]>
Commit | Line | Data |
---|---|---|
1 | /* SPDX-License-Identifier: LGPL-2.1+ */ | |
2 | ||
3 | #include <stdio.h> | |
4 | #include <sys/prctl.h> | |
5 | #include <sys/types.h> | |
6 | ||
7 | #include "capability-util.h" | |
8 | #include "cpu-set-util.h" | |
9 | #include "errno-list.h" | |
10 | #include "fileio.h" | |
11 | #include "fs-util.h" | |
12 | #include "macro.h" | |
13 | #include "manager.h" | |
14 | #include "missing_prctl.h" | |
15 | #include "mkdir.h" | |
16 | #include "path-util.h" | |
17 | #include "rm-rf.h" | |
18 | #if HAVE_SECCOMP | |
19 | #include "seccomp-util.h" | |
20 | #endif | |
21 | #include "service.h" | |
22 | #include "stat-util.h" | |
23 | #include "tests.h" | |
24 | #include "unit.h" | |
25 | #include "user-util.h" | |
26 | #include "util.h" | |
27 | #include "virt.h" | |
28 | ||
29 | static bool can_unshare; | |
30 | ||
31 | typedef void (*test_function_t)(Manager *m); | |
32 | ||
33 | static int cld_dumped_to_killed(int code) { | |
34 | /* Depending on the system, seccomp version, … some signals might result in dumping, others in plain | |
35 | * killing. Let's ignore the difference here, and map both cases to CLD_KILLED */ | |
36 | return code == CLD_DUMPED ? CLD_KILLED : code; | |
37 | } | |
38 | ||
39 | _unused_ static bool is_run_on_travis_ci(void) { | |
40 | /* https://docs.travis-ci.com/user/environment-variables#default-environment-variables */ | |
41 | return streq_ptr(getenv("TRAVIS"), "true"); | |
42 | } | |
43 | ||
44 | static void wait_for_service_finish(Manager *m, Unit *unit) { | |
45 | Service *service = NULL; | |
46 | usec_t ts; | |
47 | usec_t timeout = 2 * USEC_PER_MINUTE; | |
48 | ||
49 | assert_se(m); | |
50 | assert_se(unit); | |
51 | ||
52 | service = SERVICE(unit); | |
53 | printf("%s\n", unit->id); | |
54 | exec_context_dump(&service->exec_context, stdout, "\t"); | |
55 | ts = now(CLOCK_MONOTONIC); | |
56 | while (!IN_SET(service->state, SERVICE_DEAD, SERVICE_FAILED)) { | |
57 | int r; | |
58 | usec_t n; | |
59 | ||
60 | r = sd_event_run(m->event, 100 * USEC_PER_MSEC); | |
61 | assert_se(r >= 0); | |
62 | ||
63 | n = now(CLOCK_MONOTONIC); | |
64 | if (ts + timeout < n) { | |
65 | log_error("Test timeout when testing %s", unit->id); | |
66 | r = unit_kill(unit, KILL_ALL, SIGKILL, NULL); | |
67 | if (r < 0) | |
68 | log_error_errno(r, "Failed to kill %s: %m", unit->id); | |
69 | exit(EXIT_FAILURE); | |
70 | } | |
71 | } | |
72 | } | |
73 | ||
74 | static void check_main_result(const char *func, Manager *m, Unit *unit, int status_expected, int code_expected) { | |
75 | Service *service = NULL; | |
76 | ||
77 | assert_se(m); | |
78 | assert_se(unit); | |
79 | ||
80 | wait_for_service_finish(m, unit); | |
81 | ||
82 | service = SERVICE(unit); | |
83 | exec_status_dump(&service->main_exec_status, stdout, "\t"); | |
84 | ||
85 | if (cld_dumped_to_killed(service->main_exec_status.code) != cld_dumped_to_killed(code_expected)) { | |
86 | log_error("%s: %s: exit code %d, expected %d", | |
87 | func, unit->id, | |
88 | service->main_exec_status.code, code_expected); | |
89 | abort(); | |
90 | } | |
91 | ||
92 | if (service->main_exec_status.status != status_expected) { | |
93 | log_error("%s: %s: exit status %d, expected %d", | |
94 | func, unit->id, | |
95 | service->main_exec_status.status, status_expected); | |
96 | abort(); | |
97 | } | |
98 | } | |
99 | ||
100 | static void check_service_result(const char *func, Manager *m, Unit *unit, ServiceResult result_expected) { | |
101 | Service *service = NULL; | |
102 | ||
103 | assert_se(m); | |
104 | assert_se(unit); | |
105 | ||
106 | wait_for_service_finish(m, unit); | |
107 | ||
108 | service = SERVICE(unit); | |
109 | ||
110 | if (service->result != result_expected) { | |
111 | log_error("%s: %s: service end result %s, expected %s", | |
112 | func, unit->id, | |
113 | service_result_to_string(service->result), | |
114 | service_result_to_string(result_expected)); | |
115 | abort(); | |
116 | } | |
117 | } | |
118 | ||
119 | static bool check_nobody_user_and_group(void) { | |
120 | static int cache = -1; | |
121 | struct passwd *p; | |
122 | struct group *g; | |
123 | ||
124 | if (cache >= 0) | |
125 | return !!cache; | |
126 | ||
127 | if (!synthesize_nobody()) | |
128 | goto invalid; | |
129 | ||
130 | p = getpwnam(NOBODY_USER_NAME); | |
131 | if (!p || | |
132 | !streq(p->pw_name, NOBODY_USER_NAME) || | |
133 | p->pw_uid != UID_NOBODY || | |
134 | p->pw_gid != GID_NOBODY) | |
135 | goto invalid; | |
136 | ||
137 | p = getpwuid(UID_NOBODY); | |
138 | if (!p || | |
139 | !streq(p->pw_name, NOBODY_USER_NAME) || | |
140 | p->pw_uid != UID_NOBODY || | |
141 | p->pw_gid != GID_NOBODY) | |
142 | goto invalid; | |
143 | ||
144 | g = getgrnam(NOBODY_GROUP_NAME); | |
145 | if (!g || | |
146 | !streq(g->gr_name, NOBODY_GROUP_NAME) || | |
147 | g->gr_gid != GID_NOBODY) | |
148 | goto invalid; | |
149 | ||
150 | g = getgrgid(GID_NOBODY); | |
151 | if (!g || | |
152 | !streq(g->gr_name, NOBODY_GROUP_NAME) || | |
153 | g->gr_gid != GID_NOBODY) | |
154 | goto invalid; | |
155 | ||
156 | cache = 1; | |
157 | return true; | |
158 | ||
159 | invalid: | |
160 | cache = 0; | |
161 | return false; | |
162 | } | |
163 | ||
164 | static bool check_user_has_group_with_same_name(const char *name) { | |
165 | struct passwd *p; | |
166 | struct group *g; | |
167 | ||
168 | assert(name); | |
169 | ||
170 | p = getpwnam(name); | |
171 | if (!p || | |
172 | !streq(p->pw_name, name)) | |
173 | return false; | |
174 | ||
175 | g = getgrgid(p->pw_gid); | |
176 | if (!g || | |
177 | !streq(g->gr_name, name)) | |
178 | return false; | |
179 | ||
180 | return true; | |
181 | } | |
182 | ||
183 | static bool is_inaccessible_available(void) { | |
184 | const char *p; | |
185 | ||
186 | FOREACH_STRING(p, | |
187 | "/run/systemd/inaccessible/reg", | |
188 | "/run/systemd/inaccessible/dir", | |
189 | "/run/systemd/inaccessible/chr", | |
190 | "/run/systemd/inaccessible/blk", | |
191 | "/run/systemd/inaccessible/fifo", | |
192 | "/run/systemd/inaccessible/sock" | |
193 | ) { | |
194 | if (access(p, F_OK) < 0) | |
195 | return false; | |
196 | } | |
197 | ||
198 | return true; | |
199 | } | |
200 | ||
201 | static void test(const char *func, Manager *m, const char *unit_name, int status_expected, int code_expected) { | |
202 | Unit *unit; | |
203 | ||
204 | assert_se(unit_name); | |
205 | ||
206 | assert_se(manager_load_startable_unit_or_warn(m, unit_name, NULL, &unit) >= 0); | |
207 | assert_se(unit_start(unit) >= 0); | |
208 | check_main_result(func, m, unit, status_expected, code_expected); | |
209 | } | |
210 | ||
211 | static void test_service(const char *func, Manager *m, const char *unit_name, ServiceResult result_expected) { | |
212 | Unit *unit; | |
213 | ||
214 | assert_se(unit_name); | |
215 | ||
216 | assert_se(manager_load_startable_unit_or_warn(m, unit_name, NULL, &unit) >= 0); | |
217 | assert_se(unit_start(unit) >= 0); | |
218 | check_service_result(func, m, unit, result_expected); | |
219 | } | |
220 | ||
221 | static void test_exec_bindpaths(Manager *m) { | |
222 | assert_se(mkdir_p("/tmp/test-exec-bindpaths", 0755) >= 0); | |
223 | assert_se(mkdir_p("/tmp/test-exec-bindreadonlypaths", 0755) >= 0); | |
224 | ||
225 | test(__func__, m, "exec-bindpaths.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
226 | ||
227 | (void) rm_rf("/tmp/test-exec-bindpaths", REMOVE_ROOT|REMOVE_PHYSICAL); | |
228 | (void) rm_rf("/tmp/test-exec-bindreadonlypaths", REMOVE_ROOT|REMOVE_PHYSICAL); | |
229 | } | |
230 | ||
231 | static void test_exec_cpuaffinity(Manager *m) { | |
232 | _cleanup_(cpu_set_reset) CPUSet c = {}; | |
233 | ||
234 | assert_se(cpu_set_realloc(&c, 8192) >= 0); /* just allocate the maximum possible size */ | |
235 | assert_se(sched_getaffinity(0, c.allocated, c.set) >= 0); | |
236 | ||
237 | if (!CPU_ISSET_S(0, c.allocated, c.set)) { | |
238 | log_notice("Cannot use CPU 0, skipping %s", __func__); | |
239 | return; | |
240 | } | |
241 | ||
242 | test(__func__, m, "exec-cpuaffinity1.service", 0, CLD_EXITED); | |
243 | test(__func__, m, "exec-cpuaffinity2.service", 0, CLD_EXITED); | |
244 | ||
245 | if (!CPU_ISSET_S(1, c.allocated, c.set) || | |
246 | !CPU_ISSET_S(2, c.allocated, c.set)) { | |
247 | log_notice("Cannot use CPU 1 or 2, skipping remaining tests in %s", __func__); | |
248 | return; | |
249 | } | |
250 | ||
251 | test(__func__, m, "exec-cpuaffinity3.service", 0, CLD_EXITED); | |
252 | } | |
253 | ||
254 | static void test_exec_workingdirectory(Manager *m) { | |
255 | assert_se(mkdir_p("/tmp/test-exec_workingdirectory", 0755) >= 0); | |
256 | ||
257 | test(__func__, m, "exec-workingdirectory.service", 0, CLD_EXITED); | |
258 | test(__func__, m, "exec-workingdirectory-trailing-dot.service", 0, CLD_EXITED); | |
259 | ||
260 | (void) rm_rf("/tmp/test-exec_workingdirectory", REMOVE_ROOT|REMOVE_PHYSICAL); | |
261 | } | |
262 | ||
263 | static void test_exec_personality(Manager *m) { | |
264 | #if defined(__x86_64__) | |
265 | test(__func__, m, "exec-personality-x86-64.service", 0, CLD_EXITED); | |
266 | ||
267 | #elif defined(__s390__) | |
268 | test(__func__, m, "exec-personality-s390.service", 0, CLD_EXITED); | |
269 | ||
270 | #elif defined(__powerpc64__) | |
271 | # if __BYTE_ORDER == __BIG_ENDIAN | |
272 | test(__func__, m, "exec-personality-ppc64.service", 0, CLD_EXITED); | |
273 | # else | |
274 | test(__func__, m, "exec-personality-ppc64le.service", 0, CLD_EXITED); | |
275 | # endif | |
276 | ||
277 | #elif defined(__aarch64__) | |
278 | test(__func__, m, "exec-personality-aarch64.service", 0, CLD_EXITED); | |
279 | ||
280 | #elif defined(__i386__) | |
281 | test(__func__, m, "exec-personality-x86.service", 0, CLD_EXITED); | |
282 | #else | |
283 | log_notice("Unknown personality, skipping %s", __func__); | |
284 | #endif | |
285 | } | |
286 | ||
287 | static void test_exec_ignoresigpipe(Manager *m) { | |
288 | test(__func__, m, "exec-ignoresigpipe-yes.service", 0, CLD_EXITED); | |
289 | test(__func__, m, "exec-ignoresigpipe-no.service", SIGPIPE, CLD_KILLED); | |
290 | } | |
291 | ||
292 | static void test_exec_privatetmp(Manager *m) { | |
293 | assert_se(touch("/tmp/test-exec_privatetmp") >= 0); | |
294 | ||
295 | test(__func__, m, "exec-privatetmp-yes.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
296 | test(__func__, m, "exec-privatetmp-no.service", 0, CLD_EXITED); | |
297 | ||
298 | unlink("/tmp/test-exec_privatetmp"); | |
299 | } | |
300 | ||
301 | static void test_exec_privatedevices(Manager *m) { | |
302 | int r; | |
303 | ||
304 | if (detect_container() > 0) { | |
305 | log_notice("Testing in container, skipping %s", __func__); | |
306 | return; | |
307 | } | |
308 | if (!is_inaccessible_available()) { | |
309 | log_notice("Testing without inaccessible, skipping %s", __func__); | |
310 | return; | |
311 | } | |
312 | ||
313 | test(__func__, m, "exec-privatedevices-yes.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
314 | test(__func__, m, "exec-privatedevices-no.service", 0, CLD_EXITED); | |
315 | test(__func__, m, "exec-privatedevices-disabled-by-prefix.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
316 | test(__func__, m, "exec-privatedevices-yes-with-group.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
317 | ||
318 | /* We use capsh to test if the capabilities are | |
319 | * properly set, so be sure that it exists */ | |
320 | r = find_binary("capsh", NULL); | |
321 | if (r < 0) { | |
322 | log_notice_errno(r, "Could not find capsh binary, skipping remaining tests in %s: %m", __func__); | |
323 | return; | |
324 | } | |
325 | ||
326 | test(__func__, m, "exec-privatedevices-yes-capability-mknod.service", 0, CLD_EXITED); | |
327 | test(__func__, m, "exec-privatedevices-no-capability-mknod.service", 0, CLD_EXITED); | |
328 | test(__func__, m, "exec-privatedevices-yes-capability-sys-rawio.service", 0, CLD_EXITED); | |
329 | test(__func__, m, "exec-privatedevices-no-capability-sys-rawio.service", 0, CLD_EXITED); | |
330 | } | |
331 | ||
332 | static void test_exec_protecthome(Manager *m) { | |
333 | if (!can_unshare) { | |
334 | log_notice("Cannot reliably unshare, skipping %s", __func__); | |
335 | return; | |
336 | } | |
337 | ||
338 | test(__func__, m, "exec-protecthome-tmpfs-vs-protectsystem-strict.service", 0, CLD_EXITED); | |
339 | } | |
340 | ||
341 | static void test_exec_protectkernelmodules(Manager *m) { | |
342 | int r; | |
343 | ||
344 | if (detect_container() > 0) { | |
345 | log_notice("Testing in container, skipping %s", __func__); | |
346 | return; | |
347 | } | |
348 | if (!is_inaccessible_available()) { | |
349 | log_notice("Testing without inaccessible, skipping %s", __func__); | |
350 | return; | |
351 | } | |
352 | ||
353 | r = find_binary("capsh", NULL); | |
354 | if (r < 0) { | |
355 | log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); | |
356 | return; | |
357 | } | |
358 | ||
359 | test(__func__, m, "exec-protectkernelmodules-no-capabilities.service", 0, CLD_EXITED); | |
360 | test(__func__, m, "exec-protectkernelmodules-yes-capabilities.service", 0, CLD_EXITED); | |
361 | test(__func__, m, "exec-protectkernelmodules-yes-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
362 | } | |
363 | ||
364 | static void test_exec_readonlypaths(Manager *m) { | |
365 | ||
366 | test(__func__, m, "exec-readonlypaths-simple.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
367 | ||
368 | if (path_is_read_only_fs("/var") > 0) { | |
369 | log_notice("Directory /var is readonly, skipping remaining tests in %s", __func__); | |
370 | return; | |
371 | } | |
372 | ||
373 | test(__func__, m, "exec-readonlypaths.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
374 | test(__func__, m, "exec-readonlypaths-with-bindpaths.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
375 | test(__func__, m, "exec-readonlypaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
376 | } | |
377 | ||
378 | static void test_exec_readwritepaths(Manager *m) { | |
379 | ||
380 | if (path_is_read_only_fs("/") > 0) { | |
381 | log_notice("Root directory is readonly, skipping %s", __func__); | |
382 | return; | |
383 | } | |
384 | ||
385 | test(__func__, m, "exec-readwritepaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
386 | } | |
387 | ||
388 | static void test_exec_inaccessiblepaths(Manager *m) { | |
389 | ||
390 | if (!is_inaccessible_available()) { | |
391 | log_notice("Testing without inaccessible, skipping %s", __func__); | |
392 | return; | |
393 | } | |
394 | ||
395 | test(__func__, m, "exec-inaccessiblepaths-sys.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
396 | ||
397 | if (path_is_read_only_fs("/") > 0) { | |
398 | log_notice("Root directory is readonly, skipping remaining tests in %s", __func__); | |
399 | return; | |
400 | } | |
401 | ||
402 | test(__func__, m, "exec-inaccessiblepaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
403 | } | |
404 | ||
405 | static void test_exec_temporaryfilesystem(Manager *m) { | |
406 | ||
407 | test(__func__, m, "exec-temporaryfilesystem-options.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
408 | test(__func__, m, "exec-temporaryfilesystem-ro.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
409 | test(__func__, m, "exec-temporaryfilesystem-rw.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
410 | test(__func__, m, "exec-temporaryfilesystem-usr.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
411 | } | |
412 | ||
413 | static void test_exec_systemcallfilter(Manager *m) { | |
414 | #if HAVE_SECCOMP | |
415 | int r; | |
416 | ||
417 | if (!is_seccomp_available()) { | |
418 | log_notice("Seccomp not available, skipping %s", __func__); | |
419 | return; | |
420 | } | |
421 | ||
422 | test(__func__, m, "exec-systemcallfilter-not-failing.service", 0, CLD_EXITED); | |
423 | test(__func__, m, "exec-systemcallfilter-not-failing2.service", 0, CLD_EXITED); | |
424 | test(__func__, m, "exec-systemcallfilter-failing.service", SIGSYS, CLD_KILLED); | |
425 | test(__func__, m, "exec-systemcallfilter-failing2.service", SIGSYS, CLD_KILLED); | |
426 | ||
427 | r = find_binary("python3", NULL); | |
428 | if (r < 0) { | |
429 | log_notice_errno(r, "Skipping remaining tests in %s, could not find python3 binary: %m", __func__); | |
430 | return; | |
431 | } | |
432 | ||
433 | test(__func__, m, "exec-systemcallfilter-with-errno-name.service", errno_from_name("EILSEQ"), CLD_EXITED); | |
434 | test(__func__, m, "exec-systemcallfilter-with-errno-number.service", 255, CLD_EXITED); | |
435 | test(__func__, m, "exec-systemcallfilter-with-errno-multi.service", errno_from_name("EILSEQ"), CLD_EXITED); | |
436 | #endif | |
437 | } | |
438 | ||
439 | static void test_exec_systemcallerrornumber(Manager *m) { | |
440 | #if HAVE_SECCOMP | |
441 | int r; | |
442 | ||
443 | if (!is_seccomp_available()) { | |
444 | log_notice("Seccomp not available, skipping %s", __func__); | |
445 | return; | |
446 | } | |
447 | ||
448 | r = find_binary("python3", NULL); | |
449 | if (r < 0) { | |
450 | log_notice_errno(r, "Skipping %s, could not find python3 binary: %m", __func__); | |
451 | return; | |
452 | } | |
453 | ||
454 | test(__func__, m, "exec-systemcallerrornumber-name.service", errno_from_name("EACCES"), CLD_EXITED); | |
455 | test(__func__, m, "exec-systemcallerrornumber-number.service", 255, CLD_EXITED); | |
456 | #endif | |
457 | } | |
458 | ||
459 | static void test_exec_restrictnamespaces(Manager *m) { | |
460 | #if HAVE_SECCOMP | |
461 | if (!is_seccomp_available()) { | |
462 | log_notice("Seccomp not available, skipping %s", __func__); | |
463 | return; | |
464 | } | |
465 | ||
466 | test(__func__, m, "exec-restrictnamespaces-no.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
467 | test(__func__, m, "exec-restrictnamespaces-yes.service", 1, CLD_EXITED); | |
468 | test(__func__, m, "exec-restrictnamespaces-mnt.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
469 | test(__func__, m, "exec-restrictnamespaces-mnt-blacklist.service", 1, CLD_EXITED); | |
470 | test(__func__, m, "exec-restrictnamespaces-merge-and.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
471 | test(__func__, m, "exec-restrictnamespaces-merge-or.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
472 | test(__func__, m, "exec-restrictnamespaces-merge-all.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
473 | #endif | |
474 | } | |
475 | ||
476 | static void test_exec_systemcallfilter_system(Manager *m) { | |
477 | /* Skip this particular test case when running under ASan, as | |
478 | * LSan intermittently segfaults when accessing memory right | |
479 | * after the test finishes. Generally, ASan & LSan don't like | |
480 | * the seccomp stuff. | |
481 | */ | |
482 | #if HAVE_SECCOMP && !HAS_FEATURE_ADDRESS_SANITIZER | |
483 | if (!is_seccomp_available()) { | |
484 | log_notice("Seccomp not available, skipping %s", __func__); | |
485 | return; | |
486 | } | |
487 | ||
488 | test(__func__, m, "exec-systemcallfilter-system-user.service", 0, CLD_EXITED); | |
489 | ||
490 | if (!check_nobody_user_and_group()) { | |
491 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); | |
492 | return; | |
493 | } | |
494 | ||
495 | if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { | |
496 | log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); | |
497 | return; | |
498 | } | |
499 | ||
500 | test(__func__, m, "exec-systemcallfilter-system-user-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); | |
501 | #endif | |
502 | } | |
503 | ||
504 | static void test_exec_user(Manager *m) { | |
505 | test(__func__, m, "exec-user.service", 0, CLD_EXITED); | |
506 | ||
507 | if (!check_nobody_user_and_group()) { | |
508 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); | |
509 | return; | |
510 | } | |
511 | ||
512 | if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { | |
513 | log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); | |
514 | return; | |
515 | } | |
516 | ||
517 | test(__func__, m, "exec-user-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); | |
518 | } | |
519 | ||
520 | static void test_exec_group(Manager *m) { | |
521 | test(__func__, m, "exec-group.service", 0, CLD_EXITED); | |
522 | ||
523 | if (!check_nobody_user_and_group()) { | |
524 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); | |
525 | return; | |
526 | } | |
527 | ||
528 | if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) { | |
529 | log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__); | |
530 | return; | |
531 | } | |
532 | ||
533 | test(__func__, m, "exec-group-" NOBODY_GROUP_NAME ".service", 0, CLD_EXITED); | |
534 | } | |
535 | ||
536 | static void test_exec_supplementarygroups(Manager *m) { | |
537 | test(__func__, m, "exec-supplementarygroups.service", 0, CLD_EXITED); | |
538 | test(__func__, m, "exec-supplementarygroups-single-group.service", 0, CLD_EXITED); | |
539 | test(__func__, m, "exec-supplementarygroups-single-group-user.service", 0, CLD_EXITED); | |
540 | test(__func__, m, "exec-supplementarygroups-multiple-groups-default-group-user.service", 0, CLD_EXITED); | |
541 | test(__func__, m, "exec-supplementarygroups-multiple-groups-withgid.service", 0, CLD_EXITED); | |
542 | test(__func__, m, "exec-supplementarygroups-multiple-groups-withuid.service", 0, CLD_EXITED); | |
543 | } | |
544 | ||
545 | static void test_exec_dynamicuser(Manager *m) { | |
546 | ||
547 | test(__func__, m, "exec-dynamicuser-fixeduser.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
548 | if (check_user_has_group_with_same_name("adm")) | |
549 | test(__func__, m, "exec-dynamicuser-fixeduser-adm.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
550 | if (check_user_has_group_with_same_name("games")) | |
551 | test(__func__, m, "exec-dynamicuser-fixeduser-games.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
552 | test(__func__, m, "exec-dynamicuser-fixeduser-one-supplementarygroup.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
553 | test(__func__, m, "exec-dynamicuser-supplementarygroups.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
554 | test(__func__, m, "exec-dynamicuser-statedir.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
555 | ||
556 | (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL); | |
557 | (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL); | |
558 | (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL); | |
559 | (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL); | |
560 | ||
561 | test(__func__, m, "exec-dynamicuser-statedir-migrate-step1.service", 0, CLD_EXITED); | |
562 | test(__func__, m, "exec-dynamicuser-statedir-migrate-step2.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
563 | ||
564 | (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL); | |
565 | (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL); | |
566 | (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL); | |
567 | (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL); | |
568 | } | |
569 | ||
570 | static void test_exec_environment(Manager *m) { | |
571 | test(__func__, m, "exec-environment-no-substitute.service", 0, CLD_EXITED); | |
572 | test(__func__, m, "exec-environment.service", 0, CLD_EXITED); | |
573 | test(__func__, m, "exec-environment-multiple.service", 0, CLD_EXITED); | |
574 | test(__func__, m, "exec-environment-empty.service", 0, CLD_EXITED); | |
575 | } | |
576 | ||
577 | static void test_exec_environmentfile(Manager *m) { | |
578 | static const char e[] = | |
579 | "VAR1='word1 word2'\n" | |
580 | "VAR2=word3 \n" | |
581 | "# comment1\n" | |
582 | "\n" | |
583 | "; comment2\n" | |
584 | " ; # comment3\n" | |
585 | "line without an equal\n" | |
586 | "VAR3='$word 5 6'\n" | |
587 | "VAR4='new\nline'\n" | |
588 | "VAR5=password\\with\\backslashes"; | |
589 | int r; | |
590 | ||
591 | r = write_string_file("/tmp/test-exec_environmentfile.conf", e, WRITE_STRING_FILE_CREATE); | |
592 | assert_se(r == 0); | |
593 | ||
594 | test(__func__, m, "exec-environmentfile.service", 0, CLD_EXITED); | |
595 | ||
596 | (void) unlink("/tmp/test-exec_environmentfile.conf"); | |
597 | } | |
598 | ||
599 | static void test_exec_passenvironment(Manager *m) { | |
600 | /* test-execute runs under MANAGER_USER which, by default, forwards all | |
601 | * variables present in the environment, but only those that are | |
602 | * present _at the time it is created_! | |
603 | * | |
604 | * So these PassEnvironment checks are still expected to work, since we | |
605 | * are ensuring the variables are not present at manager creation (they | |
606 | * are unset explicitly in main) and are only set here. | |
607 | * | |
608 | * This is still a good approximation of how a test for MANAGER_SYSTEM | |
609 | * would work. | |
610 | */ | |
611 | assert_se(setenv("VAR1", "word1 word2", 1) == 0); | |
612 | assert_se(setenv("VAR2", "word3", 1) == 0); | |
613 | assert_se(setenv("VAR3", "$word 5 6", 1) == 0); | |
614 | assert_se(setenv("VAR4", "new\nline", 1) == 0); | |
615 | assert_se(setenv("VAR5", "passwordwithbackslashes", 1) == 0); | |
616 | test(__func__, m, "exec-passenvironment.service", 0, CLD_EXITED); | |
617 | test(__func__, m, "exec-passenvironment-repeated.service", 0, CLD_EXITED); | |
618 | test(__func__, m, "exec-passenvironment-empty.service", 0, CLD_EXITED); | |
619 | assert_se(unsetenv("VAR1") == 0); | |
620 | assert_se(unsetenv("VAR2") == 0); | |
621 | assert_se(unsetenv("VAR3") == 0); | |
622 | assert_se(unsetenv("VAR4") == 0); | |
623 | assert_se(unsetenv("VAR5") == 0); | |
624 | test(__func__, m, "exec-passenvironment-absent.service", 0, CLD_EXITED); | |
625 | } | |
626 | ||
627 | static void test_exec_umask(Manager *m) { | |
628 | test(__func__, m, "exec-umask-default.service", 0, CLD_EXITED); | |
629 | test(__func__, m, "exec-umask-0177.service", 0, CLD_EXITED); | |
630 | } | |
631 | ||
632 | static void test_exec_runtimedirectory(Manager *m) { | |
633 | test(__func__, m, "exec-runtimedirectory.service", 0, CLD_EXITED); | |
634 | test(__func__, m, "exec-runtimedirectory-mode.service", 0, CLD_EXITED); | |
635 | test(__func__, m, "exec-runtimedirectory-owner.service", 0, CLD_EXITED); | |
636 | ||
637 | if (!check_nobody_user_and_group()) { | |
638 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); | |
639 | return; | |
640 | } | |
641 | ||
642 | if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) { | |
643 | log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__); | |
644 | return; | |
645 | } | |
646 | ||
647 | test(__func__, m, "exec-runtimedirectory-owner-" NOBODY_GROUP_NAME ".service", 0, CLD_EXITED); | |
648 | } | |
649 | ||
650 | static void test_exec_capabilityboundingset(Manager *m) { | |
651 | int r; | |
652 | ||
653 | r = find_binary("capsh", NULL); | |
654 | if (r < 0) { | |
655 | log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); | |
656 | return; | |
657 | } | |
658 | ||
659 | if (have_effective_cap(CAP_CHOWN) <= 0 || | |
660 | have_effective_cap(CAP_FOWNER) <= 0 || | |
661 | have_effective_cap(CAP_KILL) <= 0) { | |
662 | log_notice("Skipping %s, this process does not have enough capabilities", __func__); | |
663 | return; | |
664 | } | |
665 | ||
666 | test(__func__, m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED); | |
667 | test(__func__, m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED); | |
668 | test(__func__, m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED); | |
669 | test(__func__, m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED); | |
670 | } | |
671 | ||
672 | static void test_exec_basic(Manager *m) { | |
673 | test(__func__, m, "exec-basic.service", 0, CLD_EXITED); | |
674 | } | |
675 | ||
676 | static void test_exec_ambientcapabilities(Manager *m) { | |
677 | int r; | |
678 | ||
679 | /* Check if the kernel has support for ambient capabilities. Run | |
680 | * the tests only if that's the case. Clearing all ambient | |
681 | * capabilities is fine, since we are expecting them to be unset | |
682 | * in the first place for the tests. */ | |
683 | r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0); | |
684 | if (r < 0 && IN_SET(errno, EINVAL, EOPNOTSUPP, ENOSYS)) { | |
685 | log_notice("Skipping %s, the kernel does not support ambient capabilities", __func__); | |
686 | return; | |
687 | } | |
688 | ||
689 | if (have_effective_cap(CAP_CHOWN) <= 0 || | |
690 | have_effective_cap(CAP_NET_RAW) <= 0) { | |
691 | log_notice("Skipping %s, this process does not have enough capabilities", __func__); | |
692 | return; | |
693 | } | |
694 | ||
695 | test(__func__, m, "exec-ambientcapabilities.service", 0, CLD_EXITED); | |
696 | test(__func__, m, "exec-ambientcapabilities-merge.service", 0, CLD_EXITED); | |
697 | ||
698 | if (!check_nobody_user_and_group()) { | |
699 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); | |
700 | return; | |
701 | } | |
702 | ||
703 | if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { | |
704 | log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); | |
705 | return; | |
706 | } | |
707 | ||
708 | test(__func__, m, "exec-ambientcapabilities-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); | |
709 | test(__func__, m, "exec-ambientcapabilities-merge-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); | |
710 | } | |
711 | ||
712 | static void test_exec_privatenetwork(Manager *m) { | |
713 | int r; | |
714 | ||
715 | r = find_binary("ip", NULL); | |
716 | if (r < 0) { | |
717 | log_notice_errno(r, "Skipping %s, could not find ip binary: %m", __func__); | |
718 | return; | |
719 | } | |
720 | ||
721 | test(__func__, m, "exec-privatenetwork-yes.service", can_unshare ? 0 : EXIT_NETWORK, CLD_EXITED); | |
722 | } | |
723 | ||
724 | static void test_exec_oomscoreadjust(Manager *m) { | |
725 | test(__func__, m, "exec-oomscoreadjust-positive.service", 0, CLD_EXITED); | |
726 | ||
727 | if (detect_container() > 0) { | |
728 | log_notice("Testing in container, skipping remaining tests in %s", __func__); | |
729 | return; | |
730 | } | |
731 | test(__func__, m, "exec-oomscoreadjust-negative.service", 0, CLD_EXITED); | |
732 | } | |
733 | ||
734 | static void test_exec_ioschedulingclass(Manager *m) { | |
735 | test(__func__, m, "exec-ioschedulingclass-none.service", 0, CLD_EXITED); | |
736 | test(__func__, m, "exec-ioschedulingclass-idle.service", 0, CLD_EXITED); | |
737 | test(__func__, m, "exec-ioschedulingclass-best-effort.service", 0, CLD_EXITED); | |
738 | ||
739 | if (detect_container() > 0) { | |
740 | log_notice("Testing in container, skipping remaining tests in %s", __func__); | |
741 | return; | |
742 | } | |
743 | test(__func__, m, "exec-ioschedulingclass-realtime.service", 0, CLD_EXITED); | |
744 | } | |
745 | ||
746 | static void test_exec_unsetenvironment(Manager *m) { | |
747 | test(__func__, m, "exec-unsetenvironment.service", 0, CLD_EXITED); | |
748 | } | |
749 | ||
750 | static void test_exec_specifier(Manager *m) { | |
751 | test(__func__, m, "exec-specifier.service", 0, CLD_EXITED); | |
752 | test(__func__, m, "exec-specifier@foo-bar.service", 0, CLD_EXITED); | |
753 | test(__func__, m, "exec-specifier-interpolation.service", 0, CLD_EXITED); | |
754 | } | |
755 | ||
756 | static void test_exec_standardinput(Manager *m) { | |
757 | test(__func__, m, "exec-standardinput-data.service", 0, CLD_EXITED); | |
758 | test(__func__, m, "exec-standardinput-file.service", 0, CLD_EXITED); | |
759 | test(__func__, m, "exec-standardinput-file-cat.service", 0, CLD_EXITED); | |
760 | } | |
761 | ||
762 | static void test_exec_standardoutput(Manager *m) { | |
763 | test(__func__, m, "exec-standardoutput-file.service", 0, CLD_EXITED); | |
764 | } | |
765 | ||
766 | static void test_exec_standardoutput_append(Manager *m) { | |
767 | test(__func__, m, "exec-standardoutput-append.service", 0, CLD_EXITED); | |
768 | } | |
769 | ||
770 | static void test_exec_condition(Manager *m) { | |
771 | test_service(__func__, m, "exec-condition-failed.service", SERVICE_FAILURE_EXIT_CODE); | |
772 | test_service(__func__, m, "exec-condition-skip.service", SERVICE_SKIP_CONDITION); | |
773 | } | |
774 | ||
775 | typedef struct test_entry { | |
776 | test_function_t f; | |
777 | const char *name; | |
778 | } test_entry; | |
779 | ||
780 | #define entry(x) {x, #x} | |
781 | ||
782 | static int run_tests(UnitFileScope scope, const test_entry tests[], char **patterns) { | |
783 | const test_entry *test = NULL; | |
784 | _cleanup_(manager_freep) Manager *m = NULL; | |
785 | int r; | |
786 | ||
787 | assert_se(tests); | |
788 | ||
789 | r = manager_new(scope, MANAGER_TEST_RUN_BASIC, &m); | |
790 | m->default_std_output = EXEC_OUTPUT_NULL; /* don't rely on host journald */ | |
791 | if (manager_errno_skip_test(r)) | |
792 | return log_tests_skipped_errno(r, "manager_new"); | |
793 | assert_se(r >= 0); | |
794 | assert_se(manager_startup(m, NULL, NULL) >= 0); | |
795 | ||
796 | for (test = tests; test && test->f; test++) | |
797 | if (strv_fnmatch_or_empty(patterns, test->name, FNM_NOESCAPE)) | |
798 | test->f(m); | |
799 | else | |
800 | log_info("Skipping %s because it does not match any pattern.", test->name); | |
801 | ||
802 | return 0; | |
803 | } | |
804 | ||
805 | int main(int argc, char *argv[]) { | |
806 | _cleanup_(rm_rf_physical_and_freep) char *runtime_dir = NULL; | |
807 | _cleanup_free_ char *test_execute_path = NULL; | |
808 | ||
809 | static const test_entry user_tests[] = { | |
810 | entry(test_exec_basic), | |
811 | entry(test_exec_ambientcapabilities), | |
812 | entry(test_exec_bindpaths), | |
813 | entry(test_exec_capabilityboundingset), | |
814 | entry(test_exec_condition), | |
815 | entry(test_exec_cpuaffinity), | |
816 | entry(test_exec_environment), | |
817 | entry(test_exec_environmentfile), | |
818 | entry(test_exec_group), | |
819 | entry(test_exec_ignoresigpipe), | |
820 | entry(test_exec_inaccessiblepaths), | |
821 | entry(test_exec_ioschedulingclass), | |
822 | entry(test_exec_oomscoreadjust), | |
823 | entry(test_exec_passenvironment), | |
824 | entry(test_exec_personality), | |
825 | entry(test_exec_privatedevices), | |
826 | entry(test_exec_privatenetwork), | |
827 | entry(test_exec_privatetmp), | |
828 | entry(test_exec_protecthome), | |
829 | entry(test_exec_protectkernelmodules), | |
830 | entry(test_exec_readonlypaths), | |
831 | entry(test_exec_readwritepaths), | |
832 | entry(test_exec_restrictnamespaces), | |
833 | entry(test_exec_runtimedirectory), | |
834 | entry(test_exec_standardinput), | |
835 | entry(test_exec_standardoutput), | |
836 | entry(test_exec_standardoutput_append), | |
837 | entry(test_exec_supplementarygroups), | |
838 | entry(test_exec_systemcallerrornumber), | |
839 | entry(test_exec_systemcallfilter), | |
840 | entry(test_exec_temporaryfilesystem), | |
841 | entry(test_exec_umask), | |
842 | entry(test_exec_unsetenvironment), | |
843 | entry(test_exec_user), | |
844 | entry(test_exec_workingdirectory), | |
845 | {}, | |
846 | }; | |
847 | static const test_entry system_tests[] = { | |
848 | entry(test_exec_dynamicuser), | |
849 | entry(test_exec_specifier), | |
850 | entry(test_exec_systemcallfilter_system), | |
851 | {}, | |
852 | }; | |
853 | int r; | |
854 | ||
855 | test_setup_logging(LOG_DEBUG); | |
856 | ||
857 | #if HAS_FEATURE_ADDRESS_SANITIZER | |
858 | if (is_run_on_travis_ci()) { | |
859 | log_notice("Running on TravisCI under ASan, skipping, see https://github.com/systemd/systemd/issues/10696"); | |
860 | return EXIT_TEST_SKIP; | |
861 | } | |
862 | #endif | |
863 | ||
864 | (void) unsetenv("USER"); | |
865 | (void) unsetenv("LOGNAME"); | |
866 | (void) unsetenv("SHELL"); | |
867 | (void) unsetenv("HOME"); | |
868 | ||
869 | can_unshare = have_namespaces(); | |
870 | ||
871 | /* It is needed otherwise cgroup creation fails */ | |
872 | if (getuid() != 0) | |
873 | return log_tests_skipped("not root"); | |
874 | ||
875 | r = enter_cgroup_subroot(NULL); | |
876 | if (r == -ENOMEDIUM) | |
877 | return log_tests_skipped("cgroupfs not available"); | |
878 | ||
879 | assert_se(runtime_dir = setup_fake_runtime_dir()); | |
880 | test_execute_path = path_join(get_testdata_dir(), "test-execute"); | |
881 | assert_se(set_unit_path(test_execute_path) >= 0); | |
882 | ||
883 | /* Unset VAR1, VAR2 and VAR3 which are used in the PassEnvironment test | |
884 | * cases, otherwise (and if they are present in the environment), | |
885 | * `manager_default_environment` will copy them into the default | |
886 | * environment which is passed to each created job, which will make the | |
887 | * tests that expect those not to be present to fail. | |
888 | */ | |
889 | assert_se(unsetenv("VAR1") == 0); | |
890 | assert_se(unsetenv("VAR2") == 0); | |
891 | assert_se(unsetenv("VAR3") == 0); | |
892 | ||
893 | r = run_tests(UNIT_FILE_USER, user_tests, argv + 1); | |
894 | if (r != 0) | |
895 | return r; | |
896 | ||
897 | r = run_tests(UNIT_FILE_SYSTEM, system_tests, argv + 1); | |
898 | if (r != 0) | |
899 | return r; | |
900 | ||
901 | #if HAVE_SECCOMP | |
902 | /* The following tests are for 1beab8b0d0ff2d7d1436b52d4a0c3d56dc908962. */ | |
903 | if (!is_seccomp_available()) { | |
904 | log_notice("Seccomp not available, skipping unshare() filtered tests."); | |
905 | return 0; | |
906 | } | |
907 | ||
908 | _cleanup_hashmap_free_ Hashmap *s = NULL; | |
909 | assert_se(s = hashmap_new(NULL)); | |
910 | r = seccomp_syscall_resolve_name("unshare"); | |
911 | assert_se(r != __NR_SCMP_ERROR); | |
912 | assert_se(hashmap_put(s, UINT32_TO_PTR(r + 1), INT_TO_PTR(-1)) >= 0); | |
913 | assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EOPNOTSUPP), true) >= 0); | |
914 | assert_se(unshare(CLONE_NEWNS) < 0); | |
915 | assert_se(errno == EOPNOTSUPP); | |
916 | ||
917 | can_unshare = false; | |
918 | ||
919 | r = run_tests(UNIT_FILE_USER, user_tests, argv + 1); | |
920 | if (r != 0) | |
921 | return r; | |
922 | ||
923 | return run_tests(UNIT_FILE_SYSTEM, system_tests, argv + 1); | |
924 | #else | |
925 | return 0; | |
926 | #endif | |
927 | } |