]>
git.ipfire.org Git - thirdparty/systemd.git/blob - src/test/test-bpf-restrict-fs.c
1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
3 #include "bpf-restrict-fs.h"
4 #include "load-fragment.h"
6 #include "process-util.h"
7 #include "rlimit-util.h"
15 static int test_restrict_filesystems(Manager
*m
, const char *unit_name
, const char *file_path
, char **allowed_filesystems
) {
16 _cleanup_free_
char *exec_start
= NULL
;
17 _cleanup_(unit_freep
) Unit
*u
= NULL
;
18 ExecContext
*ec
= NULL
;
21 assert_se(u
= unit_new(m
, sizeof(Service
)));
22 assert_se(unit_add_name(u
, unit_name
) == 0);
23 assert_se(ec
= unit_get_exec_context(u
));
25 STRV_FOREACH(allow_filesystem
, allowed_filesystems
) {
26 r
= config_parse_restrict_filesystems(
27 u
->id
, "filename", 1, "Service", 1, "RestrictFileSystems", 0,
28 *allow_filesystem
, ec
, u
);
30 return log_unit_error_errno(u
, r
, "Failed to parse RestrictFileSystems: %m");
33 assert_se(exec_start
= strjoin("cat ", file_path
));
34 r
= config_parse_exec(u
->id
, "filename", 1, "Service", 1, "ExecStart",
35 SERVICE_EXEC_START
, exec_start
, SERVICE(u
)->exec_command
, u
);
37 return log_error_errno(r
, "Failed to parse ExecStart");
39 SERVICE(u
)->type
= SERVICE_ONESHOT
;
40 u
->load_state
= UNIT_LOADED
;
42 r
= unit_start(u
, NULL
);
44 return log_error_errno(r
, "Unit start failed %m");
46 while (!IN_SET(SERVICE(u
)->state
, SERVICE_DEAD
, SERVICE_FAILED
)) {
47 r
= sd_event_run(m
->event
, UINT64_MAX
);
49 return log_error_errno(errno
, "Event run failed %m");
52 cld_code
= SERVICE(u
)->exec_command
[SERVICE_EXEC_START
]->exec_status
.code
;
53 if (cld_code
!= CLD_EXITED
)
54 return log_error_errno(-SYNTHETIC_ERRNO(EBUSY
), "ExecStart didn't exited, code='%s'", sigchld_code_to_string(cld_code
));
56 if (SERVICE(u
)->state
!= SERVICE_DEAD
)
57 return log_error_errno(-SYNTHETIC_ERRNO(EBUSY
), "Service is not dead");
62 int main(int argc
, char *argv
[]) {
63 _cleanup_(rm_rf_physical_and_freep
) char *runtime_dir
= NULL
;
64 _cleanup_(manager_freep
) Manager
*m
= NULL
;
65 _cleanup_free_
char *unit_dir
= NULL
;
69 test_setup_logging(LOG_DEBUG
);
71 assert_se(getrlimit(RLIMIT_MEMLOCK
, &rl
) >= 0);
72 rl
.rlim_cur
= rl
.rlim_max
= MAX(rl
.rlim_max
, CAN_MEMLOCK_SIZE
);
73 (void) setrlimit_closest(RLIMIT_MEMLOCK
, &rl
);
76 return log_tests_skipped("Can't use mlock()");
78 if (!lsm_bpf_supported(/* initialize = */ true))
79 return log_tests_skipped("LSM BPF hooks are not supported");
81 r
= enter_cgroup_subroot(NULL
);
83 return log_tests_skipped("cgroupfs not available");
85 assert_se(get_testdata_dir("units", &unit_dir
) >= 0);
86 assert_se(set_unit_path(unit_dir
) >= 0);
87 assert_se(runtime_dir
= setup_fake_runtime_dir());
89 assert_se(manager_new(RUNTIME_SCOPE_SYSTEM
, MANAGER_TEST_RUN_BASIC
, &m
) >= 0);
90 assert_se(manager_startup(m
, NULL
, NULL
, NULL
) >= 0);
92 /* We need to enable access to the filesystem where the binary is so we
93 * add @common-block */
94 assert_se(test_restrict_filesystems(m
, "restrict_filesystems_test.service", "/sys/kernel/tracing/printk_formats", STRV_MAKE("@common-block")) < 0);
95 assert_se(test_restrict_filesystems(m
, "restrict_filesystems_test.service", "/sys/kernel/tracing/printk_formats", STRV_MAKE("tracefs", "@common-block")) >= 0);
96 assert_se(test_restrict_filesystems(m
, "restrict_filesystems_test.service", "/sys/kernel/tracing/printk_formats", STRV_MAKE("tracefs", "@common-block", "~tracefs")) < 0);
97 assert_se(test_restrict_filesystems(m
, "restrict_filesystems_test.service", "/sys/kernel/debug/sleep_time", STRV_MAKE("@common-block")) < 0);
98 assert_se(test_restrict_filesystems(m
, "restrict_filesystems_test.service", "/sys/kernel/debug/sleep_time", STRV_MAKE("debugfs", "@common-block")) >= 0);
99 assert_se(test_restrict_filesystems(m
, "restrict_filesystems_test.service", "/sys/kernel/debug/sleep_time", STRV_MAKE("~debugfs")) < 0);