test/units/testsuite-65.sh

   1 #!/usr/bin/env bash
   2 # SPDX-License-Identifier: LGPL-2.1-or-later
   3 # shellcheck disable=SC2016
   4 set -eux
   5
   6 # shellcheck source=test/units/util.sh
   7 . "$(dirname "$0")"/util.sh
   8
   9 systemctl log-level debug
  10 export SYSTEMD_LOG_LEVEL=debug
  11
  12 # Sanity checks
  13 #
  14 # We can't really test time, critical-chain and plot verbs here, as
  15 # the testsuite service is a part of the boot transaction, so let's assume
  16 # they fail
  17 systemd-analyze || :
  18 systemd-analyze time || :
  19 systemd-analyze critical-chain || :
  20 # blame
  21 systemd-analyze blame
  22 systemd-run --wait --user --pipe -M testuser@.host systemd-analyze blame
  23 # plot
  24 systemd-analyze plot >/dev/null || :
  25 systemd-analyze plot --json=pretty >/dev/null || :
  26 systemd-analyze plot --json=short >/dev/null || :
  27 systemd-analyze plot --json=off >/dev/null || :
  28 systemd-analyze plot --json=pretty --no-legend >/dev/null || :
  29 systemd-analyze plot --json=short --no-legend >/dev/null || :
  30 systemd-analyze plot --json=off --no-legend >/dev/null || :
  31 systemd-analyze plot --table >/dev/null || :
  32 systemd-analyze plot --table --no-legend >/dev/null || :
  33 # legacy/deprecated options (moved to systemctl, but still usable from analyze)
  34 systemd-analyze log-level
  35 systemd-analyze log-level "$(systemctl log-level)"
  36 systemd-analyze get-log-level
  37 systemd-analyze set-log-level "$(systemctl log-level)"
  38 systemd-analyze log-target
  39 systemd-analyze log-target "$(systemctl log-target)"
  40 systemd-analyze get-log-target
  41 systemd-analyze set-log-target "$(systemctl log-target)"
  42 systemd-analyze service-watchdogs
  43 systemd-analyze service-watchdogs "$(systemctl service-watchdogs)"
  44 # dot
  45 systemd-analyze dot >/dev/null
  46 systemd-analyze dot systemd-journald.service >/dev/null
  47 systemd-analyze dot systemd-journald.service systemd-logind.service >/dev/null
  48 systemd-analyze dot --from-pattern="*" --from-pattern="*.service" systemd-journald.service >/dev/null
  49 systemd-analyze dot --to-pattern="*" --to-pattern="*.service" systemd-journald.service >/dev/null
  50 systemd-analyze dot --from-pattern="*.service" --to-pattern="*.service" systemd-journald.service >/dev/null
  51 systemd-analyze dot --order systemd-journald.service systemd-logind.service >/dev/null
  52 systemd-analyze dot --require systemd-journald.service systemd-logind.service >/dev/null
  53 systemd-analyze dot "systemd-*.service" >/dev/null
  54 (! systemd-analyze dot systemd-journald.service systemd-logind.service "*" bbb ccc)
  55 # dump
  56 # this should be rate limited to 10 calls in 10 minutes for unprivileged callers
  57 for _ in {1..10}; do
  58     runas testuser systemd-analyze dump systemd-journald.service >/dev/null
  59 done
  60 (! runas testuser systemd-analyze dump >/dev/null)
  61 # still limited after a reload
  62 systemctl daemon-reload
  63 (! runas testuser systemd-analyze dump >/dev/null)
  64 # and a re-exec
  65 systemctl daemon-reexec
  66 (! runas testuser systemd-analyze dump >/dev/null)
  67 # privileged call, so should not be rate limited
  68 for _ in {1..10}; do
  69     systemd-analyze dump systemd-journald.service >/dev/null
  70 done
  71 systemd-analyze dump >/dev/null
  72 systemd-analyze dump "*" >/dev/null
  73 systemd-analyze dump "*.socket" >/dev/null
  74 systemd-analyze dump "*.socket" "*.service" aaaaaaa ... >/dev/null
  75 systemd-analyze dump systemd-journald.service >/dev/null
  76 systemd-analyze malloc >/dev/null
  77 (! systemd-analyze dump "")
  78 # unit-files
  79 systemd-analyze unit-files >/dev/null
  80 systemd-analyze unit-files systemd-journald.service >/dev/null
  81 systemd-analyze unit-files "*" >/dev/null
  82 systemd-analyze unit-files "*" aaaaaa "*.service" "*.target" >/dev/null
  83 systemd-analyze unit-files --user >/dev/null
  84 systemd-analyze unit-files --user "*" aaaaaa "*.service" "*.target" >/dev/null
  85 # unit-paths
  86 systemd-analyze unit-paths
  87 systemd-analyze unit-paths --user
  88 systemd-analyze unit-paths --global
  89 # exist-status
  90 systemd-analyze exit-status
  91 systemd-analyze exit-status STDOUT BPF
  92 systemd-analyze exit-status 0 1 {63..65}
  93 (! systemd-analyze exit-status STDOUT BPF "hello*")
  94 # capability
  95 systemd-analyze capability
  96 systemd-analyze capability cap_chown CAP_KILL
  97 systemd-analyze capability 0 1 {30..32}
  98 (! systemd-analyze capability cap_chown CAP_KILL "hello*")
  99 # condition
 100 mkdir -p /run/systemd/system
 101 UNIT_NAME="analyze-condition-$RANDOM.service"
 102 cat >"/run/systemd/system/$UNIT_NAME" <<EOF
 103 [Unit]
 104 AssertPathExists=/etc/os-release
 105 AssertEnvironment=!FOOBAR
 106 ConditionKernelVersion=>1.0
 107 ConditionPathExists=/etc/os-release
 108
 109 [Service]
 110 ExecStart=/bin/true
 111 EOF
 112 systemctl daemon-reload
 113 systemd-analyze condition --unit="$UNIT_NAME"
 114 systemd-analyze condition 'ConditionKernelVersion = ! <4.0' \
 115                           'ConditionKernelVersion = >=3.1' \
 116                           'ConditionACPower=|false' \
 117                           'ConditionArchitecture=|!arm' \
 118                           'AssertPathExists=/etc/os-release'
 119 (! systemd-analyze condition 'ConditionArchitecture=|!arm' 'AssertXYZ=foo')
 120 (! systemd-analyze condition 'ConditionKernelVersion=<1.0')
 121 (! systemd-analyze condition 'AssertKernelVersion=<1.0')
 122 # syscall-filter
 123 systemd-analyze syscall-filter >/dev/null
 124 systemd-analyze syscall-filter @chown @sync
 125 systemd-analyze syscall-filter @sync @sync @sync
 126 (! systemd-analyze syscall-filter @chown @sync @foobar)
 127 # filesystems (requires libbpf support)
 128 if systemctl --version | grep "+BPF_FRAMEWORK"; then
 129     systemd-analyze filesystems >/dev/null
 130     systemd-analyze filesystems @basic-api
 131     systemd-analyze filesystems @basic-api @basic-api @basic-api
 132     (! systemd-analyze filesystems @basic-api @basic-api @foobar @basic-api)
 133 fi
 134 # calendar
 135 systemd-analyze calendar '*-2-29 0:0:0'
 136 systemd-analyze calendar --iterations=5 '*-2-29 0:0:0'
 137 systemd-analyze calendar '*-* *:*:*'
 138 systemd-analyze calendar --iterations=5 '*-* *:*:*'
 139 systemd-analyze calendar --iterations=50 '*-* *:*:*'
 140 systemd-analyze calendar --iterations=0 '*-* *:*:*'
 141 systemd-analyze calendar --iterations=5 '01-01-22 01:00:00'
 142 systemd-analyze calendar --base-time=yesterday --iterations=5 '*-* *:*:*'
 143 (! systemd-analyze calendar --iterations=0 '*-* 99:*:*')
 144 (! systemd-analyze calendar --base-time=never '*-* *:*:*')
 145 (! systemd-analyze calendar 1)
 146 (! systemd-analyze calendar "")
 147 # timestamp
 148 systemd-analyze timestamp now
 149 systemd-analyze timestamp -- -1
 150 systemd-analyze timestamp yesterday now tomorrow
 151 (! systemd-analyze timestamp yesterday never tomorrow)
 152 (! systemd-analyze timestamp 1)
 153 (! systemd-analyze timestamp '*-2-29 0:0:0')
 154 (! systemd-analyze timestamp "")
 155 # timespan
 156 systemd-analyze timespan 1
 157 systemd-analyze timespan 1s 300s '1year 0.000001s'
 158 (! systemd-analyze timespan 1s 300s aaaaaa '1year 0.000001s')
 159 (! systemd-analyze timespan -- -1)
 160 (! systemd-analyze timespan '*-2-29 0:0:0')
 161 (! systemd-analyze timespan "")
 162 # cat-config
 163 systemd-analyze cat-config systemd/system.conf >/dev/null
 164 systemd-analyze cat-config /etc/systemd/system.conf >/dev/null
 165 systemd-analyze cat-config systemd/system.conf systemd/journald.conf >/dev/null
 166 systemd-analyze cat-config systemd/system.conf foo/bar systemd/journald.conf >/dev/null
 167 systemd-analyze cat-config foo/bar
 168 systemd-analyze cat-config --tldr systemd/system.conf >/dev/null
 169 systemd-analyze cat-config --tldr /etc/systemd/system.conf >/dev/null
 170 systemd-analyze cat-config --tldr systemd/system.conf systemd/journald.conf >/dev/null
 171 systemd-analyze cat-config --tldr systemd/system.conf foo/bar systemd/journald.conf >/dev/null
 172 systemd-analyze cat-config --tldr foo/bar
 173 # security
 174 systemd-analyze security
 175 systemd-analyze security --json=off
 176 systemd-analyze security --json=pretty | jq
 177 systemd-analyze security --json=short | jq
 178
 179 if [[ ! -v ASAN_OPTIONS ]]; then
 180     # check that systemd-analyze cat-config paths work in a chroot
 181     mkdir -p /tmp/root
 182     mount --bind / /tmp/root
 183     systemd-analyze cat-config systemd/system-preset >/tmp/out1
 184     chroot /tmp/root systemd-analyze cat-config systemd/system-preset >/tmp/out2
 185     diff /tmp/out{1,2}
 186 fi
 187
 188 # verify
 189 mkdir -p /tmp/img/usr/lib/systemd/system/
 190 mkdir -p /tmp/img/opt/
 191
 192 touch /tmp/img/opt/script0.sh
 193 chmod +x /tmp/img/opt/script0.sh
 194
 195 cat <<EOF >/tmp/img/usr/lib/systemd/system/testfile.service
 196 [Service]
 197 ExecStart = /opt/script0.sh
 198 EOF
 199
 200 set +e
 201 # Default behaviour is to recurse through all dependencies when unit is loaded
 202 (! systemd-analyze verify --root=/tmp/img/ testfile.service)
 203
 204 # As above, recurses through all dependencies when unit is loaded
 205 (! systemd-analyze verify --recursive-errors=yes --root=/tmp/img/ testfile.service)
 206
 207 # Recurses through unit file and its direct dependencies when unit is loaded
 208 (! systemd-analyze verify --recursive-errors=one --root=/tmp/img/ testfile.service)
 209
 210 set -e
 211
 212 # zero exit status since dependencies are ignored when unit is loaded
 213 systemd-analyze verify --recursive-errors=no --root=/tmp/img/ testfile.service
 214
 215 rm /tmp/img/usr/lib/systemd/system/testfile.service
 216
 217 cat <<EOF >/tmp/testfile.service
 218 [Unit]
 219 foo = bar
 220
 221 [Service]
 222 ExecStart = echo hello
 223 EOF
 224
 225 cat <<EOF >/tmp/testfile2.service
 226 [Unit]
 227 Requires = testfile.service
 228
 229 [Service]
 230 ExecStart = echo hello
 231 EOF
 232
 233 # Zero exit status since no additional dependencies are recursively loaded when the unit file is loaded
 234 systemd-analyze verify --recursive-errors=no /tmp/testfile2.service
 235
 236 set +e
 237 # Non-zero exit status since all associated dependencies are recursively loaded when the unit file is loaded
 238 (! systemd-analyze verify --recursive-errors=yes /tmp/testfile2.service)
 239 set -e
 240
 241 rm /tmp/testfile.service
 242 rm /tmp/testfile2.service
 243
 244 cat <<EOF >/tmp/sample.service
 245 [Unit]
 246 Description = A Sample Service
 247
 248 [Service]
 249 ExecStart = echo hello
 250 Slice=support.slice
 251 EOF
 252
 253 # Zero exit status since no additional dependencies are recursively loaded when the unit file is loaded
 254 systemd-analyze verify --recursive-errors=no /tmp/sample.service
 255
 256 cat <<EOF >/tmp/testfile.service
 257 [Service]
 258 ExecStart = echo hello
 259 DeviceAllow=/dev/sda
 260 EOF
 261
 262 # Prevent regression from #13380 and #20859 where we can't verify hidden files
 263 cp /tmp/testfile.service /tmp/.testfile.service
 264
 265 systemd-analyze verify /tmp/.testfile.service
 266
 267 rm /tmp/.testfile.service
 268
 269 # Alias a unit file's name on disk (see #20061)
 270 cp /tmp/testfile.service /tmp/testsrvc
 271
 272 (! systemd-analyze verify /tmp/testsrvc)
 273
 274 systemd-analyze verify /tmp/testsrvc:alias.service
 275
 276 # Zero exit status since the value used for comparison determine exposure to security threats is by default 100
 277 systemd-analyze security --offline=true /tmp/testfile.service
 278
 279 #The overall exposure level assigned to the unit is greater than the set threshold
 280 (! systemd-analyze security --threshold=90 --offline=true /tmp/testfile.service)
 281
 282 # Ensure we print the list of ACLs, see https://github.com/systemd/systemd/issues/23185
 283 systemd-analyze security --offline=true /tmp/testfile.service | grep -q -F "/dev/sda"
 284
 285 rm /tmp/testfile.service
 286
 287 cat <<EOF >/tmp/img/usr/lib/systemd/system/testfile.service
 288 [Service]
 289 ExecStart = echo hello
 290 PrivateNetwork = yes
 291 PrivateDevices = yes
 292 PrivateUsers = yes
 293 EOF
 294
 295 # The new overall exposure level assigned to the unit is less than the set thresholds
 296 # Verifies that the --offline= option works with --root=
 297 systemd-analyze security --threshold=90 --offline=true --root=/tmp/img/ testfile.service
 298
 299 # Added an additional "INVALID_ID" id to the .json to verify that nothing breaks when input is malformed
 300 # The PrivateNetwork id description and weight was changed to verify that 'security' is actually reading in
 301 # values from the .json file when required. The default weight for "PrivateNetwork" is 2500, and the new weight
 302 # assigned to that id in the .json file is 6000. This increased weight means that when the "PrivateNetwork" key is
 303 # set to 'yes' (as above in the case of testfile.service) in the content of the unit file, the overall exposure
 304 # level for the unit file should decrease to account for that increased weight.
 305 cat <<EOF >/tmp/testfile.json
 306 {"UserOrDynamicUser":
 307     {"description_bad": "Service runs as root user",
 308     "weight": 0,
 309     "range": 10
 310     },
 311 "SupplementaryGroups":
 312     {"description_good": "Service has no supplementary groups",
 313     "description_bad": "Service runs with supplementary groups",
 314     "description_na": "Service runs as root, option does not matter",
 315     "weight": 200,
 316     "range": 1
 317     },
 318 "PrivateDevices":
 319     {"description_good": "Service has no access to hardware devices",
 320     "description_bad": "Service potentially has access to hardware devices",
 321     "weight": 1000,
 322     "range": 1
 323     },
 324 "PrivateMounts":
 325     {"description_good": "Service cannot install system mounts",
 326     "description_bad": "Service may install system mounts",
 327     "weight": 1000,
 328     "range": 1
 329     },
 330 "PrivateNetwork":
 331     {"description_good": "Service doesn't have access to the host's network",
 332     "description_bad": "Service has access to the host's network",
 333     "weight": 6000,
 334     "range": 1
 335     },
 336 "PrivateTmp":
 337     {"description_good": "Service has no access to other software's temporary files",
 338     "description_bad": "Service has access to other software's temporary files",
 339     "weight": 1000,
 340     "range": 1
 341     },
 342 "PrivateUsers":
 343     {"description_good": "Service does not have access to other users",
 344     "description_bad": "Service has access to other users",
 345     "weight": 1000,
 346     "range": 1
 347     },
 348 "ProtectControlGroups":
 349     {"description_good": "Service cannot modify the control group file system",
 350     "description_bad": "Service may modify the control group file system",
 351     "weight": 1000,
 352     "range": 1
 353     },
 354 "ProtectKernelModules":
 355     {"description_good": "Service cannot load or read kernel modules",
 356     "description_bad": "Service may load or read kernel modules",
 357     "weight": 1000,
 358     "range": 1
 359     },
 360 "ProtectKernelTunables":
 361     {"description_good": "Service cannot alter kernel tunables (/proc/sys, …)",
 362     "description_bad": "Service may alter kernel tunables",
 363     "weight": 1000,
 364     "range": 1
 365     },
 366 "ProtectKernelLogs":
 367     {"description_good": "Service cannot read from or write to the kernel log ring buffer",
 368     "description_bad": "Service may read from or write to the kernel log ring buffer",
 369     "weight": 1000,
 370     "range": 1
 371     },
 372 "ProtectClock":
 373     {"description_good": "Service cannot write to the hardware clock or system clock",
 374     "description_bad": "Service may write to the hardware clock or system clock",
 375     "weight": 1000,
 376     "range": 1
 377     },
 378 "ProtectHome":
 379     {"weight": 1000,
 380     "range": 10
 381     },
 382 "ProtectHostname":
 383     {"description_good": "Service cannot change system host/domainname",
 384     "description_bad": "Service may change system host/domainname",
 385     "weight": 50,
 386     "range": 1
 387     },
 388 "ProtectSystem":
 389     {"weight": 1000,
 390     "range": 10
 391     },
 392 "RootDirectoryOrRootImage":
 393     {"description_good": "Service has its own root directory/image",
 394     "description_bad": "Service runs within the host's root directory",
 395     "weight": 200,
 396     "range": 1
 397     },
 398 "LockPersonality":
 399     {"description_good": "Service cannot change ABI personality",
 400     "description_bad": "Service may change ABI personality",
 401     "weight": 100,
 402     "range": 1
 403     },
 404 "MemoryDenyWriteExecute":
 405     {"description_good": "Service cannot create writable executable memory mappings",
 406     "description_bad": "Service may create writable executable memory mappings",
 407     "weight": 100,
 408     "range": 1
 409     },
 410 "NoNewPrivileges":
 411     {"description_good": "Service processes cannot acquire new privileges",
 412     "description_bad": "Service processes may acquire new privileges",
 413     "weight": 1000,
 414     "range": 1
 415     },
 416 "CapabilityBoundingSet_CAP_SYS_ADMIN":
 417     {"description_good": "Service has no administrator privileges",
 418     "description_bad": "Service has administrator privileges",
 419     "weight": 1500,
 420     "range": 1
 421     },
 422 "CapabilityBoundingSet_CAP_SET_UID_GID_PCAP":
 423     {"description_good": "Service cannot change UID/GID identities/capabilities",
 424     "description_bad": "Service may change UID/GID identities/capabilities",
 425     "weight": 1500,
 426     "range": 1
 427     },
 428 "CapabilityBoundingSet_CAP_SYS_PTRACE":
 429     {"description_good": "Service has no ptrace() debugging abilities",
 430     "description_bad": "Service has ptrace() debugging abilities",
 431     "weight": 1500,
 432     "range": 1
 433     },
 434 "CapabilityBoundingSet_CAP_SYS_TIME":
 435     {"description_good": "Service processes cannot change the system clock",
 436     "description_bad": "Service processes may change the system clock",
 437     "weight": 1000,
 438     "range": 1
 439     },
 440 "CapabilityBoundingSet_CAP_NET_ADMIN":
 441     {"description_good": "Service has no network configuration privileges",
 442     "description_bad": "Service has network configuration privileges",
 443     "weight": 1000,
 444     "range": 1
 445     },
 446 "CapabilityBoundingSet_CAP_SYS_RAWIO":
 447     {"description_good": "Service has no raw I/O access",
 448     "description_bad": "Service has raw I/O access",
 449     "weight": 1000,
 450     "range": 1
 451     },
 452 "CapabilityBoundingSet_CAP_SYS_MODULE":
 453     {"description_good": "Service cannot load kernel modules",
 454     "description_bad": "Service may load kernel modules",
 455     "weight": 1000,
 456     "range": 1
 457     },
 458 "CapabilityBoundingSet_CAP_AUDIT":
 459     {"description_good": "Service has no audit subsystem access",
 460     "description_bad": "Service has audit subsystem access",
 461     "weight": 500,
 462     "range": 1
 463     },
 464 "CapabilityBoundingSet_CAP_SYSLOG":
 465     {"description_good": "Service has no access to kernel logging",
 466     "description_bad": "Service has access to kernel logging",
 467     "weight": 500,
 468     "range": 1
 469     },
 470 "CapabilityBoundingSet_CAP_SYS_NICE_RESOURCE":
 471     {"description_good": "Service has no privileges to change resource use parameters",
 472     "description_bad": "Service has privileges to change resource use parameters",
 473     "weight": 500,
 474     "range": 1
 475     },
 476 "CapabilityBoundingSet_CAP_MKNOD":
 477     {"description_good": "Service cannot create device nodes",
 478     "description_bad": "Service may create device nodes",
 479     "weight": 500,
 480     "range": 1
 481     },
 482 "CapabilityBoundingSet_CAP_CHOWN_FSETID_SETFCAP":
 483     {"description_good": "Service cannot change file ownership/access mode/capabilities",
 484     "description_bad": "Service may change file ownership/access mode/capabilities unrestricted",
 485     "weight": 1000,
 486     "range": 1
 487     },
 488 "CapabilityBoundingSet_CAP_DAC_FOWNER_IPC_OWNER":
 489     {"description_good": "Service cannot override UNIX file/IPC permission checks",
 490     "description_bad": "Service may override UNIX file/IPC permission checks",
 491     "weight": 1000,
 492     "range": 1
 493     },
 494 "CapabilityBoundingSet_CAP_KILL":
 495     {"description_good": "Service cannot send UNIX signals to arbitrary processes",
 496     "description_bad": "Service may send UNIX signals to arbitrary processes",
 497     "weight": 500,
 498     "range": 1
 499     },
 500 "CapabilityBoundingSet_CAP_NET_BIND_SERVICE_BROADCAST_RAW":
 501     {"description_good": "Service has no elevated networking privileges",
 502     "description_bad": "Service has elevated networking privileges",
 503     "weight": 500,
 504     "range": 1
 505     },
 506 "CapabilityBoundingSet_CAP_SYS_BOOT":
 507     {"description_good": "Service cannot issue reboot()",
 508     "description_bad": "Service may issue reboot()",
 509     "weight": 100,
 510     "range": 1
 511     },
 512 "CapabilityBoundingSet_CAP_MAC":
 513     {"description_good": "Service cannot adjust SMACK MAC",
 514     "description_bad": "Service may adjust SMACK MAC",
 515     "weight": 100,
 516     "range": 1
 517     },
 518 "CapabilityBoundingSet_CAP_LINUX_IMMUTABLE":
 519     {"description_good": "Service cannot mark files immutable",
 520     "description_bad": "Service may mark files immutable",
 521     "weight": 75,
 522     "range": 1
 523     },
 524 "CapabilityBoundingSet_CAP_IPC_LOCK":
 525     {"description_good": "Service cannot lock memory into RAM",
 526     "description_bad": "Service may lock memory into RAM",
 527     "weight": 50,
 528     "range": 1
 529     },
 530 "CapabilityBoundingSet_CAP_SYS_CHROOT":
 531     {"description_good": "Service cannot issue chroot()",
 532     "description_bad": "Service may issue chroot()",
 533     "weight": 50,
 534     "range": 1
 535     },
 536 "CapabilityBoundingSet_CAP_BLOCK_SUSPEND":
 537     {"description_good": "Service cannot establish wake locks",
 538     "description_bad": "Service may establish wake locks",
 539     "weight": 25,
 540     "range": 1
 541     },
 542 "CapabilityBoundingSet_CAP_WAKE_ALARM":
 543     {"description_good": "Service cannot program timers that wake up the system",
 544     "description_bad": "Service may program timers that wake up the system",
 545     "weight": 25,
 546     "range": 1
 547     },
 548 "CapabilityBoundingSet_CAP_LEASE":
 549     {"description_good": "Service cannot create file leases",
 550     "description_bad": "Service may create file leases",
 551     "weight": 25,
 552     "range": 1
 553     },
 554 "CapabilityBoundingSet_CAP_SYS_TTY_CONFIG":
 555     {"description_good": "Service cannot issue vhangup()",
 556     "description_bad": "Service may issue vhangup()",
 557     "weight": 25,
 558     "range": 1
 559     },
 560 "CapabilityBoundingSet_CAP_SYS_PACCT":
 561     {"description_good": "Service cannot use acct()",
 562     "description_bad": "Service may use acct()",
 563     "weight": 25,
 564     "range": 1
 565     },
 566 "UMask":
 567     {"weight": 100,
 568     "range": 10
 569     },
 570 "KeyringMode":
 571     {"description_good": "Service doesn't share key material with other services",
 572     "description_bad": "Service shares key material with other service",
 573     "weight": 1000,
 574     "range": 1
 575     },
 576 "ProtectProc":
 577     {"description_good": "Service has restricted access to process tree(/proc hidepid=)",
 578     "description_bad": "Service has full access to process tree(/proc hidepid=)",
 579     "weight": 1000,
 580     "range": 3
 581     },
 582 "ProcSubset":
 583     {"description_good": "Service has no access to non-process/proc files(/proc subset=)",
 584     "description_bad": "Service has full access to non-process/proc files(/proc subset=)",
 585     "weight": 10,
 586     "range": 1
 587     },
 588 "NotifyAccess":
 589     {"description_good": "Service child processes cannot alter service state",
 590     "description_bad": "Service child processes may alter service state",
 591     "weight": 1000,
 592     "range": 1
 593     },
 594 "RemoveIPC":
 595     {"description_good": "Service user cannot leave SysV IPC objects around",
 596     "description_bad": "Service user may leave SysV IPC objects around",
 597     "description_na": "Service runs as root, option does not apply",
 598     "weight": 100,
 599     "range": 1
 600     },
 601 "Delegate":
 602     {"description_good": "Service does not maintain its own delegated control group subtree",
 603     "description_bad": "Service maintains its own delegated control group subtree",
 604     "weight": 100,
 605     "range": 1
 606     },
 607 "RestrictRealtime":
 608     {"description_good": "Service realtime scheduling access is restricted",
 609     "description_bad": "Service may acquire realtime scheduling",
 610     "weight": 500,
 611     "range": 1
 612     },
 613 "RestrictSUIDSGID":
 614     {"description_good": "SUID/SGIDfilecreationbyserviceisrestricted",
 615     "description_bad": "ServicemaycreateSUID/SGIDfiles",
 616     "weight": 1000,
 617     "range": 1
 618     },
 619 "RestrictNamespaces_user":
 620     {"description_good": "Servicecannotcreateusernamespaces",
 621     "description_bad": "Servicemaycreateusernamespaces",
 622     "weight": 1500,
 623     "range": 1
 624     },
 625 "RestrictNamespaces_mnt":
 626     {"description_good": "Service cannot create file system namespaces",
 627     "description_bad": "Service may create file system namespaces",
 628     "weight": 500,
 629     "range": 1
 630     },
 631 "RestrictNamespaces_ipc":
 632     {"description_good": "Service cannot create IPC namespaces",
 633     "description_bad": "Service may create IPC namespaces",
 634     "weight": 500,
 635     "range": 1
 636     },
 637 "RestrictNamespaces_pid":
 638     {"description_good": "Service cannot create process namespaces",
 639     "description_bad": "Service may create process namespaces",
 640     "weight": 500,
 641     "range": 1
 642     },
 643 "RestrictNamespaces_cgroup":
 644     {"description_good": "Service cannot create cgroup namespaces",
 645     "description_bad": "Service may create cgroup namespaces",
 646     "weight": 500,
 647     "range": 1
 648     },
 649 "RestrictNamespaces_net":
 650     {"description_good": "Service cannot create network namespaces",
 651     "description_bad": "Service may create network namespaces",
 652     "weight": 500,
 653     "range": 1
 654     },
 655 "RestrictNamespaces_uts":
 656     {"description_good": "Service cannot create hostname namespaces",
 657     "description_bad": "Service may create hostname namespaces",
 658     "weight": 100,
 659     "range": 1
 660     },
 661 "RestrictAddressFamilies_AF_INET_INET6":
 662     {"description_good": "Service cannot allocate Internet sockets",
 663     "description_bad": "Service may allocate Internet sockets",
 664     "weight": 1500,
 665     "range": 1
 666     },
 667 "RestrictAddressFamilies_AF_UNIX":
 668     {"description_good": "Service cannot allocate local sockets",
 669     "description_bad": "Service may allocate local sockets",
 670     "weight": 25,
 671     "range": 1
 672     },
 673 "RestrictAddressFamilies_AF_NETLINK":
 674     {"description_good": "Service cannot allocate netlink sockets",
 675     "description_bad": "Service may allocate netlink sockets",
 676     "weight": 200,
 677     "range": 1
 678     },
 679 "RestrictAddressFamilies_AF_PACKET":
 680     {"description_good": "Service cannot allocate packet sockets",
 681     "description_bad": "Service may allocate packet sockets",
 682     "weight": 1000,
 683     "range": 1
 684     },
 685 "RestrictAddressFamilies_OTHER":
 686     {"description_good": "Service cannot allocate exotic sockets",
 687     "description_bad": "Service may allocate exotic sockets",
 688     "weight": 1250,
 689     "range": 1
 690     },
 691 "SystemCallArchitectures":
 692     {"weight": 1000,
 693     "range": 10
 694     },
 695 "SystemCallFilter_swap":
 696     {"weight": 1000,
 697     "range": 10
 698     },
 699 "SystemCallFilter_obsolete":
 700     {"weight": 250,
 701     "range": 10
 702     },
 703 "SystemCallFilter_clock":
 704     {"weight": 1000,
 705     "range": 10
 706     },
 707 "SystemCallFilter_cpu_emulation":
 708     {"weight": 250,
 709     "range": 10
 710     },
 711 "SystemCallFilter_debug":
 712     {"weight": 1000,
 713     "range": 10
 714     },
 715 "SystemCallFilter_mount":
 716     {"weight": 1000,
 717     "range": 10
 718     },
 719 "SystemCallFilter_module":
 720     {"weight": 1000,
 721     "range": 10
 722     },
 723 "SystemCallFilter_raw_io":
 724     {"weight": 1000,
 725     "range": 10
 726     },
 727 "SystemCallFilter_reboot":
 728     {"weight": 1000,
 729     "range": 10
 730     },
 731 "SystemCallFilter_privileged":
 732     {"weight": 700,
 733     "range": 10
 734     },
 735 "SystemCallFilter_resources":
 736     {"weight": 700,
 737     "range": 10
 738     },
 739 "IPAddressDeny":
 740     {"weight": 1000,
 741     "range": 10
 742     },
 743 "DeviceAllow":
 744     {"weight": 1000,
 745     "range": 10
 746     },
 747 "AmbientCapabilities":
 748     {"description_good": "Service process does not receive ambient capabilities",
 749     "description_bad": "Service process receives ambient capabilities",
 750     "weight": 500,
 751     "range": 1
 752     },
 753 "INVALID_ID":
 754     {"weight": 1000,
 755     "range": 10
 756     }
 757 }
 758 EOF
 759
 760 # Reads in custom security requirements from the parsed .json file and uses these for comparison
 761 systemd-analyze security --threshold=90 --offline=true \
 762                            --security-policy=/tmp/testfile.json \
 763                            --root=/tmp/img/ testfile.service
 764
 765 # The strict profile adds a lot of sanboxing options
 766 systemd-analyze security --threshold=25 --offline=true \
 767                            --security-policy=/tmp/testfile.json \
 768                            --profile=strict \
 769                            --root=/tmp/img/ testfile.service
 770
 771 # The trusted profile doesn't add any sanboxing options
 772 (! systemd-analyze security --threshold=25 --offline=true \
 773                            --security-policy=/tmp/testfile.json \
 774                            --profile=/usr/lib/systemd/portable/profile/trusted/service.conf \
 775                            --root=/tmp/img/ testfile.service)
 776
 777 (! systemd-analyze security --threshold=50 --offline=true \
 778                            --security-policy=/tmp/testfile.json \
 779                            --root=/tmp/img/ testfile.service)
 780
 781 rm /tmp/img/usr/lib/systemd/system/testfile.service
 782
 783 if systemd-analyze --version | grep -q -F "+ELFUTILS"; then
 784     systemd-analyze inspect-elf --json=short /lib/systemd/systemd | grep -q -F '"elfType":"executable"'
 785 fi
 786
 787 systemd-analyze --threshold=90 security systemd-journald.service
 788
 789 # issue 23663
 790 check() {(
 791     set +x
 792     output=$(systemd-analyze security --offline="${2?}" "${3?}" | grep -F 'SystemCallFilter=')
 793     assert_in "System call ${1?} list" "$output"
 794     assert_in "[+✓] SystemCallFilter=~@swap" "$output"
 795     assert_in "[+✓] SystemCallFilter=~@resources" "$output"
 796     assert_in "[+✓] SystemCallFilter=~@reboot" "$output"
 797     assert_in "[+✓] SystemCallFilter=~@raw-io" "$output"
 798     assert_in "[-✗] SystemCallFilter=~@privileged" "$output"
 799     assert_in "[+✓] SystemCallFilter=~@obsolete" "$output"
 800     assert_in "[+✓] SystemCallFilter=~@mount" "$output"
 801     assert_in "[+✓] SystemCallFilter=~@module" "$output"
 802     assert_in "[+✓] SystemCallFilter=~@debug" "$output"
 803     assert_in "[+✓] SystemCallFilter=~@cpu-emulation" "$output"
 804     assert_in "[-✗] SystemCallFilter=~@clock" "$output"
 805 )}
 806
 807 export -n SYSTEMD_LOG_LEVEL
 808
 809 mkdir -p /run/systemd/system
 810 cat >/run/systemd/system/allow-list.service <<EOF
 811 [Service]
 812 ExecStart=false
 813 SystemCallFilter=@system-service
 814 SystemCallFilter=~@resources:ENOANO @privileged
 815 SystemCallFilter=@clock
 816 EOF
 817
 818 cat >/run/systemd/system/deny-list.service <<EOF
 819 [Service]
 820 ExecStart=false
 821 SystemCallFilter=~@known
 822 SystemCallFilter=@system-service
 823 SystemCallFilter=~@resources:ENOANO @privileged
 824 SystemCallFilter=@clock
 825 EOF
 826
 827 systemctl daemon-reload
 828
 829 check allow yes /run/systemd/system/allow-list.service
 830 check allow no allow-list.service
 831 check deny yes /run/systemd/system/deny-list.service
 832 check deny no deny-list.service
 833
 834 output=$(systemd-run -p "SystemCallFilter=@system-service" -p "SystemCallFilter=~@resources:ENOANO @privileged" -p "SystemCallFilter=@clock" sleep 60 2>&1)
 835 name=$(echo "$output" | awk '{ print $4 }' | cut -d';' -f1)
 836
 837 check allow yes /run/systemd/transient/"$name"
 838 check allow no "$name"
 839
 840 output=$(systemd-run -p "SystemCallFilter=~@known" -p "SystemCallFilter=@system-service" -p "SystemCallFilter=~@resources:ENOANO @privileged" -p "SystemCallFilter=@clock" sleep 60 2>&1)
 841 name=$(echo "$output" | awk '{ print $4 }' | cut -d';' -f1)
 842
 843 check deny yes /run/systemd/transient/"$name"
 844 check deny no "$name"
 845
 846 # Let's also test the "image-policy" verb
 847
 848 systemd-analyze image-policy '*' 2>&1 | grep -q -F "Long form: =verity+signed+encrypted+unprotected+unused+absent"
 849 systemd-analyze image-policy '-' 2>&1 | grep -q -F "Long form: =unused+absent"
 850 systemd-analyze image-policy 'home=encrypted:usr=verity' 2>&1 | grep -q -F "Long form: usr=verity:home=encrypted:=unused+absent"
 851 systemd-analyze image-policy 'home=encrypted:usr=verity' 2>&1 | grep -q -e '^home \+encrypted \+'
 852 systemd-analyze image-policy 'home=encrypted:usr=verity' 2>&1 | grep -q -e '^usr \+verity \+'
 853 systemd-analyze image-policy 'home=encrypted:usr=verity' 2>&1 | grep -q -e '^root \+ignore \+'
 854 systemd-analyze image-policy 'home=encrypted:usr=verity' 2>&1 | grep -q -e '^usr-verity \+unprotected \+'
 855
 856 (! systemd-analyze image-policy 'doedel')
 857
 858 # Output is very hard to predict, but let's run it for coverage anyway
 859 systemd-analyze pcrs
 860 systemd-analyze pcrs --json=pretty
 861 systemd-analyze pcrs 14 7 0 ima
 862
 863 systemd-analyze log-level info
 864
 865 touch /testok