6 RC |
272 | #endif |
273 | } | |
274 | ||
97e60383 | 275 | static void test_exec_restrict_namespaces(Manager *m) { |
349cc4a5 | 276 | #if HAVE_SECCOMP |
97e60383 DH |
277 | if (!is_seccomp_available()) |
278 | return; | |
279 | ||
280 | test(m, "exec-restrict-namespaces-no.service", 0, CLD_EXITED); | |
281 | test(m, "exec-restrict-namespaces-yes.service", 1, CLD_EXITED); | |
282 | test(m, "exec-restrict-namespaces-mnt.service", 0, CLD_EXITED); | |
283 | test(m, "exec-restrict-namespaces-mnt-blacklist.service", 1, CLD_EXITED); | |
284 | #endif | |
285 | } | |
286 | ||
19c0b0b9 | 287 | static void test_exec_systemcall_system_mode_with_user(Manager *m) { |
349cc4a5 | 288 | #if HAVE_SECCOMP |
83f12b27 FS |
289 | if (!is_seccomp_available()) |
290 | return; | |
19c0b0b9 RC |
291 | if (getpwnam("nobody")) |
292 | test(m, "exec-systemcallfilter-system-user.service", 0, CLD_EXITED); | |
50f130c2 RC |
293 | else if (getpwnam("nfsnobody")) |
294 | test(m, "exec-systemcallfilter-system-user-nfsnobody.service", 0, CLD_EXITED); | |
19c0b0b9 | 295 | else |
303c0bf8 | 296 | log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody user: %m", __func__); |
19c0b0b9 RC |
297 | #endif |
298 | } | |
299 | ||
281e05b6 | 300 | static void test_exec_user(Manager *m) { |
cc7fa4fb RC |
301 | if (getpwnam("nobody")) |
302 | test(m, "exec-user.service", 0, CLD_EXITED); | |
50f130c2 RC |
303 | else if (getpwnam("nfsnobody")) |
304 | test(m, "exec-user-nfsnobody.service", 0, CLD_EXITED); | |
ff4ca461 | 305 | else |
303c0bf8 | 306 | log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody user: %m", __func__); |
281e05b6 RC |
307 | } |
308 | ||
309 | static void test_exec_group(Manager *m) { | |
cc7fa4fb RC |
310 | if (getgrnam("nobody")) |
311 | test(m, "exec-group.service", 0, CLD_EXITED); | |
50f130c2 RC |
312 | else if (getgrnam("nfsnobody")) |
313 | test(m, "exec-group-nfsnobody.service", 0, CLD_EXITED); | |
ff4ca461 | 314 | else |
303c0bf8 | 315 | log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody group: %m", __func__); |
281e05b6 RC |
316 | } |
317 | ||
86b838ea DH |
318 | static void test_exec_supplementary_groups(Manager *m) { |
319 | test(m, "exec-supplementarygroups.service", 0, CLD_EXITED); | |
bf9ace96 DH |
320 | test(m, "exec-supplementarygroups-single-group.service", 0, CLD_EXITED); |
321 | test(m, "exec-supplementarygroups-single-group-user.service", 0, CLD_EXITED); | |
50ca7a35 DH |
322 | test(m, "exec-supplementarygroups-multiple-groups-default-group-user.service", 0, CLD_EXITED); |
323 | test(m, "exec-supplementarygroups-multiple-groups-withgid.service", 0, CLD_EXITED); | |
324 | test(m, "exec-supplementarygroups-multiple-groups-withuid.service", 0, CLD_EXITED); | |
86b838ea DH |
325 | } |
326 | ||
2b9ac11e DH |
327 | static void test_exec_dynamic_user(Manager *m) { |
328 | test(m, "exec-dynamicuser-fixeduser.service", 0, CLD_EXITED); | |
329 | test(m, "exec-dynamicuser-fixeduser-one-supplementarygroup.service", 0, CLD_EXITED); | |
5c67067f | 330 | test(m, "exec-dynamicuser-supplementarygroups.service", 0, CLD_EXITED); |
8adb3d63 | 331 | test(m, "exec-dynamicuser-state-dir.service", 0, CLD_EXITED); |
2b9ac11e DH |
332 | } |
333 | ||
281e05b6 RC |
334 | static void test_exec_environment(Manager *m) { |
335 | test(m, "exec-environment.service", 0, CLD_EXITED); | |
336 | test(m, "exec-environment-multiple.service", 0, CLD_EXITED); | |
337 | test(m, "exec-environment-empty.service", 0, CLD_EXITED); | |
338 | } | |
339 | ||
03bd70dd RC |
340 | static void test_exec_environmentfile(Manager *m) { |
341 | static const char e[] = | |
342 | "VAR1='word1 word2'\n" | |
343 | "VAR2=word3 \n" | |
344 | "# comment1\n" | |
345 | "\n" | |
346 | "; comment2\n" | |
347 | " ; # comment3\n" | |
348 | "line without an equal\n" | |
349 | "VAR3='$word 5 6'\n"; | |
350 | int r; | |
351 | ||
352 | r = write_string_file("/tmp/test-exec_environmentfile.conf", e, WRITE_STRING_FILE_CREATE); | |
353 | assert_se(r == 0); | |
354 | ||
355 | test(m, "exec-environmentfile.service", 0, CLD_EXITED); | |
356 | ||
357 | unlink("/tmp/test-exec_environmentfile.conf"); | |
358 | } | |
359 | ||
4c80d201 | 360 | static void test_exec_passenvironment(Manager *m) { |
e1abca2e FB |
361 | /* test-execute runs under MANAGER_USER which, by default, forwards all |
362 | * variables present in the environment, but only those that are | |
363 | * present _at the time it is created_! | |
364 | * | |
365 | * So these PassEnvironment checks are still expected to work, since we | |
366 | * are ensuring the variables are not present at manager creation (they | |
367 | * are unset explicitly in main) and are only set here. | |
368 | * | |
369 | * This is still a good approximation of how a test for MANAGER_SYSTEM | |
370 | * would work. | |
371 | */ | |
4c80d201 FB |
372 | assert_se(setenv("VAR1", "word1 word2", 1) == 0); |
373 | assert_se(setenv("VAR2", "word3", 1) == 0); | |
374 | assert_se(setenv("VAR3", "$word 5 6", 1) == 0); | |
375 | test(m, "exec-passenvironment.service", 0, CLD_EXITED); | |
376 | test(m, "exec-passenvironment-repeated.service", 0, CLD_EXITED); | |
377 | test(m, "exec-passenvironment-empty.service", 0, CLD_EXITED); | |
378 | assert_se(unsetenv("VAR1") == 0); | |
379 | assert_se(unsetenv("VAR2") == 0); | |
380 | assert_se(unsetenv("VAR3") == 0); | |
381 | test(m, "exec-passenvironment-absent.service", 0, CLD_EXITED); | |
382 | } | |
383 | ||
27c5347c RC |
384 | static void test_exec_umask(Manager *m) { |
385 | test(m, "exec-umask-default.service", 0, CLD_EXITED); | |
386 | test(m, "exec-umask-0177.service", 0, CLD_EXITED); | |
387 | } | |
388 | ||
cc3ddc85 RC |
389 | static void test_exec_runtimedirectory(Manager *m) { |
390 | test(m, "exec-runtimedirectory.service", 0, CLD_EXITED); | |
391 | test(m, "exec-runtimedirectory-mode.service", 0, CLD_EXITED); | |
cc7fa4fb RC |
392 | if (getgrnam("nobody")) |
393 | test(m, "exec-runtimedirectory-owner.service", 0, CLD_EXITED); | |
50f130c2 RC |
394 | else if (getgrnam("nfsnobody")) |
395 | test(m, "exec-runtimedirectory-owner-nfsnobody.service", 0, CLD_EXITED); | |
ff4ca461 | 396 | else |
303c0bf8 | 397 | log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody group: %m", __func__); |
ff4ca461 RC |
398 | } |
399 | ||
400 | static void test_exec_capabilityboundingset(Manager *m) { | |
401 | int r; | |
402 | ||
ff4ca461 RC |
403 | r = find_binary("capsh", NULL); |
404 | if (r < 0) { | |
0608ba98 | 405 | log_error_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); |
ff4ca461 RC |
406 | return; |
407 | } | |
408 | ||
409 | test(m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED); | |
410 | test(m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED); | |
411 | test(m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED); | |
412 | test(m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED); | |
cc3ddc85 RC |
413 | } |
414 | ||
70d7aea5 IP |
415 | static void test_exec_capabilityambientset(Manager *m) { |
416 | int r; | |
417 | ||
418 | /* Check if the kernel has support for ambient capabilities. Run | |
419 | * the tests only if that's the case. Clearing all ambient | |
420 | * capabilities is fine, since we are expecting them to be unset | |
421 | * in the first place for the tests. */ | |
422 | r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0); | |
423 | if (r >= 0 || errno != EINVAL) { | |
50f130c2 | 424 | if (getpwnam("nobody")) { |
50f130c2 RC |
425 | test(m, "exec-capabilityambientset.service", 0, CLD_EXITED); |
426 | test(m, "exec-capabilityambientset-merge.service", 0, CLD_EXITED); | |
34f5ff46 RC |
427 | } else if (getpwnam("nfsnobody")) { |
428 | test(m, "exec-capabilityambientset-nfsnobody.service", 0, CLD_EXITED); | |
429 | test(m, "exec-capabilityambientset-merge-nfsnobody.service", 0, CLD_EXITED); | |
50f130c2 | 430 | } else |
303c0bf8 | 431 | log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody user: %m", __func__); |
50f130c2 | 432 | } else |
303c0bf8 | 433 | log_error_errno(errno, "Skipping %s, the kernel does not support ambient capabilities: %m", __func__); |
70d7aea5 IP |
434 | } |
435 | ||
63447f11 RC |
436 | static void test_exec_privatenetwork(Manager *m) { |
437 | int r; | |
438 | ||
439 | r = find_binary("ip", NULL); | |
440 | if (r < 0) { | |
303c0bf8 | 441 | log_error_errno(r, "Skipping %s, could not find ip binary: %m", __func__); |
63447f11 RC |
442 | return; |
443 | } | |
444 | ||
445 | test(m, "exec-privatenetwork-yes.service", 0, CLD_EXITED); | |
446 | } | |
447 | ||
c388dfea RC |
448 | static void test_exec_oomscoreadjust(Manager *m) { |
449 | test(m, "exec-oomscoreadjust-positive.service", 0, CLD_EXITED); | |
450 | test(m, "exec-oomscoreadjust-negative.service", 0, CLD_EXITED); | |
451 | } | |
452 | ||
a6226758 RC |
453 | static void test_exec_ioschedulingclass(Manager *m) { |
454 | test(m, "exec-ioschedulingclass-none.service", 0, CLD_EXITED); | |
455 | test(m, "exec-ioschedulingclass-idle.service", 0, CLD_EXITED); | |
456 | test(m, "exec-ioschedulingclass-realtime.service", 0, CLD_EXITED); | |
457 | test(m, "exec-ioschedulingclass-best-effort.service", 0, CLD_EXITED); | |
458 | } | |
459 | ||
25254999 EV |
460 | static void test_exec_spec_interpolation(Manager *m) { |
461 | test(m, "exec-spec-interpolation.service", 0, CLD_EXITED); | |
462 | } | |
463 | ||
6818c54c LP |
464 | static void test_exec_read_only_path_suceed(Manager *m) { |
465 | test(m, "exec-read-only-path-succeed.service", 0, CLD_EXITED); | |
466 | } | |
467 | ||
42cc99d5 LP |
468 | static void test_exec_unset_environment(Manager *m) { |
469 | test(m, "exec-unset-environment.service", 0, CLD_EXITED); | |
470 | } | |
471 | ||
9672b583 LP |
472 | static void test_exec_specifier(Manager *m) { |
473 | test(m, "exec-specifier.service", 0, CLD_EXITED); | |
474 | } | |
475 | ||
ea9cfad1 LP |
476 | static int run_tests(UnitFileScope scope, const test_function_t *tests) { |
477 | const test_function_t *test = NULL; | |
19c0b0b9 RC |
478 | Manager *m = NULL; |
479 | int r; | |
480 | ||
481 | assert_se(tests); | |
482 | ||
e0a3da1f | 483 | r = manager_new(scope, MANAGER_TEST_RUN_MINIMAL, &m); |
19c0b0b9 | 484 | if (MANAGER_SKIP_TEST(r)) { |
2179fd10 | 485 | log_notice_errno(r, "Skipping test: manager_new: %m"); |
19c0b0b9 RC |
486 | return EXIT_TEST_SKIP; |
487 | } | |
488 | assert_se(r >= 0); | |
489 | assert_se(manager_startup(m, NULL, NULL) >= 0); | |
490 | ||
491 | for (test = tests; test && *test; test++) | |
492 | (*test)(m); | |
493 | ||
494 | manager_free(m); | |
495 | ||
496 | return 0; | |
497 | } | |
498 | ||
281e05b6 | 499 | int main(int argc, char *argv[]) { |
ea9cfad1 | 500 | static const test_function_t user_tests[] = { |
d053b72b | 501 | test_exec_bind_paths, |
281e05b6 RC |
502 | test_exec_workingdirectory, |
503 | test_exec_personality, | |
504 | test_exec_ignoresigpipe, | |
505 | test_exec_privatetmp, | |
506 | test_exec_privatedevices, | |
615a1f4b | 507 | test_exec_privatedevices_capabilities, |
4982dbcc | 508 | test_exec_protectkernelmodules, |
f78b36f0 | 509 | test_exec_readonlypaths, |
cdfbd1fb DH |
510 | test_exec_readwritepaths, |
511 | test_exec_inaccessiblepaths, | |
c090d74d | 512 | test_exec_inaccessiblepaths_proc, |
63447f11 | 513 | test_exec_privatenetwork, |
281e05b6 RC |
514 | test_exec_systemcallfilter, |
515 | test_exec_systemcallerrornumber, | |
97e60383 | 516 | test_exec_restrict_namespaces, |
281e05b6 RC |
517 | test_exec_user, |
518 | test_exec_group, | |
86b838ea | 519 | test_exec_supplementary_groups, |
281e05b6 | 520 | test_exec_environment, |
03bd70dd | 521 | test_exec_environmentfile, |
4c80d201 | 522 | test_exec_passenvironment, |
27c5347c | 523 | test_exec_umask, |
cc3ddc85 | 524 | test_exec_runtimedirectory, |
ff4ca461 | 525 | test_exec_capabilityboundingset, |
70d7aea5 | 526 | test_exec_capabilityambientset, |
c388dfea | 527 | test_exec_oomscoreadjust, |
a6226758 | 528 | test_exec_ioschedulingclass, |
25254999 | 529 | test_exec_spec_interpolation, |
6818c54c | 530 | test_exec_read_only_path_suceed, |
42cc99d5 | 531 | test_exec_unset_environment, |
281e05b6 RC |
532 | NULL, |
533 | }; | |
ea9cfad1 | 534 | static const test_function_t system_tests[] = { |
19c0b0b9 | 535 | test_exec_systemcall_system_mode_with_user, |
8adb3d63 | 536 | test_exec_dynamic_user, |
9672b583 | 537 | test_exec_specifier, |
19c0b0b9 RC |
538 | NULL, |
539 | }; | |
281e05b6 RC |
540 | int r; |
541 | ||
469830d1 | 542 | log_set_max_level(LOG_DEBUG); |
281e05b6 RC |
543 | log_parse_environment(); |
544 | log_open(); | |
545 | ||
607ff5f9 DH |
546 | /* It is needed otherwise cgroup creation fails */ |
547 | if (getuid() != 0) { | |
651d47d1 | 548 | puts("Skipping test: not root"); |
607ff5f9 DH |
549 | return EXIT_TEST_SKIP; |
550 | } | |
551 | ||
651d47d1 ZJS |
552 | r = enter_cgroup_subroot(); |
553 | if (r == -ENOMEDIUM) { | |
554 | puts("Skipping test: cgroupfs not available"); | |
555 | return EXIT_TEST_SKIP; | |
556 | } | |
8c759b33 | 557 | |
cc3ddc85 | 558 | assert_se(setenv("XDG_RUNTIME_DIR", "/tmp/", 1) == 0); |
cc100a5a | 559 | assert_se(set_unit_path(get_testdata_dir("/test-execute")) >= 0); |
281e05b6 | 560 | |
e1abca2e FB |
561 | /* Unset VAR1, VAR2 and VAR3 which are used in the PassEnvironment test |
562 | * cases, otherwise (and if they are present in the environment), | |
563 | * `manager_default_environment` will copy them into the default | |
564 | * environment which is passed to each created job, which will make the | |
565 | * tests that expect those not to be present to fail. | |
566 | */ | |
567 | assert_se(unsetenv("VAR1") == 0); | |
568 | assert_se(unsetenv("VAR2") == 0); | |
569 | assert_se(unsetenv("VAR3") == 0); | |
570 | ||
463d0d15 | 571 | r = run_tests(UNIT_FILE_USER, user_tests); |
19c0b0b9 RC |
572 | if (r != 0) |
573 | return r; | |
281e05b6 | 574 | |
463d0d15 | 575 | return run_tests(UNIT_FILE_SYSTEM, system_tests); |
281e05b6 | 576 | } |