src/test/test-execute.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <stdio.h>
   4 #include <sys/prctl.h>
   5 #include <sys/types.h>
   6
   7 #include "capability-util.h"
   8 #include "cpu-set-util.h"
   9 #include "errno-list.h"
  10 #include "fileio.h"
  11 #include "fs-util.h"
  12 #include "macro.h"
  13 #include "manager.h"
  14 #include "missing_prctl.h"
  15 #include "mkdir.h"
  16 #include "path-util.h"
  17 #include "rm-rf.h"
  18 #if HAVE_SECCOMP
  19 #include "seccomp-util.h"
  20 #endif
  21 #include "service.h"
  22 #include "stat-util.h"
  23 #include "tests.h"
  24 #include "unit.h"
  25 #include "user-util.h"
  26 #include "util.h"
  27 #include "virt.h"
  28
  29 static bool can_unshare;
  30
  31 typedef void (*test_function_t)(Manager *m);
  32
  33 static int cld_dumped_to_killed(int code) {
  34         /* Depending on the system, seccomp version, … some signals might result in dumping, others in plain
  35          * killing. Let's ignore the difference here, and map both cases to CLD_KILLED */
  36         return code == CLD_DUMPED ? CLD_KILLED : code;
  37 }
  38
  39 static void wait_for_service_finish(Manager *m, Unit *unit) {
  40         Service *service = NULL;
  41         usec_t ts;
  42         usec_t timeout = 2 * USEC_PER_MINUTE;
  43
  44         assert_se(m);
  45         assert_se(unit);
  46
  47         service = SERVICE(unit);
  48         printf("%s\n", unit->id);
  49         exec_context_dump(&service->exec_context, stdout, "\t");
  50         ts = now(CLOCK_MONOTONIC);
  51         while (!IN_SET(service->state, SERVICE_DEAD, SERVICE_FAILED)) {
  52                 int r;
  53                 usec_t n;
  54
  55                 r = sd_event_run(m->event, 100 * USEC_PER_MSEC);
  56                 assert_se(r >= 0);
  57
  58                 n = now(CLOCK_MONOTONIC);
  59                 if (ts + timeout < n) {
  60                         log_error("Test timeout when testing %s", unit->id);
  61                         r = unit_kill(unit, KILL_ALL, SIGKILL, NULL);
  62                         if (r < 0)
  63                                 log_error_errno(r, "Failed to kill %s: %m", unit->id);
  64                         exit(EXIT_FAILURE);
  65                 }
  66         }
  67 }
  68
  69 static void check_main_result(const char *file, unsigned line, const char *func,
  70                               Manager *m, Unit *unit, int status_expected, int code_expected) {
  71         Service *service = NULL;
  72
  73         assert_se(m);
  74         assert_se(unit);
  75
  76         wait_for_service_finish(m, unit);
  77
  78         service = SERVICE(unit);
  79         exec_status_dump(&service->main_exec_status, stdout, "\t");
  80
  81         if (cld_dumped_to_killed(service->main_exec_status.code) != cld_dumped_to_killed(code_expected)) {
  82                 log_error("%s:%u:%s %s: exit code %d, expected %d",
  83                           file, line, func,
  84                           unit->id,
  85                           service->main_exec_status.code, code_expected);
  86                 abort();
  87         }
  88
  89         if (service->main_exec_status.status != status_expected) {
  90                 log_error("%s:%u:%s: %s: exit status %d, expected %d",
  91                           file, line, func, unit->id,
  92                           service->main_exec_status.status, status_expected);
  93                 abort();
  94         }
  95 }
  96
  97 static void check_service_result(const char *file, unsigned line, const char *func,
  98                                  Manager *m, Unit *unit, ServiceResult result_expected) {
  99         Service *service = NULL;
 100
 101         assert_se(m);
 102         assert_se(unit);
 103
 104         wait_for_service_finish(m, unit);
 105
 106         service = SERVICE(unit);
 107
 108         if (service->result != result_expected) {
 109                 log_error("%s:%u:%s: %s: service end result %s, expected %s",
 110                           file, line, func,
 111                           unit->id,
 112                           service_result_to_string(service->result),
 113                           service_result_to_string(result_expected));
 114                 abort();
 115         }
 116 }
 117
 118 static bool check_nobody_user_and_group(void) {
 119         static int cache = -1;
 120         struct passwd *p;
 121         struct group *g;
 122
 123         if (cache >= 0)
 124                 return !!cache;
 125
 126         if (!synthesize_nobody())
 127                 goto invalid;
 128
 129         p = getpwnam(NOBODY_USER_NAME);
 130         if (!p ||
 131             !streq(p->pw_name, NOBODY_USER_NAME) ||
 132             p->pw_uid != UID_NOBODY ||
 133             p->pw_gid != GID_NOBODY)
 134                 goto invalid;
 135
 136         p = getpwuid(UID_NOBODY);
 137         if (!p ||
 138             !streq(p->pw_name, NOBODY_USER_NAME) ||
 139             p->pw_uid != UID_NOBODY ||
 140             p->pw_gid != GID_NOBODY)
 141                 goto invalid;
 142
 143         g = getgrnam(NOBODY_GROUP_NAME);
 144         if (!g ||
 145             !streq(g->gr_name, NOBODY_GROUP_NAME) ||
 146             g->gr_gid != GID_NOBODY)
 147                 goto invalid;
 148
 149         g = getgrgid(GID_NOBODY);
 150         if (!g ||
 151             !streq(g->gr_name, NOBODY_GROUP_NAME) ||
 152             g->gr_gid != GID_NOBODY)
 153                 goto invalid;
 154
 155         cache = 1;
 156         return true;
 157
 158 invalid:
 159         cache = 0;
 160         return false;
 161 }
 162
 163 static bool check_user_has_group_with_same_name(const char *name) {
 164         struct passwd *p;
 165         struct group *g;
 166
 167         assert(name);
 168
 169         p = getpwnam(name);
 170         if (!p ||
 171             !streq(p->pw_name, name))
 172                 return false;
 173
 174         g = getgrgid(p->pw_gid);
 175         if (!g ||
 176             !streq(g->gr_name, name))
 177                 return false;
 178
 179         return true;
 180 }
 181
 182 static bool is_inaccessible_available(void) {
 183         const char *p;
 184
 185         FOREACH_STRING(p,
 186                 "/run/systemd/inaccessible/reg",
 187                 "/run/systemd/inaccessible/dir",
 188                 "/run/systemd/inaccessible/chr",
 189                 "/run/systemd/inaccessible/blk",
 190                 "/run/systemd/inaccessible/fifo",
 191                 "/run/systemd/inaccessible/sock"
 192         ) {
 193                 if (access(p, F_OK) < 0)
 194                         return false;
 195         }
 196
 197         return true;
 198 }
 199
 200 static void _test(const char *file, unsigned line, const char *func,
 201                   Manager *m, const char *unit_name, int status_expected, int code_expected) {
 202         Unit *unit;
 203
 204         assert_se(unit_name);
 205
 206         assert_se(manager_load_startable_unit_or_warn(m, unit_name, NULL, &unit) >= 0);
 207         assert_se(unit_start(unit) >= 0);
 208         check_main_result(file, line, func, m, unit, status_expected, code_expected);
 209 }
 210 #define test(m, unit_name, status_expected, code_expected) \
 211         _test(PROJECT_FILE, __LINE__, __func__, m, unit_name, status_expected, code_expected)
 212
 213 static void _test_service(const char *file, unsigned line, const char *func,
 214                           Manager *m, const char *unit_name, ServiceResult result_expected) {
 215         Unit *unit;
 216
 217         assert_se(unit_name);
 218
 219         assert_se(manager_load_startable_unit_or_warn(m, unit_name, NULL, &unit) >= 0);
 220         assert_se(unit_start(unit) >= 0);
 221         check_service_result(file, line, func, m, unit, result_expected);
 222 }
 223 #define test_service(m, unit_name, result_expected) \
 224         _test_service(PROJECT_FILE, __LINE__, __func__, m, unit_name, result_expected)
 225
 226 static void test_exec_bindpaths(Manager *m) {
 227         assert_se(mkdir_p("/tmp/test-exec-bindpaths", 0755) >= 0);
 228         assert_se(mkdir_p("/tmp/test-exec-bindreadonlypaths", 0755) >= 0);
 229
 230         test(m, "exec-bindpaths.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 231
 232         (void) rm_rf("/tmp/test-exec-bindpaths", REMOVE_ROOT|REMOVE_PHYSICAL);
 233         (void) rm_rf("/tmp/test-exec-bindreadonlypaths", REMOVE_ROOT|REMOVE_PHYSICAL);
 234 }
 235
 236 static void test_exec_cpuaffinity(Manager *m) {
 237         _cleanup_(cpu_set_reset) CPUSet c = {};
 238
 239         assert_se(cpu_set_realloc(&c, 8192) >= 0); /* just allocate the maximum possible size */
 240         assert_se(sched_getaffinity(0, c.allocated, c.set) >= 0);
 241
 242         if (!CPU_ISSET_S(0, c.allocated, c.set)) {
 243                 log_notice("Cannot use CPU 0, skipping %s", __func__);
 244                 return;
 245         }
 246
 247         test(m, "exec-cpuaffinity1.service", 0, CLD_EXITED);
 248         test(m, "exec-cpuaffinity2.service", 0, CLD_EXITED);
 249
 250         if (!CPU_ISSET_S(1, c.allocated, c.set) ||
 251             !CPU_ISSET_S(2, c.allocated, c.set)) {
 252                 log_notice("Cannot use CPU 1 or 2, skipping remaining tests in %s", __func__);
 253                 return;
 254         }
 255
 256         test(m, "exec-cpuaffinity3.service", 0, CLD_EXITED);
 257 }
 258
 259 static void test_exec_workingdirectory(Manager *m) {
 260         assert_se(mkdir_p("/tmp/test-exec_workingdirectory", 0755) >= 0);
 261
 262         test(m, "exec-workingdirectory.service", 0, CLD_EXITED);
 263         test(m, "exec-workingdirectory-trailing-dot.service", 0, CLD_EXITED);
 264
 265         (void) rm_rf("/tmp/test-exec_workingdirectory", REMOVE_ROOT|REMOVE_PHYSICAL);
 266 }
 267
 268 static void test_exec_personality(Manager *m) {
 269 #if defined(__x86_64__)
 270         test(m, "exec-personality-x86-64.service", 0, CLD_EXITED);
 271
 272 #elif defined(__s390__)
 273         test(m, "exec-personality-s390.service", 0, CLD_EXITED);
 274
 275 #elif defined(__powerpc64__)
 276 #  if __BYTE_ORDER == __BIG_ENDIAN
 277         test(m, "exec-personality-ppc64.service", 0, CLD_EXITED);
 278 #  else
 279         test(m, "exec-personality-ppc64le.service", 0, CLD_EXITED);
 280 #  endif
 281
 282 #elif defined(__aarch64__)
 283         test(m, "exec-personality-aarch64.service", 0, CLD_EXITED);
 284
 285 #elif defined(__i386__)
 286         test(m, "exec-personality-x86.service", 0, CLD_EXITED);
 287 #else
 288         log_notice("Unknown personality, skipping %s", __func__);
 289 #endif
 290 }
 291
 292 static void test_exec_ignoresigpipe(Manager *m) {
 293         test(m, "exec-ignoresigpipe-yes.service", 0, CLD_EXITED);
 294         test(m, "exec-ignoresigpipe-no.service", SIGPIPE, CLD_KILLED);
 295 }
 296
 297 static void test_exec_privatetmp(Manager *m) {
 298         assert_se(touch("/tmp/test-exec_privatetmp") >= 0);
 299
 300         test(m, "exec-privatetmp-yes.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 301         test(m, "exec-privatetmp-no.service", 0, CLD_EXITED);
 302         test(m, "exec-privatetmp-disabled-by-prefix.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 303
 304         unlink("/tmp/test-exec_privatetmp");
 305 }
 306
 307 static void test_exec_privatedevices(Manager *m) {
 308         int r;
 309
 310         if (detect_container() > 0) {
 311                 log_notice("Testing in container, skipping %s", __func__);
 312                 return;
 313         }
 314         if (!is_inaccessible_available()) {
 315                 log_notice("Testing without inaccessible, skipping %s", __func__);
 316                 return;
 317         }
 318
 319         test(m, "exec-privatedevices-yes.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 320         test(m, "exec-privatedevices-no.service", 0, CLD_EXITED);
 321         test(m, "exec-privatedevices-disabled-by-prefix.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 322         test(m, "exec-privatedevices-yes-with-group.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 323
 324         /* We use capsh to test if the capabilities are
 325          * properly set, so be sure that it exists */
 326         r = find_executable("capsh", NULL);
 327         if (r < 0) {
 328                 log_notice_errno(r, "Could not find capsh binary, skipping remaining tests in %s: %m", __func__);
 329                 return;
 330         }
 331
 332         test(m, "exec-privatedevices-yes-capability-mknod.service", 0, CLD_EXITED);
 333         test(m, "exec-privatedevices-no-capability-mknod.service", 0, CLD_EXITED);
 334         test(m, "exec-privatedevices-yes-capability-sys-rawio.service", 0, CLD_EXITED);
 335         test(m, "exec-privatedevices-no-capability-sys-rawio.service", 0, CLD_EXITED);
 336 }
 337
 338 static void test_exec_protecthome(Manager *m) {
 339         if (!can_unshare) {
 340                 log_notice("Cannot reliably unshare, skipping %s", __func__);
 341                 return;
 342         }
 343
 344         test(m, "exec-protecthome-tmpfs-vs-protectsystem-strict.service", 0, CLD_EXITED);
 345 }
 346
 347 static void test_exec_protectkernelmodules(Manager *m) {
 348         int r;
 349
 350         if (detect_container() > 0) {
 351                 log_notice("Testing in container, skipping %s", __func__);
 352                 return;
 353         }
 354         if (!is_inaccessible_available()) {
 355                 log_notice("Testing without inaccessible, skipping %s", __func__);
 356                 return;
 357         }
 358
 359         r = find_executable("capsh", NULL);
 360         if (r < 0) {
 361                 log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
 362                 return;
 363         }
 364
 365         test(m, "exec-protectkernelmodules-no-capabilities.service", 0, CLD_EXITED);
 366         test(m, "exec-protectkernelmodules-yes-capabilities.service", 0, CLD_EXITED);
 367         test(m, "exec-protectkernelmodules-yes-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 368 }
 369
 370 static void test_exec_readonlypaths(Manager *m) {
 371
 372         test(m, "exec-readonlypaths-simple.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 373
 374         if (path_is_read_only_fs("/var") > 0) {
 375                 log_notice("Directory /var is readonly, skipping remaining tests in %s", __func__);
 376                 return;
 377         }
 378
 379         test(m, "exec-readonlypaths.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 380         test(m, "exec-readonlypaths-with-bindpaths.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 381         test(m, "exec-readonlypaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 382 }
 383
 384 static void test_exec_readwritepaths(Manager *m) {
 385
 386         if (path_is_read_only_fs("/") > 0) {
 387                 log_notice("Root directory is readonly, skipping %s", __func__);
 388                 return;
 389         }
 390
 391         test(m, "exec-readwritepaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 392 }
 393
 394 static void test_exec_inaccessiblepaths(Manager *m) {
 395
 396         if (!is_inaccessible_available()) {
 397                 log_notice("Testing without inaccessible, skipping %s", __func__);
 398                 return;
 399         }
 400
 401         test(m, "exec-inaccessiblepaths-sys.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 402
 403         if (path_is_read_only_fs("/") > 0) {
 404                 log_notice("Root directory is readonly, skipping remaining tests in %s", __func__);
 405                 return;
 406         }
 407
 408         test(m, "exec-inaccessiblepaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 409 }
 410
 411 static void test_exec_temporaryfilesystem(Manager *m) {
 412
 413         test(m, "exec-temporaryfilesystem-options.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 414         test(m, "exec-temporaryfilesystem-ro.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 415         test(m, "exec-temporaryfilesystem-rw.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 416         test(m, "exec-temporaryfilesystem-usr.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 417 }
 418
 419 static void test_exec_systemcallfilter(Manager *m) {
 420 #if HAVE_SECCOMP
 421         int r;
 422
 423         if (!is_seccomp_available()) {
 424                 log_notice("Seccomp not available, skipping %s", __func__);
 425                 return;
 426         }
 427
 428         test(m, "exec-systemcallfilter-not-failing.service", 0, CLD_EXITED);
 429         test(m, "exec-systemcallfilter-not-failing2.service", 0, CLD_EXITED);
 430         test(m, "exec-systemcallfilter-failing.service", SIGSYS, CLD_KILLED);
 431         test(m, "exec-systemcallfilter-failing2.service", SIGSYS, CLD_KILLED);
 432
 433         r = find_executable("python3", NULL);
 434         if (r < 0) {
 435                 log_notice_errno(r, "Skipping remaining tests in %s, could not find python3 binary: %m", __func__);
 436                 return;
 437         }
 438
 439         test(m, "exec-systemcallfilter-with-errno-name.service", errno_from_name("EILSEQ"), CLD_EXITED);
 440         test(m, "exec-systemcallfilter-with-errno-number.service", 255, CLD_EXITED);
 441         test(m, "exec-systemcallfilter-with-errno-multi.service", errno_from_name("EILSEQ"), CLD_EXITED);
 442         test(m, "exec-systemcallfilter-override-error-action.service", SIGSYS, CLD_KILLED);
 443         test(m, "exec-systemcallfilter-override-error-action2.service", errno_from_name("EILSEQ"), CLD_EXITED);
 444 #endif
 445 }
 446
 447 static void test_exec_systemcallerrornumber(Manager *m) {
 448 #if HAVE_SECCOMP
 449         int r;
 450
 451         if (!is_seccomp_available()) {
 452                 log_notice("Seccomp not available, skipping %s", __func__);
 453                 return;
 454         }
 455
 456         r = find_executable("python3", NULL);
 457         if (r < 0) {
 458                 log_notice_errno(r, "Skipping %s, could not find python3 binary: %m", __func__);
 459                 return;
 460         }
 461
 462         test(m, "exec-systemcallerrornumber-name.service", errno_from_name("EACCES"), CLD_EXITED);
 463         test(m, "exec-systemcallerrornumber-number.service", 255, CLD_EXITED);
 464 #endif
 465 }
 466
 467 static void test_exec_restrictnamespaces(Manager *m) {
 468 #if HAVE_SECCOMP
 469         if (!is_seccomp_available()) {
 470                 log_notice("Seccomp not available, skipping %s", __func__);
 471                 return;
 472         }
 473
 474         test(m, "exec-restrictnamespaces-no.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 475         test(m, "exec-restrictnamespaces-yes.service", 1, CLD_EXITED);
 476         test(m, "exec-restrictnamespaces-mnt.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 477         test(m, "exec-restrictnamespaces-mnt-deny-list.service", 1, CLD_EXITED);
 478         test(m, "exec-restrictnamespaces-merge-and.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 479         test(m, "exec-restrictnamespaces-merge-or.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 480         test(m, "exec-restrictnamespaces-merge-all.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 481 #endif
 482 }
 483
 484 static void test_exec_systemcallfilter_system(Manager *m) {
 485 /* Skip this particular test case when running under ASan, as
 486  * LSan intermittently segfaults when accessing memory right
 487  * after the test finishes. Generally, ASan & LSan don't like
 488  * the seccomp stuff.
 489  */
 490 #if HAVE_SECCOMP && !HAS_FEATURE_ADDRESS_SANITIZER
 491         if (!is_seccomp_available()) {
 492                 log_notice("Seccomp not available, skipping %s", __func__);
 493                 return;
 494         }
 495
 496         test(m, "exec-systemcallfilter-system-user.service", 0, CLD_EXITED);
 497
 498         if (!check_nobody_user_and_group()) {
 499                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 500                 return;
 501         }
 502
 503         if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) {
 504                 log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__);
 505                 return;
 506         }
 507
 508         test(m, "exec-systemcallfilter-system-user-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 509 #endif
 510 }
 511
 512 static void test_exec_user(Manager *m) {
 513         test(m, "exec-user.service", 0, CLD_EXITED);
 514
 515         if (!check_nobody_user_and_group()) {
 516                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 517                 return;
 518         }
 519
 520         if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) {
 521                 log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__);
 522                 return;
 523         }
 524
 525         test(m, "exec-user-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 526 }
 527
 528 static void test_exec_group(Manager *m) {
 529         test(m, "exec-group.service", 0, CLD_EXITED);
 530
 531         if (!check_nobody_user_and_group()) {
 532                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 533                 return;
 534         }
 535
 536         if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) {
 537                 log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__);
 538                 return;
 539         }
 540
 541         test(m, "exec-group-" NOBODY_GROUP_NAME ".service", 0, CLD_EXITED);
 542 }
 543
 544 static void test_exec_supplementarygroups(Manager *m) {
 545         test(m, "exec-supplementarygroups.service", 0, CLD_EXITED);
 546         test(m, "exec-supplementarygroups-single-group.service", 0, CLD_EXITED);
 547         test(m, "exec-supplementarygroups-single-group-user.service", 0, CLD_EXITED);
 548         test(m, "exec-supplementarygroups-multiple-groups-default-group-user.service", 0, CLD_EXITED);
 549         test(m, "exec-supplementarygroups-multiple-groups-withgid.service", 0, CLD_EXITED);
 550         test(m, "exec-supplementarygroups-multiple-groups-withuid.service", 0, CLD_EXITED);
 551 }
 552
 553 static char* private_directory_bad(Manager *m) {
 554         /* This mirrors setup_exec_directory(). */
 555
 556         for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
 557                 _cleanup_free_ char *p = NULL;
 558                 struct stat st;
 559
 560                 assert_se(p = path_join(m->prefix[dt], "private"));
 561
 562                 if (stat(p, &st) >= 0 &&
 563                     (st.st_mode & (S_IRWXG|S_IRWXO)))
 564                         return TAKE_PTR(p);
 565         }
 566
 567         return NULL;
 568 }
 569
 570 static void test_exec_dynamicuser(Manager *m) {
 571         _cleanup_free_ char *bad = private_directory_bad(m);
 572         if (bad) {
 573                 log_warning("%s: %s has bad permissions, skipping test.", __func__, bad);
 574                 return;
 575         }
 576
 577         test(m, "exec-dynamicuser-fixeduser.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 578         if (check_user_has_group_with_same_name("adm"))
 579                 test(m, "exec-dynamicuser-fixeduser-adm.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 580         if (check_user_has_group_with_same_name("games"))
 581                 test(m, "exec-dynamicuser-fixeduser-games.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 582         test(m, "exec-dynamicuser-fixeduser-one-supplementarygroup.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 583         test(m, "exec-dynamicuser-supplementarygroups.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 584         test(m, "exec-dynamicuser-statedir.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 585
 586         (void) rm_rf("/var/lib/quux", REMOVE_ROOT|REMOVE_PHYSICAL);
 587         (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 588         (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 589         (void) rm_rf("/var/lib/waldo", REMOVE_ROOT|REMOVE_PHYSICAL);
 590         (void) rm_rf("/var/lib/private/quux", REMOVE_ROOT|REMOVE_PHYSICAL);
 591         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 592         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 593         (void) rm_rf("/var/lib/private/waldo", REMOVE_ROOT|REMOVE_PHYSICAL);
 594
 595         test(m, "exec-dynamicuser-statedir-migrate-step1.service", 0, CLD_EXITED);
 596         test(m, "exec-dynamicuser-statedir-migrate-step2.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 597         test(m, "exec-dynamicuser-statedir-migrate-step1.service", 0, CLD_EXITED);
 598
 599         (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 600         (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 601         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 602         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 603
 604         test(m, "exec-dynamicuser-runtimedirectory1.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 605         test(m, "exec-dynamicuser-runtimedirectory2.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 606         test(m, "exec-dynamicuser-runtimedirectory3.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 607 }
 608
 609 static void test_exec_environment(Manager *m) {
 610         test(m, "exec-environment-no-substitute.service", 0, CLD_EXITED);
 611         test(m, "exec-environment.service", 0, CLD_EXITED);
 612         test(m, "exec-environment-multiple.service", 0, CLD_EXITED);
 613         test(m, "exec-environment-empty.service", 0, CLD_EXITED);
 614 }
 615
 616 static void test_exec_environmentfile(Manager *m) {
 617         static const char e[] =
 618                 "VAR1='word1 word2'\n"
 619                 "VAR2=word3 \n"
 620                 "# comment1\n"
 621                 "\n"
 622                 "; comment2\n"
 623                 " ; # comment3\n"
 624                 "line without an equal\n"
 625                 "VAR3='$word 5 6'\n"
 626                 "VAR4='new\nline'\n"
 627                 "VAR5=password\\with\\backslashes";
 628         int r;
 629
 630         r = write_string_file("/tmp/test-exec_environmentfile.conf", e, WRITE_STRING_FILE_CREATE);
 631         assert_se(r == 0);
 632
 633         test(m, "exec-environmentfile.service", 0, CLD_EXITED);
 634
 635         (void) unlink("/tmp/test-exec_environmentfile.conf");
 636 }
 637
 638 static void test_exec_passenvironment(Manager *m) {
 639         /* test-execute runs under MANAGER_USER which, by default, forwards all
 640          * variables present in the environment, but only those that are
 641          * present _at the time it is created_!
 642          *
 643          * So these PassEnvironment checks are still expected to work, since we
 644          * are ensuring the variables are not present at manager creation (they
 645          * are unset explicitly in main) and are only set here.
 646          *
 647          * This is still a good approximation of how a test for MANAGER_SYSTEM
 648          * would work.
 649          */
 650         assert_se(setenv("VAR1", "word1 word2", 1) == 0);
 651         assert_se(setenv("VAR2", "word3", 1) == 0);
 652         assert_se(setenv("VAR3", "$word 5 6", 1) == 0);
 653         assert_se(setenv("VAR4", "new\nline", 1) == 0);
 654         assert_se(setenv("VAR5", "passwordwithbackslashes", 1) == 0);
 655         test(m, "exec-passenvironment.service", 0, CLD_EXITED);
 656         test(m, "exec-passenvironment-repeated.service", 0, CLD_EXITED);
 657         test(m, "exec-passenvironment-empty.service", 0, CLD_EXITED);
 658         assert_se(unsetenv("VAR1") == 0);
 659         assert_se(unsetenv("VAR2") == 0);
 660         assert_se(unsetenv("VAR3") == 0);
 661         assert_se(unsetenv("VAR4") == 0);
 662         assert_se(unsetenv("VAR5") == 0);
 663         test(m, "exec-passenvironment-absent.service", 0, CLD_EXITED);
 664 }
 665
 666 static void test_exec_umask(Manager *m) {
 667         test(m, "exec-umask-default.service", 0, CLD_EXITED);
 668         test(m, "exec-umask-0177.service", 0, CLD_EXITED);
 669 }
 670
 671 static void test_exec_runtimedirectory(Manager *m) {
 672         test(m, "exec-runtimedirectory.service", 0, CLD_EXITED);
 673         test(m, "exec-runtimedirectory-mode.service", 0, CLD_EXITED);
 674         test(m, "exec-runtimedirectory-owner.service", 0, CLD_EXITED);
 675
 676         if (!check_nobody_user_and_group()) {
 677                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 678                 return;
 679         }
 680
 681         if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) {
 682                 log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__);
 683                 return;
 684         }
 685
 686         test(m, "exec-runtimedirectory-owner-" NOBODY_GROUP_NAME ".service", 0, CLD_EXITED);
 687 }
 688
 689 static void test_exec_capabilityboundingset(Manager *m) {
 690         int r;
 691
 692         r = find_executable("capsh", NULL);
 693         if (r < 0) {
 694                 log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
 695                 return;
 696         }
 697
 698         if (have_effective_cap(CAP_CHOWN) <= 0 ||
 699             have_effective_cap(CAP_FOWNER) <= 0 ||
 700             have_effective_cap(CAP_KILL) <= 0) {
 701                 log_notice("Skipping %s, this process does not have enough capabilities", __func__);
 702                 return;
 703         }
 704
 705         test(m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED);
 706         test(m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED);
 707         test(m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED);
 708         test(m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED);
 709 }
 710
 711 static void test_exec_basic(Manager *m) {
 712         test(m, "exec-basic.service", 0, CLD_EXITED);
 713 }
 714
 715 static void test_exec_ambientcapabilities(Manager *m) {
 716         int r;
 717
 718         /* Check if the kernel has support for ambient capabilities. Run
 719          * the tests only if that's the case. Clearing all ambient
 720          * capabilities is fine, since we are expecting them to be unset
 721          * in the first place for the tests. */
 722         r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
 723         if (r < 0 && IN_SET(errno, EINVAL, EOPNOTSUPP, ENOSYS)) {
 724                 log_notice("Skipping %s, the kernel does not support ambient capabilities", __func__);
 725                 return;
 726         }
 727
 728         if (have_effective_cap(CAP_CHOWN) <= 0 ||
 729             have_effective_cap(CAP_NET_RAW) <= 0) {
 730                 log_notice("Skipping %s, this process does not have enough capabilities", __func__);
 731                 return;
 732         }
 733
 734         test(m, "exec-ambientcapabilities.service", 0, CLD_EXITED);
 735         test(m, "exec-ambientcapabilities-merge.service", 0, CLD_EXITED);
 736
 737         if (!check_nobody_user_and_group()) {
 738                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 739                 return;
 740         }
 741
 742         if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) {
 743                 log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__);
 744                 return;
 745         }
 746
 747         test(m, "exec-ambientcapabilities-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 748         test(m, "exec-ambientcapabilities-merge-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 749 }
 750
 751 static void test_exec_privatenetwork(Manager *m) {
 752         int r;
 753
 754         r = find_executable("ip", NULL);
 755         if (r < 0) {
 756                 log_notice_errno(r, "Skipping %s, could not find ip binary: %m", __func__);
 757                 return;
 758         }
 759
 760         test(m, "exec-privatenetwork-yes.service", can_unshare ? 0 : EXIT_NETWORK, CLD_EXITED);
 761 }
 762
 763 static void test_exec_oomscoreadjust(Manager *m) {
 764         test(m, "exec-oomscoreadjust-positive.service", 0, CLD_EXITED);
 765
 766         if (detect_container() > 0) {
 767                 log_notice("Testing in container, skipping remaining tests in %s", __func__);
 768                 return;
 769         }
 770         test(m, "exec-oomscoreadjust-negative.service", 0, CLD_EXITED);
 771 }
 772
 773 static void test_exec_ioschedulingclass(Manager *m) {
 774         test(m, "exec-ioschedulingclass-none.service", 0, CLD_EXITED);
 775         test(m, "exec-ioschedulingclass-idle.service", 0, CLD_EXITED);
 776         test(m, "exec-ioschedulingclass-best-effort.service", 0, CLD_EXITED);
 777
 778         if (detect_container() > 0) {
 779                 log_notice("Testing in container, skipping remaining tests in %s", __func__);
 780                 return;
 781         }
 782         test(m, "exec-ioschedulingclass-realtime.service", 0, CLD_EXITED);
 783 }
 784
 785 static void test_exec_unsetenvironment(Manager *m) {
 786         test(m, "exec-unsetenvironment.service", 0, CLD_EXITED);
 787 }
 788
 789 static void test_exec_specifier(Manager *m) {
 790         test(m, "exec-specifier.service", 0, CLD_EXITED);
 791         test(m, "exec-specifier@foo-bar.service", 0, CLD_EXITED);
 792         test(m, "exec-specifier-interpolation.service", 0, CLD_EXITED);
 793 }
 794
 795 static void test_exec_standardinput(Manager *m) {
 796         test(m, "exec-standardinput-data.service", 0, CLD_EXITED);
 797         test(m, "exec-standardinput-file.service", 0, CLD_EXITED);
 798         test(m, "exec-standardinput-file-cat.service", 0, CLD_EXITED);
 799 }
 800
 801 static void test_exec_standardoutput(Manager *m) {
 802         test(m, "exec-standardoutput-file.service", 0, CLD_EXITED);
 803 }
 804
 805 static void test_exec_standardoutput_append(Manager *m) {
 806         test(m, "exec-standardoutput-append.service", 0, CLD_EXITED);
 807 }
 808
 809 static void test_exec_condition(Manager *m) {
 810         test_service(m, "exec-condition-failed.service", SERVICE_FAILURE_EXIT_CODE);
 811         test_service(m, "exec-condition-skip.service", SERVICE_SKIP_CONDITION);
 812 }
 813
 814 typedef struct test_entry {
 815         test_function_t f;
 816         const char *name;
 817 } test_entry;
 818
 819 #define entry(x) {x, #x}
 820
 821 static int run_tests(UnitFileScope scope, const test_entry tests[], char **patterns) {
 822         _cleanup_(manager_freep) Manager *m = NULL;
 823         int r;
 824
 825         assert_se(tests);
 826
 827         r = manager_new(scope, MANAGER_TEST_RUN_BASIC, &m);
 828         m->default_std_output = EXEC_OUTPUT_NULL; /* don't rely on host journald */
 829         if (manager_errno_skip_test(r))
 830                 return log_tests_skipped_errno(r, "manager_new");
 831         assert_se(r >= 0);
 832         assert_se(manager_startup(m, NULL, NULL) >= 0);
 833
 834         for (const test_entry *test = tests; test->f; test++)
 835                 if (strv_fnmatch_or_empty(patterns, test->name, FNM_NOESCAPE))
 836                         test->f(m);
 837                 else
 838                         log_info("Skipping %s because it does not match any pattern.", test->name);
 839
 840         return 0;
 841 }
 842
 843 int main(int argc, char *argv[]) {
 844         _cleanup_(rm_rf_physical_and_freep) char *runtime_dir = NULL;
 845
 846         static const test_entry user_tests[] = {
 847                 entry(test_exec_basic),
 848                 entry(test_exec_ambientcapabilities),
 849                 entry(test_exec_bindpaths),
 850                 entry(test_exec_capabilityboundingset),
 851                 entry(test_exec_condition),
 852                 entry(test_exec_cpuaffinity),
 853                 entry(test_exec_environment),
 854                 entry(test_exec_environmentfile),
 855                 entry(test_exec_group),
 856                 entry(test_exec_ignoresigpipe),
 857                 entry(test_exec_inaccessiblepaths),
 858                 entry(test_exec_ioschedulingclass),
 859                 entry(test_exec_oomscoreadjust),
 860                 entry(test_exec_passenvironment),
 861                 entry(test_exec_personality),
 862                 entry(test_exec_privatedevices),
 863                 entry(test_exec_privatenetwork),
 864                 entry(test_exec_privatetmp),
 865                 entry(test_exec_protecthome),
 866                 entry(test_exec_protectkernelmodules),
 867                 entry(test_exec_readonlypaths),
 868                 entry(test_exec_readwritepaths),
 869                 entry(test_exec_restrictnamespaces),
 870                 entry(test_exec_runtimedirectory),
 871                 entry(test_exec_standardinput),
 872                 entry(test_exec_standardoutput),
 873                 entry(test_exec_standardoutput_append),
 874                 entry(test_exec_supplementarygroups),
 875                 entry(test_exec_systemcallerrornumber),
 876                 entry(test_exec_systemcallfilter),
 877                 entry(test_exec_temporaryfilesystem),
 878                 entry(test_exec_umask),
 879                 entry(test_exec_unsetenvironment),
 880                 entry(test_exec_user),
 881                 entry(test_exec_workingdirectory),
 882                 {},
 883         };
 884         static const test_entry system_tests[] = {
 885                 entry(test_exec_dynamicuser),
 886                 entry(test_exec_specifier),
 887                 entry(test_exec_systemcallfilter_system),
 888                 {},
 889         };
 890         int r;
 891
 892         test_setup_logging(LOG_DEBUG);
 893
 894 #if HAS_FEATURE_ADDRESS_SANITIZER
 895         if (strstr_ptr(ci_environment(), "travis")) {
 896                 log_notice("Running on TravisCI under ASan, skipping, see https://github.com/systemd/systemd/issues/10696");
 897                 return EXIT_TEST_SKIP;
 898         }
 899 #endif
 900
 901         (void) unsetenv("USER");
 902         (void) unsetenv("LOGNAME");
 903         (void) unsetenv("SHELL");
 904         (void) unsetenv("HOME");
 905         (void) unsetenv("TMPDIR");
 906
 907         can_unshare = have_namespaces();
 908
 909         /* It is needed otherwise cgroup creation fails */
 910         if (getuid() != 0)
 911                 return log_tests_skipped("not root");
 912
 913         r = enter_cgroup_subroot(NULL);
 914         if (r == -ENOMEDIUM)
 915                 return log_tests_skipped("cgroupfs not available");
 916
 917         _cleanup_free_ char *unit_dir = NULL;
 918         assert_se(get_testdata_dir("test-execute/", &unit_dir) >= 0);
 919         assert_se(set_unit_path(unit_dir) >= 0);
 920         assert_se(runtime_dir = setup_fake_runtime_dir());
 921
 922         /* Unset VAR1, VAR2 and VAR3 which are used in the PassEnvironment test
 923          * cases, otherwise (and if they are present in the environment),
 924          * `manager_default_environment` will copy them into the default
 925          * environment which is passed to each created job, which will make the
 926          * tests that expect those not to be present to fail.
 927          */
 928         assert_se(unsetenv("VAR1") == 0);
 929         assert_se(unsetenv("VAR2") == 0);
 930         assert_se(unsetenv("VAR3") == 0);
 931
 932         r = run_tests(UNIT_FILE_USER, user_tests, argv + 1);
 933         if (r != 0)
 934                 return r;
 935
 936         r = run_tests(UNIT_FILE_SYSTEM, system_tests, argv + 1);
 937         if (r != 0)
 938                 return r;
 939
 940 #if HAVE_SECCOMP
 941         /* The following tests are for 1beab8b0d0ff2d7d1436b52d4a0c3d56dc908962. */
 942         if (!is_seccomp_available()) {
 943                 log_notice("Seccomp not available, skipping unshare() filtered tests.");
 944                 return 0;
 945         }
 946
 947         _cleanup_hashmap_free_ Hashmap *s = NULL;
 948         assert_se(s = hashmap_new(NULL));
 949         r = seccomp_syscall_resolve_name("unshare");
 950         assert_se(r != __NR_SCMP_ERROR);
 951         assert_se(hashmap_put(s, UINT32_TO_PTR(r + 1), INT_TO_PTR(-1)) >= 0);
 952         assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EOPNOTSUPP), true) >= 0);
 953         assert_se(unshare(CLONE_NEWNS) < 0);
 954         assert_se(errno == EOPNOTSUPP);
 955
 956         can_unshare = false;
 957
 958         r = run_tests(UNIT_FILE_USER, user_tests, argv + 1);
 959         if (r != 0)
 960                 return r;
 961
 962         return run_tests(UNIT_FILE_SYSTEM, system_tests, argv + 1);
 963 #else
 964         return 0;
 965 #endif
 966 }