]>
Commit | Line | Data |
---|---|---|
53e1b683 | 1 | /* SPDX-License-Identifier: LGPL-2.1+ */ |
281e05b6 | 2 | |
cc7fa4fb RC |
3 | #include <grp.h> |
4 | #include <pwd.h> | |
ff4ca461 | 5 | #include <stdio.h> |
70d7aea5 | 6 | #include <sys/prctl.h> |
ff4ca461 | 7 | #include <sys/types.h> |
281e05b6 | 8 | |
b7856f92 | 9 | #include "capability-util.h" |
4e79aeaa | 10 | #include "cpu-set-util.h" |
b4891260 | 11 | #include "errno-list.h" |
03bd70dd | 12 | #include "fileio.h" |
f4f15635 | 13 | #include "fs-util.h" |
281e05b6 | 14 | #include "macro.h" |
f4f15635 | 15 | #include "manager.h" |
281e05b6 | 16 | #include "mkdir.h" |
ff4ca461 | 17 | #include "path-util.h" |
c6878637 | 18 | #include "rm-rf.h" |
349cc4a5 | 19 | #if HAVE_SECCOMP |
83f12b27 FS |
20 | #include "seccomp-util.h" |
21 | #endif | |
57b7a260 | 22 | #include "service.h" |
34b86909 | 23 | #include "stat-util.h" |
8b3aa503 | 24 | #include "test-helper.h" |
cc100a5a | 25 | #include "tests.h" |
f4f15635 | 26 | #include "unit.h" |
57c2efa0 | 27 | #include "user-util.h" |
f4f15635 | 28 | #include "util.h" |
4dd4cb8f | 29 | #include "virt.h" |
281e05b6 | 30 | |
5f00dc4d | 31 | static bool can_unshare; |
b7172f34 | 32 | |
281e05b6 RC |
33 | typedef void (*test_function_t)(Manager *m); |
34 | ||
35 | static void check(Manager *m, Unit *unit, int status_expected, int code_expected) { | |
36 | Service *service = NULL; | |
37 | usec_t ts; | |
8adb3d63 | 38 | usec_t timeout = 2 * USEC_PER_MINUTE; |
281e05b6 RC |
39 | |
40 | assert_se(m); | |
41 | assert_se(unit); | |
42 | ||
43 | service = SERVICE(unit); | |
44 | printf("%s\n", unit->id); | |
45 | exec_context_dump(&service->exec_context, stdout, "\t"); | |
46 | ts = now(CLOCK_MONOTONIC); | |
ec2ce0c5 | 47 | while (!IN_SET(service->state, SERVICE_DEAD, SERVICE_FAILED)) { |
281e05b6 RC |
48 | int r; |
49 | usec_t n; | |
50 | ||
51 | r = sd_event_run(m->event, 100 * USEC_PER_MSEC); | |
52 | assert_se(r >= 0); | |
53 | ||
54 | n = now(CLOCK_MONOTONIC); | |
55 | if (ts + timeout < n) { | |
56 | log_error("Test timeout when testing %s", unit->id); | |
f7f8e8cb EV |
57 | r = UNIT_VTABLE(unit)->kill(unit, KILL_ALL, 9, NULL); |
58 | if (r < 0) | |
59 | log_error_errno(r, "Failed to kill %s: %m", unit->id); | |
281e05b6 RC |
60 | exit(EXIT_FAILURE); |
61 | } | |
62 | } | |
63 | exec_status_dump(&service->main_exec_status, stdout, "\t"); | |
64 | assert_se(service->main_exec_status.status == status_expected); | |
65 | assert_se(service->main_exec_status.code == code_expected); | |
66 | } | |
67 | ||
57c2efa0 YW |
68 | static bool check_nobody_user_and_group(void) { |
69 | static int cache = -1; | |
70 | struct passwd *p; | |
71 | struct group *g; | |
72 | ||
73 | if (cache >= 0) | |
74 | return !!cache; | |
75 | ||
76 | if (!synthesize_nobody()) | |
77 | goto invalid; | |
78 | ||
79 | p = getpwnam(NOBODY_USER_NAME); | |
80 | if (!p || | |
81 | !streq(p->pw_name, NOBODY_USER_NAME) || | |
82 | p->pw_uid != UID_NOBODY || | |
83 | p->pw_gid != GID_NOBODY) | |
84 | goto invalid; | |
85 | ||
86 | p = getpwuid(UID_NOBODY); | |
87 | if (!p || | |
88 | !streq(p->pw_name, NOBODY_USER_NAME) || | |
89 | p->pw_uid != UID_NOBODY || | |
90 | p->pw_gid != GID_NOBODY) | |
91 | goto invalid; | |
92 | ||
93 | g = getgrnam(NOBODY_GROUP_NAME); | |
94 | if (!g || | |
95 | !streq(g->gr_name, NOBODY_GROUP_NAME) || | |
96 | g->gr_gid != GID_NOBODY) | |
97 | goto invalid; | |
98 | ||
99 | g = getgrgid(GID_NOBODY); | |
100 | if (!g || | |
101 | !streq(g->gr_name, NOBODY_GROUP_NAME) || | |
102 | g->gr_gid != GID_NOBODY) | |
103 | goto invalid; | |
104 | ||
105 | cache = 1; | |
106 | return true; | |
107 | ||
108 | invalid: | |
109 | cache = 0; | |
110 | return false; | |
111 | } | |
112 | ||
9f82d685 YW |
113 | static bool check_user_has_group_with_same_name(const char *name) { |
114 | struct passwd *p; | |
115 | struct group *g; | |
116 | ||
117 | assert(name); | |
118 | ||
119 | p = getpwnam(name); | |
120 | if (!p || | |
121 | !streq(p->pw_name, name)) | |
122 | return false; | |
123 | ||
124 | g = getgrgid(p->pw_gid); | |
125 | if (!g || | |
126 | !streq(g->gr_name, name)) | |
127 | return false; | |
128 | ||
129 | return true; | |
130 | } | |
131 | ||
6086d2da DP |
132 | static bool is_inaccessible_available(void) { |
133 | char *p; | |
134 | ||
135 | FOREACH_STRING(p, | |
136 | "/run/systemd/inaccessible/reg", | |
137 | "/run/systemd/inaccessible/dir", | |
138 | "/run/systemd/inaccessible/chr", | |
139 | "/run/systemd/inaccessible/blk", | |
140 | "/run/systemd/inaccessible/fifo", | |
141 | "/run/systemd/inaccessible/sock" | |
142 | ) { | |
143 | if (access(p, F_OK) < 0) | |
144 | return false; | |
145 | } | |
146 | ||
147 | return true; | |
148 | } | |
149 | ||
281e05b6 RC |
150 | static void test(Manager *m, const char *unit_name, int status_expected, int code_expected) { |
151 | Unit *unit; | |
152 | ||
153 | assert_se(unit_name); | |
154 | ||
ba412430 | 155 | assert_se(manager_load_startable_unit_or_warn(m, unit_name, NULL, &unit) >= 0); |
281e05b6 RC |
156 | assert_se(UNIT_VTABLE(unit)->start(unit) >= 0); |
157 | check(m, unit, status_expected, code_expected); | |
158 | } | |
159 | ||
f0e018e7 YW |
160 | static void test_exec_bindpaths(Manager *m) { |
161 | assert_se(mkdir_p("/tmp/test-exec-bindpaths", 0755) >= 0); | |
162 | assert_se(mkdir_p("/tmp/test-exec-bindreadonlypaths", 0755) >= 0); | |
d053b72b | 163 | |
b7172f34 | 164 | test(m, "exec-bindpaths.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); |
d053b72b | 165 | |
f0e018e7 YW |
166 | (void) rm_rf("/tmp/test-exec-bindpaths", REMOVE_ROOT|REMOVE_PHYSICAL); |
167 | (void) rm_rf("/tmp/test-exec-bindreadonlypaths", REMOVE_ROOT|REMOVE_PHYSICAL); | |
d053b72b YW |
168 | } |
169 | ||
4e79aeaa YW |
170 | static void test_exec_cpuaffinity(Manager *m) { |
171 | _cleanup_cpu_free_ cpu_set_t *c = NULL; | |
172 | unsigned n; | |
173 | ||
174 | assert_se(c = cpu_set_malloc(&n)); | |
175 | assert_se(sched_getaffinity(0, CPU_ALLOC_SIZE(n), c) >= 0); | |
176 | ||
177 | if (CPU_ISSET_S(0, CPU_ALLOC_SIZE(n), c) == 0) { | |
178 | log_notice("Cannot use CPU 0, skipping %s", __func__); | |
179 | return; | |
180 | } | |
181 | ||
182 | test(m, "exec-cpuaffinity1.service", 0, CLD_EXITED); | |
183 | test(m, "exec-cpuaffinity2.service", 0, CLD_EXITED); | |
184 | ||
185 | if (CPU_ISSET_S(1, CPU_ALLOC_SIZE(n), c) == 0 || | |
186 | CPU_ISSET_S(2, CPU_ALLOC_SIZE(n), c) == 0) { | |
187 | log_notice("Cannot use CPU 1 or 2, skipping remaining tests in %s", __func__); | |
188 | return; | |
189 | } | |
190 | ||
191 | test(m, "exec-cpuaffinity3.service", 0, CLD_EXITED); | |
192 | } | |
193 | ||
281e05b6 RC |
194 | static void test_exec_workingdirectory(Manager *m) { |
195 | assert_se(mkdir_p("/tmp/test-exec_workingdirectory", 0755) >= 0); | |
196 | ||
197 | test(m, "exec-workingdirectory.service", 0, CLD_EXITED); | |
2b633119 | 198 | test(m, "exec-workingdirectory-trailing-dot.service", 0, CLD_EXITED); |
281e05b6 | 199 | |
c6878637 | 200 | (void) rm_rf("/tmp/test-exec_workingdirectory", REMOVE_ROOT|REMOVE_PHYSICAL); |
281e05b6 RC |
201 | } |
202 | ||
203 | static void test_exec_personality(Manager *m) { | |
281e05b6 RC |
204 | #if defined(__x86_64__) |
205 | test(m, "exec-personality-x86-64.service", 0, CLD_EXITED); | |
7517f51e HB |
206 | |
207 | #elif defined(__s390__) | |
208 | test(m, "exec-personality-s390.service", 0, CLD_EXITED); | |
209 | ||
12591863 JS |
210 | #elif defined(__powerpc64__) |
211 | # if __BYTE_ORDER == __BIG_ENDIAN | |
212 | test(m, "exec-personality-ppc64.service", 0, CLD_EXITED); | |
213 | # else | |
214 | test(m, "exec-personality-ppc64le.service", 0, CLD_EXITED); | |
215 | # endif | |
216 | ||
217 | #elif defined(__aarch64__) | |
218 | test(m, "exec-personality-aarch64.service", 0, CLD_EXITED); | |
219 | ||
5798eb4c | 220 | #elif defined(__i386__) |
7517f51e | 221 | test(m, "exec-personality-x86.service", 0, CLD_EXITED); |
f0e018e7 YW |
222 | #else |
223 | log_notice("Unknown personality, skipping %s", __func__); | |
281e05b6 RC |
224 | #endif |
225 | } | |
226 | ||
227 | static void test_exec_ignoresigpipe(Manager *m) { | |
228 | test(m, "exec-ignoresigpipe-yes.service", 0, CLD_EXITED); | |
229 | test(m, "exec-ignoresigpipe-no.service", SIGPIPE, CLD_KILLED); | |
230 | } | |
231 | ||
232 | static void test_exec_privatetmp(Manager *m) { | |
233 | assert_se(touch("/tmp/test-exec_privatetmp") >= 0); | |
234 | ||
b7172f34 | 235 | test(m, "exec-privatetmp-yes.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); |
281e05b6 RC |
236 | test(m, "exec-privatetmp-no.service", 0, CLD_EXITED); |
237 | ||
238 | unlink("/tmp/test-exec_privatetmp"); | |
239 | } | |
240 | ||
241 | static void test_exec_privatedevices(Manager *m) { | |
f0e018e7 YW |
242 | int r; |
243 | ||
4dd4cb8f | 244 | if (detect_container() > 0) { |
f0e018e7 | 245 | log_notice("Testing in container, skipping %s", __func__); |
4dd4cb8f SM |
246 | return; |
247 | } | |
6086d2da | 248 | if (!is_inaccessible_available()) { |
f0e018e7 | 249 | log_notice("Testing without inaccessible, skipping %s", __func__); |
6086d2da DP |
250 | return; |
251 | } | |
252 | ||
b7172f34 | 253 | test(m, "exec-privatedevices-yes.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); |
281e05b6 | 254 | test(m, "exec-privatedevices-no.service", 0, CLD_EXITED); |
b7172f34 | 255 | test(m, "exec-privatedevices-disabled-by-prefix.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); |
6086d2da | 256 | |
0608ba98 ZJS |
257 | /* We use capsh to test if the capabilities are |
258 | * properly set, so be sure that it exists */ | |
259 | r = find_binary("capsh", NULL); | |
260 | if (r < 0) { | |
5cd33ccc | 261 | log_notice_errno(r, "Could not find capsh binary, skipping remaining tests in %s: %m", __func__); |
6086d2da DP |
262 | return; |
263 | } | |
264 | ||
615a1f4b DH |
265 | test(m, "exec-privatedevices-yes-capability-mknod.service", 0, CLD_EXITED); |
266 | test(m, "exec-privatedevices-no-capability-mknod.service", 0, CLD_EXITED); | |
625d8769 DH |
267 | test(m, "exec-privatedevices-yes-capability-sys-rawio.service", 0, CLD_EXITED); |
268 | test(m, "exec-privatedevices-no-capability-sys-rawio.service", 0, CLD_EXITED); | |
615a1f4b DH |
269 | } |
270 | ||
4982dbcc | 271 | static void test_exec_protectkernelmodules(Manager *m) { |
0608ba98 ZJS |
272 | int r; |
273 | ||
3ae33295 | 274 | if (detect_container() > 0) { |
f0e018e7 | 275 | log_notice("Testing in container, skipping %s", __func__); |
3ae33295 DH |
276 | return; |
277 | } | |
6086d2da | 278 | if (!is_inaccessible_available()) { |
f0e018e7 | 279 | log_notice("Testing without inaccessible, skipping %s", __func__); |
6086d2da DP |
280 | return; |
281 | } | |
3ae33295 | 282 | |
0608ba98 ZJS |
283 | r = find_binary("capsh", NULL); |
284 | if (r < 0) { | |
5cd33ccc | 285 | log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); |
0608ba98 ZJS |
286 | return; |
287 | } | |
288 | ||
3ae33295 DH |
289 | test(m, "exec-protectkernelmodules-no-capabilities.service", 0, CLD_EXITED); |
290 | test(m, "exec-protectkernelmodules-yes-capabilities.service", 0, CLD_EXITED); | |
b7172f34 | 291 | test(m, "exec-protectkernelmodules-yes-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); |
3ae33295 DH |
292 | } |
293 | ||
f78b36f0 | 294 | static void test_exec_readonlypaths(Manager *m) { |
34b86909 | 295 | |
b7172f34 | 296 | test(m, "exec-readonlypaths-simple.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); |
f0e018e7 YW |
297 | |
298 | if (path_is_read_only_fs("/var") > 0) { | |
299 | log_notice("Directory /var is readonly, skipping remaining tests in %s", __func__); | |
34b86909 | 300 | return; |
f0e018e7 | 301 | } |
34b86909 | 302 | |
b7172f34 YW |
303 | test(m, "exec-readonlypaths.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); |
304 | test(m, "exec-readonlypaths-with-bindpaths.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
305 | test(m, "exec-readonlypaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
cdfbd1fb DH |
306 | } |
307 | ||
308 | static void test_exec_readwritepaths(Manager *m) { | |
34b86909 | 309 | |
f0e018e7 YW |
310 | if (path_is_read_only_fs("/") > 0) { |
311 | log_notice("Root directory is readonly, skipping %s", __func__); | |
34b86909 | 312 | return; |
f0e018e7 | 313 | } |
34b86909 | 314 | |
b7172f34 | 315 | test(m, "exec-readwritepaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); |
cdfbd1fb DH |
316 | } |
317 | ||
318 | static void test_exec_inaccessiblepaths(Manager *m) { | |
34b86909 | 319 | |
f0e018e7 YW |
320 | if (!is_inaccessible_available()) { |
321 | log_notice("Testing without inaccessible, skipping %s", __func__); | |
34b86909 | 322 | return; |
f0e018e7 | 323 | } |
34b86909 | 324 | |
b7172f34 | 325 | test(m, "exec-inaccessiblepaths-proc.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); |
f78b36f0 | 326 | |
f0e018e7 YW |
327 | if (path_is_read_only_fs("/") > 0) { |
328 | log_notice("Root directory is readonly, skipping remaining tests in %s", __func__); | |
af4af186 EV |
329 | return; |
330 | } | |
331 | ||
b7172f34 | 332 | test(m, "exec-inaccessiblepaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); |
c090d74d TR |
333 | } |
334 | ||
4cac89bd YW |
335 | static void test_exec_temporaryfilesystem(Manager *m) { |
336 | ||
b7172f34 YW |
337 | test(m, "exec-temporaryfilesystem-options.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); |
338 | test(m, "exec-temporaryfilesystem-ro.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
339 | test(m, "exec-temporaryfilesystem-rw.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
340 | test(m, "exec-temporaryfilesystem-usr.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
4cac89bd YW |
341 | } |
342 | ||
281e05b6 | 343 | static void test_exec_systemcallfilter(Manager *m) { |
349cc4a5 | 344 | #if HAVE_SECCOMP |
738c74d7 YW |
345 | int r; |
346 | ||
f0e018e7 YW |
347 | if (!is_seccomp_available()) { |
348 | log_notice("Seccomp not available, skipping %s", __func__); | |
83f12b27 | 349 | return; |
f0e018e7 YW |
350 | } |
351 | ||
281e05b6 RC |
352 | test(m, "exec-systemcallfilter-not-failing.service", 0, CLD_EXITED); |
353 | test(m, "exec-systemcallfilter-not-failing2.service", 0, CLD_EXITED); | |
354 | test(m, "exec-systemcallfilter-failing.service", SIGSYS, CLD_KILLED); | |
355 | test(m, "exec-systemcallfilter-failing2.service", SIGSYS, CLD_KILLED); | |
738c74d7 YW |
356 | |
357 | r = find_binary("python3", NULL); | |
358 | if (r < 0) { | |
359 | log_notice_errno(r, "Skipping remaining tests in %s, could not find python3 binary: %m", __func__); | |
360 | return; | |
361 | } | |
362 | ||
b4891260 YW |
363 | test(m, "exec-systemcallfilter-with-errno-name.service", errno_from_name("EILSEQ"), CLD_EXITED); |
364 | test(m, "exec-systemcallfilter-with-errno-number.service", 255, CLD_EXITED); | |
e913b798 | 365 | test(m, "exec-systemcallfilter-with-errno-multi.service", errno_from_name("EILSEQ"), CLD_EXITED); |
281e05b6 RC |
366 | #endif |
367 | } | |
368 | ||
369 | static void test_exec_systemcallerrornumber(Manager *m) { | |
349cc4a5 | 370 | #if HAVE_SECCOMP |
738c74d7 YW |
371 | int r; |
372 | ||
f0e018e7 YW |
373 | if (!is_seccomp_available()) { |
374 | log_notice("Seccomp not available, skipping %s", __func__); | |
7a18854f | 375 | return; |
f0e018e7 YW |
376 | } |
377 | ||
738c74d7 YW |
378 | r = find_binary("python3", NULL); |
379 | if (r < 0) { | |
380 | log_notice_errno(r, "Skipping %s, could not find python3 binary: %m", __func__); | |
381 | return; | |
382 | } | |
383 | ||
7a18854f YW |
384 | test(m, "exec-systemcallerrornumber-name.service", errno_from_name("EACCES"), CLD_EXITED); |
385 | test(m, "exec-systemcallerrornumber-number.service", 255, CLD_EXITED); | |
281e05b6 RC |
386 | #endif |
387 | } | |
388 | ||
f0e018e7 | 389 | static void test_exec_restrictnamespaces(Manager *m) { |
349cc4a5 | 390 | #if HAVE_SECCOMP |
f0e018e7 YW |
391 | if (!is_seccomp_available()) { |
392 | log_notice("Seccomp not available, skipping %s", __func__); | |
97e60383 | 393 | return; |
f0e018e7 | 394 | } |
97e60383 | 395 | |
b7172f34 | 396 | test(m, "exec-restrictnamespaces-no.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); |
f0e018e7 | 397 | test(m, "exec-restrictnamespaces-yes.service", 1, CLD_EXITED); |
b7172f34 | 398 | test(m, "exec-restrictnamespaces-mnt.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); |
f0e018e7 | 399 | test(m, "exec-restrictnamespaces-mnt-blacklist.service", 1, CLD_EXITED); |
b7172f34 YW |
400 | test(m, "exec-restrictnamespaces-merge-and.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); |
401 | test(m, "exec-restrictnamespaces-merge-or.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
402 | test(m, "exec-restrictnamespaces-merge-all.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
97e60383 DH |
403 | #endif |
404 | } | |
405 | ||
f0e018e7 | 406 | static void test_exec_systemcallfilter_system(Manager *m) { |
349cc4a5 | 407 | #if HAVE_SECCOMP |
f0e018e7 YW |
408 | if (!is_seccomp_available()) { |
409 | log_notice("Seccomp not available, skipping %s", __func__); | |
83f12b27 | 410 | return; |
f0e018e7 | 411 | } |
57c2efa0 | 412 | |
69b07407 YW |
413 | test(m, "exec-systemcallfilter-system-user.service", 0, CLD_EXITED); |
414 | ||
57c2efa0 | 415 | if (!check_nobody_user_and_group()) { |
5cd33ccc | 416 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
57c2efa0 YW |
417 | return; |
418 | } | |
419 | ||
69b07407 | 420 | if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { |
5cd33ccc | 421 | log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); |
69b07407 YW |
422 | return; |
423 | } | |
424 | ||
425 | test(m, "exec-systemcallfilter-system-user-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); | |
19c0b0b9 RC |
426 | #endif |
427 | } | |
428 | ||
281e05b6 | 429 | static void test_exec_user(Manager *m) { |
69b07407 YW |
430 | test(m, "exec-user.service", 0, CLD_EXITED); |
431 | ||
57c2efa0 | 432 | if (!check_nobody_user_and_group()) { |
5cd33ccc | 433 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
57c2efa0 YW |
434 | return; |
435 | } | |
436 | ||
69b07407 | 437 | if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { |
5cd33ccc | 438 | log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); |
69b07407 YW |
439 | return; |
440 | } | |
441 | ||
442 | test(m, "exec-user-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); | |
281e05b6 RC |
443 | } |
444 | ||
445 | static void test_exec_group(Manager *m) { | |
69b07407 YW |
446 | test(m, "exec-group.service", 0, CLD_EXITED); |
447 | ||
57c2efa0 | 448 | if (!check_nobody_user_and_group()) { |
5cd33ccc | 449 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
57c2efa0 YW |
450 | return; |
451 | } | |
452 | ||
69b07407 | 453 | if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) { |
5cd33ccc | 454 | log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__); |
69b07407 YW |
455 | return; |
456 | } | |
457 | ||
458 | test(m, "exec-group-" NOBODY_GROUP_NAME ".service", 0, CLD_EXITED); | |
281e05b6 RC |
459 | } |
460 | ||
f0e018e7 | 461 | static void test_exec_supplementarygroups(Manager *m) { |
86b838ea | 462 | test(m, "exec-supplementarygroups.service", 0, CLD_EXITED); |
bf9ace96 DH |
463 | test(m, "exec-supplementarygroups-single-group.service", 0, CLD_EXITED); |
464 | test(m, "exec-supplementarygroups-single-group-user.service", 0, CLD_EXITED); | |
50ca7a35 DH |
465 | test(m, "exec-supplementarygroups-multiple-groups-default-group-user.service", 0, CLD_EXITED); |
466 | test(m, "exec-supplementarygroups-multiple-groups-withgid.service", 0, CLD_EXITED); | |
467 | test(m, "exec-supplementarygroups-multiple-groups-withuid.service", 0, CLD_EXITED); | |
86b838ea DH |
468 | } |
469 | ||
f0e018e7 | 470 | static void test_exec_dynamicuser(Manager *m) { |
b7172f34 YW |
471 | |
472 | test(m, "exec-dynamicuser-fixeduser.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
9f82d685 | 473 | if (check_user_has_group_with_same_name("adm")) |
b7172f34 | 474 | test(m, "exec-dynamicuser-fixeduser-adm.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); |
9f82d685 | 475 | if (check_user_has_group_with_same_name("games")) |
b7172f34 YW |
476 | test(m, "exec-dynamicuser-fixeduser-games.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); |
477 | test(m, "exec-dynamicuser-fixeduser-one-supplementarygroup.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
478 | test(m, "exec-dynamicuser-supplementarygroups.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
479 | test(m, "exec-dynamicuser-statedir.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
028f3a7f | 480 | |
1c587309 YW |
481 | (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL); |
482 | (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL); | |
483 | (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL); | |
484 | (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL); | |
485 | ||
028f3a7f | 486 | test(m, "exec-dynamicuser-statedir-migrate-step1.service", 0, CLD_EXITED); |
b7172f34 | 487 | test(m, "exec-dynamicuser-statedir-migrate-step2.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); |
1c587309 | 488 | |
028f3a7f YW |
489 | (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL); |
490 | (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL); | |
491 | (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL); | |
492 | (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL); | |
2b9ac11e DH |
493 | } |
494 | ||
281e05b6 RC |
495 | static void test_exec_environment(Manager *m) { |
496 | test(m, "exec-environment.service", 0, CLD_EXITED); | |
497 | test(m, "exec-environment-multiple.service", 0, CLD_EXITED); | |
498 | test(m, "exec-environment-empty.service", 0, CLD_EXITED); | |
499 | } | |
500 | ||
03bd70dd RC |
501 | static void test_exec_environmentfile(Manager *m) { |
502 | static const char e[] = | |
503 | "VAR1='word1 word2'\n" | |
504 | "VAR2=word3 \n" | |
505 | "# comment1\n" | |
506 | "\n" | |
507 | "; comment2\n" | |
508 | " ; # comment3\n" | |
509 | "line without an equal\n" | |
9b796f35 | 510 | "VAR3='$word 5 6'\n" |
b6887d7a JH |
511 | "VAR4='new\nline'\n" |
512 | "VAR5=password\\with\\backslashes"; | |
03bd70dd RC |
513 | int r; |
514 | ||
515 | r = write_string_file("/tmp/test-exec_environmentfile.conf", e, WRITE_STRING_FILE_CREATE); | |
516 | assert_se(r == 0); | |
517 | ||
518 | test(m, "exec-environmentfile.service", 0, CLD_EXITED); | |
519 | ||
f0e018e7 | 520 | (void) unlink("/tmp/test-exec_environmentfile.conf"); |
03bd70dd RC |
521 | } |
522 | ||
4c80d201 | 523 | static void test_exec_passenvironment(Manager *m) { |
e1abca2e FB |
524 | /* test-execute runs under MANAGER_USER which, by default, forwards all |
525 | * variables present in the environment, but only those that are | |
526 | * present _at the time it is created_! | |
527 | * | |
528 | * So these PassEnvironment checks are still expected to work, since we | |
529 | * are ensuring the variables are not present at manager creation (they | |
530 | * are unset explicitly in main) and are only set here. | |
531 | * | |
532 | * This is still a good approximation of how a test for MANAGER_SYSTEM | |
533 | * would work. | |
534 | */ | |
4c80d201 FB |
535 | assert_se(setenv("VAR1", "word1 word2", 1) == 0); |
536 | assert_se(setenv("VAR2", "word3", 1) == 0); | |
537 | assert_se(setenv("VAR3", "$word 5 6", 1) == 0); | |
9b796f35 | 538 | assert_se(setenv("VAR4", "new\nline", 1) == 0); |
b6887d7a | 539 | assert_se(setenv("VAR5", "passwordwithbackslashes", 1) == 0); |
4c80d201 FB |
540 | test(m, "exec-passenvironment.service", 0, CLD_EXITED); |
541 | test(m, "exec-passenvironment-repeated.service", 0, CLD_EXITED); | |
542 | test(m, "exec-passenvironment-empty.service", 0, CLD_EXITED); | |
543 | assert_se(unsetenv("VAR1") == 0); | |
544 | assert_se(unsetenv("VAR2") == 0); | |
545 | assert_se(unsetenv("VAR3") == 0); | |
9b796f35 | 546 | assert_se(unsetenv("VAR4") == 0); |
b6887d7a | 547 | assert_se(unsetenv("VAR5") == 0); |
4c80d201 FB |
548 | test(m, "exec-passenvironment-absent.service", 0, CLD_EXITED); |
549 | } | |
550 | ||
27c5347c RC |
551 | static void test_exec_umask(Manager *m) { |
552 | test(m, "exec-umask-default.service", 0, CLD_EXITED); | |
553 | test(m, "exec-umask-0177.service", 0, CLD_EXITED); | |
554 | } | |
555 | ||
cc3ddc85 RC |
556 | static void test_exec_runtimedirectory(Manager *m) { |
557 | test(m, "exec-runtimedirectory.service", 0, CLD_EXITED); | |
558 | test(m, "exec-runtimedirectory-mode.service", 0, CLD_EXITED); | |
69b07407 | 559 | test(m, "exec-runtimedirectory-owner.service", 0, CLD_EXITED); |
57c2efa0 YW |
560 | |
561 | if (!check_nobody_user_and_group()) { | |
5cd33ccc | 562 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
69b07407 YW |
563 | return; |
564 | } | |
565 | ||
566 | if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) { | |
5cd33ccc | 567 | log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__); |
57c2efa0 YW |
568 | return; |
569 | } | |
570 | ||
69b07407 | 571 | test(m, "exec-runtimedirectory-owner-" NOBODY_GROUP_NAME ".service", 0, CLD_EXITED); |
ff4ca461 RC |
572 | } |
573 | ||
574 | static void test_exec_capabilityboundingset(Manager *m) { | |
575 | int r; | |
576 | ||
ff4ca461 RC |
577 | r = find_binary("capsh", NULL); |
578 | if (r < 0) { | |
5cd33ccc | 579 | log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); |
ff4ca461 RC |
580 | return; |
581 | } | |
582 | ||
b7856f92 YW |
583 | if (have_effective_cap(CAP_CHOWN) <= 0 || |
584 | have_effective_cap(CAP_FOWNER) <= 0 || | |
585 | have_effective_cap(CAP_KILL) <= 0) { | |
586 | log_notice("Skipping %s, this process does not have enough capabilities", __func__); | |
587 | return; | |
588 | } | |
589 | ||
ff4ca461 RC |
590 | test(m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED); |
591 | test(m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED); | |
592 | test(m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED); | |
593 | test(m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED); | |
cc3ddc85 RC |
594 | } |
595 | ||
5008da1e ZJS |
596 | static void test_exec_basic(Manager *m) { |
597 | test(m, "exec-basic.service", 0, CLD_EXITED); | |
598 | } | |
599 | ||
b6dc25ee | 600 | static void test_exec_ambientcapabilities(Manager *m) { |
70d7aea5 IP |
601 | int r; |
602 | ||
603 | /* Check if the kernel has support for ambient capabilities. Run | |
604 | * the tests only if that's the case. Clearing all ambient | |
605 | * capabilities is fine, since we are expecting them to be unset | |
606 | * in the first place for the tests. */ | |
607 | r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0); | |
f0e018e7 | 608 | if (r < 0 && IN_SET(errno, EINVAL, EOPNOTSUPP, ENOSYS)) { |
5cd33ccc | 609 | log_notice("Skipping %s, the kernel does not support ambient capabilities", __func__); |
f0e018e7 YW |
610 | return; |
611 | } | |
612 | ||
e5ba1d32 | 613 | if (have_effective_cap(CAP_CHOWN) <= 0 || |
b7856f92 YW |
614 | have_effective_cap(CAP_NET_RAW) <= 0) { |
615 | log_notice("Skipping %s, this process does not have enough capabilities", __func__); | |
616 | return; | |
617 | } | |
618 | ||
b6dc25ee YW |
619 | test(m, "exec-ambientcapabilities.service", 0, CLD_EXITED); |
620 | test(m, "exec-ambientcapabilities-merge.service", 0, CLD_EXITED); | |
69b07407 | 621 | |
57c2efa0 | 622 | if (!check_nobody_user_and_group()) { |
5cd33ccc | 623 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
69b07407 YW |
624 | return; |
625 | } | |
626 | ||
627 | if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { | |
5cd33ccc | 628 | log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); |
57c2efa0 YW |
629 | return; |
630 | } | |
631 | ||
b6dc25ee YW |
632 | test(m, "exec-ambientcapabilities-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); |
633 | test(m, "exec-ambientcapabilities-merge-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); | |
70d7aea5 IP |
634 | } |
635 | ||
63447f11 RC |
636 | static void test_exec_privatenetwork(Manager *m) { |
637 | int r; | |
638 | ||
639 | r = find_binary("ip", NULL); | |
640 | if (r < 0) { | |
5cd33ccc | 641 | log_notice_errno(r, "Skipping %s, could not find ip binary: %m", __func__); |
63447f11 RC |
642 | return; |
643 | } | |
644 | ||
b7172f34 | 645 | test(m, "exec-privatenetwork-yes.service", can_unshare ? 0 : EXIT_NETWORK, CLD_EXITED); |
63447f11 RC |
646 | } |
647 | ||
c388dfea RC |
648 | static void test_exec_oomscoreadjust(Manager *m) { |
649 | test(m, "exec-oomscoreadjust-positive.service", 0, CLD_EXITED); | |
642d1a6d YW |
650 | |
651 | if (detect_container() > 0) { | |
652 | log_notice("Testing in container, skipping remaining tests in %s", __func__); | |
653 | return; | |
654 | } | |
c388dfea RC |
655 | test(m, "exec-oomscoreadjust-negative.service", 0, CLD_EXITED); |
656 | } | |
657 | ||
a6226758 RC |
658 | static void test_exec_ioschedulingclass(Manager *m) { |
659 | test(m, "exec-ioschedulingclass-none.service", 0, CLD_EXITED); | |
660 | test(m, "exec-ioschedulingclass-idle.service", 0, CLD_EXITED); | |
a6226758 | 661 | test(m, "exec-ioschedulingclass-best-effort.service", 0, CLD_EXITED); |
642d1a6d YW |
662 | |
663 | if (detect_container() > 0) { | |
664 | log_notice("Testing in container, skipping remaining tests in %s", __func__); | |
665 | return; | |
666 | } | |
667 | test(m, "exec-ioschedulingclass-realtime.service", 0, CLD_EXITED); | |
a6226758 RC |
668 | } |
669 | ||
f0e018e7 YW |
670 | static void test_exec_unsetenvironment(Manager *m) { |
671 | test(m, "exec-unsetenvironment.service", 0, CLD_EXITED); | |
42cc99d5 LP |
672 | } |
673 | ||
9672b583 LP |
674 | static void test_exec_specifier(Manager *m) { |
675 | test(m, "exec-specifier.service", 0, CLD_EXITED); | |
8b3c4b57 | 676 | test(m, "exec-specifier@foo-bar.service", 0, CLD_EXITED); |
f0e018e7 | 677 | test(m, "exec-specifier-interpolation.service", 0, CLD_EXITED); |
9672b583 LP |
678 | } |
679 | ||
f0e018e7 YW |
680 | static void test_exec_standardinput(Manager *m) { |
681 | test(m, "exec-standardinput-data.service", 0, CLD_EXITED); | |
682 | test(m, "exec-standardinput-file.service", 0, CLD_EXITED); | |
666d7877 LP |
683 | } |
684 | ||
566b7d23 ZD |
685 | static void test_exec_standardoutput(Manager *m) { |
686 | test(m, "exec-standardoutput-file.service", 0, CLD_EXITED); | |
687 | } | |
688 | ||
689 | static void test_exec_standardoutput_append(Manager *m) { | |
690 | test(m, "exec-standardoutput-append.service", 0, CLD_EXITED); | |
691 | } | |
692 | ||
ea9cfad1 LP |
693 | static int run_tests(UnitFileScope scope, const test_function_t *tests) { |
694 | const test_function_t *test = NULL; | |
c70cac54 | 695 | _cleanup_(manager_freep) Manager *m = NULL; |
19c0b0b9 RC |
696 | int r; |
697 | ||
698 | assert_se(tests); | |
699 | ||
e8112e67 | 700 | r = manager_new(scope, MANAGER_TEST_RUN_BASIC, &m); |
730d989a ZJS |
701 | if (MANAGER_SKIP_TEST(r)) |
702 | return log_tests_skipped_errno(r, "manager_new"); | |
19c0b0b9 RC |
703 | assert_se(r >= 0); |
704 | assert_se(manager_startup(m, NULL, NULL) >= 0); | |
705 | ||
706 | for (test = tests; test && *test; test++) | |
707 | (*test)(m); | |
708 | ||
19c0b0b9 RC |
709 | return 0; |
710 | } | |
711 | ||
281e05b6 | 712 | int main(int argc, char *argv[]) { |
ac1f08b9 | 713 | _cleanup_(rm_rf_physical_and_freep) char *runtime_dir = NULL; |
55890a40 | 714 | _cleanup_free_ char *test_execute_path = NULL; |
b7172f34 | 715 | _cleanup_hashmap_free_ Hashmap *s = NULL; |
ea9cfad1 | 716 | static const test_function_t user_tests[] = { |
5008da1e | 717 | test_exec_basic, |
b6dc25ee | 718 | test_exec_ambientcapabilities, |
f0e018e7 | 719 | test_exec_bindpaths, |
f0e018e7 | 720 | test_exec_capabilityboundingset, |
4e79aeaa | 721 | test_exec_cpuaffinity, |
f0e018e7 YW |
722 | test_exec_environment, |
723 | test_exec_environmentfile, | |
724 | test_exec_group, | |
281e05b6 | 725 | test_exec_ignoresigpipe, |
f0e018e7 YW |
726 | test_exec_inaccessiblepaths, |
727 | test_exec_ioschedulingclass, | |
728 | test_exec_oomscoreadjust, | |
729 | test_exec_passenvironment, | |
730 | test_exec_personality, | |
281e05b6 | 731 | test_exec_privatedevices, |
f0e018e7 YW |
732 | test_exec_privatenetwork, |
733 | test_exec_privatetmp, | |
4982dbcc | 734 | test_exec_protectkernelmodules, |
f78b36f0 | 735 | test_exec_readonlypaths, |
cdfbd1fb | 736 | test_exec_readwritepaths, |
f0e018e7 YW |
737 | test_exec_restrictnamespaces, |
738 | test_exec_runtimedirectory, | |
739 | test_exec_standardinput, | |
566b7d23 ZD |
740 | test_exec_standardoutput, |
741 | test_exec_standardoutput_append, | |
f0e018e7 | 742 | test_exec_supplementarygroups, |
281e05b6 | 743 | test_exec_systemcallerrornumber, |
f0e018e7 | 744 | test_exec_systemcallfilter, |
4cac89bd | 745 | test_exec_temporaryfilesystem, |
27c5347c | 746 | test_exec_umask, |
f0e018e7 YW |
747 | test_exec_unsetenvironment, |
748 | test_exec_user, | |
749 | test_exec_workingdirectory, | |
281e05b6 RC |
750 | NULL, |
751 | }; | |
ea9cfad1 | 752 | static const test_function_t system_tests[] = { |
f0e018e7 | 753 | test_exec_dynamicuser, |
9672b583 | 754 | test_exec_specifier, |
f0e018e7 | 755 | test_exec_systemcallfilter_system, |
19c0b0b9 RC |
756 | NULL, |
757 | }; | |
281e05b6 RC |
758 | int r; |
759 | ||
6d7c4033 | 760 | test_setup_logging(LOG_DEBUG); |
281e05b6 | 761 | |
2482f88d LP |
762 | (void) unsetenv("USER"); |
763 | (void) unsetenv("LOGNAME"); | |
63d6135f | 764 | (void) unsetenv("SHELL"); |
2482f88d | 765 | |
5f00dc4d LP |
766 | can_unshare = have_namespaces(); |
767 | ||
607ff5f9 | 768 | /* It is needed otherwise cgroup creation fails */ |
317bb217 ZJS |
769 | if (getuid() != 0) |
770 | return log_tests_skipped("not root"); | |
607ff5f9 | 771 | |
651d47d1 | 772 | r = enter_cgroup_subroot(); |
317bb217 ZJS |
773 | if (r == -ENOMEDIUM) |
774 | return log_tests_skipped("cgroupfs not available"); | |
8c759b33 | 775 | |
ac1f08b9 | 776 | assert_se(runtime_dir = setup_fake_runtime_dir()); |
55890a40 FB |
777 | test_execute_path = path_join(NULL, get_testdata_dir(), "test-execute"); |
778 | assert_se(set_unit_path(test_execute_path) >= 0); | |
281e05b6 | 779 | |
e1abca2e FB |
780 | /* Unset VAR1, VAR2 and VAR3 which are used in the PassEnvironment test |
781 | * cases, otherwise (and if they are present in the environment), | |
782 | * `manager_default_environment` will copy them into the default | |
783 | * environment which is passed to each created job, which will make the | |
784 | * tests that expect those not to be present to fail. | |
785 | */ | |
786 | assert_se(unsetenv("VAR1") == 0); | |
787 | assert_se(unsetenv("VAR2") == 0); | |
788 | assert_se(unsetenv("VAR3") == 0); | |
789 | ||
b7172f34 YW |
790 | r = run_tests(UNIT_FILE_USER, user_tests); |
791 | if (r != 0) | |
792 | return r; | |
793 | ||
794 | r = run_tests(UNIT_FILE_SYSTEM, system_tests); | |
795 | if (r != 0) | |
796 | return r; | |
797 | ||
798 | #if HAVE_SECCOMP | |
799 | /* The following tests are for 1beab8b0d0ff2d7d1436b52d4a0c3d56dc908962. */ | |
800 | if (!is_seccomp_available()) { | |
801 | log_notice("Seccomp not available, skipping unshare() filtered tests."); | |
802 | return 0; | |
803 | } | |
804 | ||
805 | assert_se(s = hashmap_new(NULL)); | |
806 | r = seccomp_syscall_resolve_name("unshare"); | |
807 | assert_se(r != __NR_SCMP_ERROR); | |
808 | assert_se(hashmap_put(s, UINT32_TO_PTR(r + 1), INT_TO_PTR(-1)) >= 0); | |
809 | assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EOPNOTSUPP), true) >= 0); | |
810 | assert_se(unshare(CLONE_NEWNS) < 0); | |
811 | assert_se(errno == EOPNOTSUPP); | |
812 | ||
813 | can_unshare = false; | |
814 | ||
463d0d15 | 815 | r = run_tests(UNIT_FILE_USER, user_tests); |
19c0b0b9 RC |
816 | if (r != 0) |
817 | return r; | |
281e05b6 | 818 | |
463d0d15 | 819 | return run_tests(UNIT_FILE_SYSTEM, system_tests); |
b7172f34 YW |
820 | #else |
821 | return 0; | |
822 | #endif | |
281e05b6 | 823 | } |