src/test/test-condition.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <stdio.h>
   4 #include <sys/types.h>
   5 #include <sys/utsname.h>
   6 #include <unistd.h>
   7
   8 #include "sd-id128.h"
   9
  10 #include "alloc-util.h"
  11 #include "apparmor-util.h"
  12 #include "architecture.h"
  13 #include "audit-util.h"
  14 #include "cgroup-util.h"
  15 #include "condition.h"
  16 #include "efivars.h"
  17 #include "hostname-util.h"
  18 #include "id128-util.h"
  19 #include "ima-util.h"
  20 #include "limits-util.h"
  21 #include "log.h"
  22 #include "macro.h"
  23 #include "nulstr-util.h"
  24 #include "process-util.h"
  25 #include "selinux-util.h"
  26 #include "set.h"
  27 #include "smack-util.h"
  28 #include "string-util.h"
  29 #include "strv.h"
  30 #include "tests.h"
  31 #include "tomoyo-util.h"
  32 #include "user-util.h"
  33 #include "virt.h"
  34
  35 static void test_condition_test_path(void) {
  36         Condition *condition;
  37
  38         condition = condition_new(CONDITION_PATH_EXISTS, "/bin/sh", false, false);
  39         assert_se(condition);
  40         assert_se(condition_test(condition));
  41         condition_free(condition);
  42
  43         condition = condition_new(CONDITION_PATH_EXISTS, "/bin/s?", false, false);
  44         assert_se(condition);
  45         assert_se(!condition_test(condition));
  46         condition_free(condition);
  47
  48         condition = condition_new(CONDITION_PATH_EXISTS_GLOB, "/bin/s?", false, false);
  49         assert_se(condition);
  50         assert_se(condition_test(condition));
  51         condition_free(condition);
  52
  53         condition = condition_new(CONDITION_PATH_EXISTS_GLOB, "/bin/s?", false, true);
  54         assert_se(condition);
  55         assert_se(!condition_test(condition));
  56         condition_free(condition);
  57
  58         condition = condition_new(CONDITION_PATH_EXISTS, "/thiscertainlywontexist", false, false);
  59         assert_se(condition);
  60         assert_se(!condition_test(condition));
  61         condition_free(condition);
  62
  63         condition = condition_new(CONDITION_PATH_EXISTS, "/thiscertainlywontexist", false, true);
  64         assert_se(condition);
  65         assert_se(condition_test(condition));
  66         condition_free(condition);
  67
  68         condition = condition_new(CONDITION_PATH_IS_DIRECTORY, "/bin", false, false);
  69         assert_se(condition);
  70         assert_se(condition_test(condition));
  71         condition_free(condition);
  72
  73         condition = condition_new(CONDITION_DIRECTORY_NOT_EMPTY, "/bin", false, false);
  74         assert_se(condition);
  75         assert_se(condition_test(condition));
  76         condition_free(condition);
  77
  78         condition = condition_new(CONDITION_FILE_NOT_EMPTY, "/bin/sh", false, false);
  79         assert_se(condition);
  80         assert_se(condition_test(condition));
  81         condition_free(condition);
  82
  83         condition = condition_new(CONDITION_FILE_IS_EXECUTABLE, "/bin/sh", false, false);
  84         assert_se(condition);
  85         assert_se(condition_test(condition));
  86         condition_free(condition);
  87
  88         condition = condition_new(CONDITION_FILE_IS_EXECUTABLE, "/etc/passwd", false, false);
  89         assert_se(condition);
  90         assert_se(!condition_test(condition));
  91         condition_free(condition);
  92
  93         condition = condition_new(CONDITION_PATH_IS_MOUNT_POINT, "/proc", false, false);
  94         assert_se(condition);
  95         assert_se(condition_test(condition));
  96         condition_free(condition);
  97
  98         condition = condition_new(CONDITION_PATH_IS_MOUNT_POINT, "/", false, false);
  99         assert_se(condition);
 100         assert_se(condition_test(condition));
 101         condition_free(condition);
 102
 103         condition = condition_new(CONDITION_PATH_IS_MOUNT_POINT, "/bin", false, false);
 104         assert_se(condition);
 105         assert_se(!condition_test(condition));
 106         condition_free(condition);
 107
 108         condition = condition_new(CONDITION_PATH_IS_READ_WRITE, "/tmp", false, false);
 109         assert_se(condition);
 110         assert_se(condition_test(condition));
 111         condition_free(condition);
 112
 113         condition = condition_new(CONDITION_PATH_IS_SYMBOLIC_LINK, "/dev/stdout", false, false);
 114         assert_se(condition);
 115         assert_se(condition_test(condition));
 116         condition_free(condition);
 117 }
 118
 119 static void test_condition_test_control_group_controller(void) {
 120         Condition *condition;
 121         CGroupMask system_mask;
 122         CGroupController controller;
 123         _cleanup_free_ char *controller_name = NULL;
 124         int r;
 125
 126         r = cg_unified_flush();
 127         if (r < 0) {
 128                 log_notice_errno(r, "Skipping ConditionControlGroupController tests: %m");
 129                 return;
 130         }
 131
 132         /* Invalid controllers are ignored */
 133         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, "thisisnotarealcontroller", false, false);
 134         assert_se(condition);
 135         assert_se(condition_test(condition));
 136         condition_free(condition);
 137
 138         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, "thisisnotarealcontroller", false, true);
 139         assert_se(condition);
 140         assert_se(!condition_test(condition));
 141         condition_free(condition);
 142
 143         assert_se(cg_mask_supported(&system_mask) >= 0);
 144
 145         /* Individual valid controllers one by one */
 146         for (controller = 0; controller < _CGROUP_CONTROLLER_MAX; controller++) {
 147                 const char *local_controller_name = cgroup_controller_to_string(controller);
 148                 log_info("chosen controller is '%s'", local_controller_name);
 149                 if (system_mask & CGROUP_CONTROLLER_TO_MASK(controller)) {
 150                         log_info("this controller is available");
 151                         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, false);
 152                         assert_se(condition);
 153                         assert_se(condition_test(condition));
 154                         condition_free(condition);
 155
 156                         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, true);
 157                         assert_se(condition);
 158                         assert_se(!condition_test(condition));
 159                         condition_free(condition);
 160                 } else {
 161                         log_info("this controller is unavailable");
 162                         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, false);
 163                         assert_se(condition);
 164                         assert_se(!condition_test(condition));
 165                         condition_free(condition);
 166
 167                         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, true);
 168                         assert_se(condition);
 169                         assert_se(condition_test(condition));
 170                         condition_free(condition);
 171                 }
 172         }
 173
 174         /* Multiple valid controllers at the same time */
 175         assert_se(cg_mask_to_string(system_mask, &controller_name) >= 0);
 176
 177         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, strempty(controller_name), false, false);
 178         assert_se(condition);
 179         assert_se(condition_test(condition));
 180         condition_free(condition);
 181
 182         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, strempty(controller_name), false, true);
 183         assert_se(condition);
 184         assert_se(!condition_test(condition));
 185         condition_free(condition);
 186 }
 187
 188 static void test_condition_test_ac_power(void) {
 189         Condition *condition;
 190
 191         condition = condition_new(CONDITION_AC_POWER, "true", false, false);
 192         assert_se(condition);
 193         assert_se(condition_test(condition) == on_ac_power());
 194         condition_free(condition);
 195
 196         condition = condition_new(CONDITION_AC_POWER, "false", false, false);
 197         assert_se(condition);
 198         assert_se(condition_test(condition) != on_ac_power());
 199         condition_free(condition);
 200
 201         condition = condition_new(CONDITION_AC_POWER, "false", false, true);
 202         assert_se(condition);
 203         assert_se(condition_test(condition) == on_ac_power());
 204         condition_free(condition);
 205 }
 206
 207 static void test_condition_test_host(void) {
 208         _cleanup_free_ char *hostname = NULL;
 209         char sid[SD_ID128_STRING_MAX];
 210         Condition *condition;
 211         sd_id128_t id;
 212         int r;
 213
 214         r = sd_id128_get_machine(&id);
 215         assert_se(r >= 0);
 216         assert_se(sd_id128_to_string(id, sid));
 217
 218         condition = condition_new(CONDITION_HOST, sid, false, false);
 219         assert_se(condition);
 220         assert_se(condition_test(condition));
 221         condition_free(condition);
 222
 223         condition = condition_new(CONDITION_HOST, "garbage value jjjjjjjjjjjjjj", false, false);
 224         assert_se(condition);
 225         assert_se(!condition_test(condition));
 226         condition_free(condition);
 227
 228         condition = condition_new(CONDITION_HOST, sid, false, true);
 229         assert_se(condition);
 230         assert_se(!condition_test(condition));
 231         condition_free(condition);
 232
 233         hostname = gethostname_malloc();
 234         assert_se(hostname);
 235
 236         /* if hostname looks like an id128 then skip testing it */
 237         if (id128_is_valid(hostname))
 238                 log_notice("hostname is an id128, skipping test");
 239         else {
 240                 condition = condition_new(CONDITION_HOST, hostname, false, false);
 241                 assert_se(condition);
 242                 assert_se(condition_test(condition));
 243                 condition_free(condition);
 244         }
 245 }
 246
 247 static void test_condition_test_architecture(void) {
 248         Condition *condition;
 249         const char *sa;
 250         int a;
 251
 252         a = uname_architecture();
 253         assert_se(a >= 0);
 254
 255         sa = architecture_to_string(a);
 256         assert_se(sa);
 257
 258         condition = condition_new(CONDITION_ARCHITECTURE, sa, false, false);
 259         assert_se(condition);
 260         assert_se(condition_test(condition) > 0);
 261         condition_free(condition);
 262
 263         condition = condition_new(CONDITION_ARCHITECTURE, "garbage value", false, false);
 264         assert_se(condition);
 265         assert_se(condition_test(condition) == 0);
 266         condition_free(condition);
 267
 268         condition = condition_new(CONDITION_ARCHITECTURE, sa, false, true);
 269         assert_se(condition);
 270         assert_se(condition_test(condition) == 0);
 271         condition_free(condition);
 272 }
 273
 274 static void test_condition_test_kernel_command_line(void) {
 275         Condition *condition;
 276
 277         condition = condition_new(CONDITION_KERNEL_COMMAND_LINE, "thisreallyshouldntbeonthekernelcommandline", false, false);
 278         assert_se(condition);
 279         assert_se(!condition_test(condition));
 280         condition_free(condition);
 281
 282         condition = condition_new(CONDITION_KERNEL_COMMAND_LINE, "andthis=neither", false, false);
 283         assert_se(condition);
 284         assert_se(!condition_test(condition));
 285         condition_free(condition);
 286 }
 287
 288 static void test_condition_test_kernel_version(void) {
 289         Condition *condition;
 290         struct utsname u;
 291         const char *v;
 292
 293         condition = condition_new(CONDITION_KERNEL_VERSION, "*thisreallyshouldntbeinthekernelversion*", false, false);
 294         assert_se(condition);
 295         assert_se(!condition_test(condition));
 296         condition_free(condition);
 297
 298         condition = condition_new(CONDITION_KERNEL_VERSION, "*", false, false);
 299         assert_se(condition);
 300         assert_se(condition_test(condition));
 301         condition_free(condition);
 302
 303         condition = condition_new(CONDITION_KERNEL_VERSION, "", false, false);
 304         assert_se(condition);
 305         assert_se(!condition_test(condition));
 306         condition_free(condition);
 307
 308         assert_se(uname(&u) >= 0);
 309
 310         condition = condition_new(CONDITION_KERNEL_VERSION, u.release, false, false);
 311         assert_se(condition);
 312         assert_se(condition_test(condition));
 313         condition_free(condition);
 314
 315         strshorten(u.release, 4);
 316         strcpy(strchr(u.release, 0), "*");
 317
 318         condition = condition_new(CONDITION_KERNEL_VERSION, u.release, false, false);
 319         assert_se(condition);
 320         assert_se(condition_test(condition));
 321         condition_free(condition);
 322
 323         /* 0.1.2 would be a very very very old kernel */
 324         condition = condition_new(CONDITION_KERNEL_VERSION, "> 0.1.2", false, false);
 325         assert_se(condition);
 326         assert_se(condition_test(condition));
 327         condition_free(condition);
 328
 329         condition = condition_new(CONDITION_KERNEL_VERSION, ">= 0.1.2", false, false);
 330         assert_se(condition);
 331         assert_se(condition_test(condition));
 332         condition_free(condition);
 333
 334         condition = condition_new(CONDITION_KERNEL_VERSION, "< 0.1.2", false, false);
 335         assert_se(condition);
 336         assert_se(!condition_test(condition));
 337         condition_free(condition);
 338
 339         condition = condition_new(CONDITION_KERNEL_VERSION, "<= 0.1.2", false, false);
 340         assert_se(condition);
 341         assert_se(!condition_test(condition));
 342         condition_free(condition);
 343
 344         condition = condition_new(CONDITION_KERNEL_VERSION, "= 0.1.2", false, false);
 345         assert_se(condition);
 346         assert_se(!condition_test(condition));
 347         condition_free(condition);
 348
 349         /* 4711.8.15 is a very very very future kernel */
 350         condition = condition_new(CONDITION_KERNEL_VERSION, "< 4711.8.15", false, false);
 351         assert_se(condition);
 352         assert_se(condition_test(condition));
 353         condition_free(condition);
 354
 355         condition = condition_new(CONDITION_KERNEL_VERSION, "<= 4711.8.15", false, false);
 356         assert_se(condition);
 357         assert_se(condition_test(condition));
 358         condition_free(condition);
 359
 360         condition = condition_new(CONDITION_KERNEL_VERSION, "= 4711.8.15", false, false);
 361         assert_se(condition);
 362         assert_se(!condition_test(condition));
 363         condition_free(condition);
 364
 365         condition = condition_new(CONDITION_KERNEL_VERSION, "> 4711.8.15", false, false);
 366         assert_se(condition);
 367         assert_se(!condition_test(condition));
 368         condition_free(condition);
 369
 370         condition = condition_new(CONDITION_KERNEL_VERSION, ">= 4711.8.15", false, false);
 371         assert_se(condition);
 372         assert_se(!condition_test(condition));
 373         condition_free(condition);
 374
 375         assert_se(uname(&u) >= 0);
 376
 377         v = strjoina(">=", u.release);
 378         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 379         assert_se(condition);
 380         assert_se(condition_test(condition));
 381         condition_free(condition);
 382
 383         v = strjoina("=  ", u.release);
 384         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 385         assert_se(condition);
 386         assert_se(condition_test(condition));
 387         condition_free(condition);
 388
 389         v = strjoina("<=", u.release);
 390         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 391         assert_se(condition);
 392         assert_se(condition_test(condition));
 393         condition_free(condition);
 394
 395         v = strjoina("> ", u.release);
 396         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 397         assert_se(condition);
 398         assert_se(!condition_test(condition));
 399         condition_free(condition);
 400
 401         v = strjoina("<   ", u.release);
 402         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 403         assert_se(condition);
 404         assert_se(!condition_test(condition));
 405         condition_free(condition);
 406 }
 407
 408 static void test_condition_test_null(void) {
 409         Condition *condition;
 410
 411         condition = condition_new(CONDITION_NULL, NULL, false, false);
 412         assert_se(condition);
 413         assert_se(condition_test(condition));
 414         condition_free(condition);
 415
 416         condition = condition_new(CONDITION_NULL, NULL, false, true);
 417         assert_se(condition);
 418         assert_se(!condition_test(condition));
 419         condition_free(condition);
 420 }
 421
 422 static void test_condition_test_security(void) {
 423         Condition *condition;
 424
 425         condition = condition_new(CONDITION_SECURITY, "garbage oifdsjfoidsjoj", false, false);
 426         assert_se(condition);
 427         assert_se(!condition_test(condition));
 428         condition_free(condition);
 429
 430         condition = condition_new(CONDITION_SECURITY, "selinux", false, true);
 431         assert_se(condition);
 432         assert_se(condition_test(condition) != mac_selinux_use());
 433         condition_free(condition);
 434
 435         condition = condition_new(CONDITION_SECURITY, "apparmor", false, false);
 436         assert_se(condition);
 437         assert_se(condition_test(condition) == mac_apparmor_use());
 438         condition_free(condition);
 439
 440         condition = condition_new(CONDITION_SECURITY, "tomoyo", false, false);
 441         assert_se(condition);
 442         assert_se(condition_test(condition) == mac_tomoyo_use());
 443         condition_free(condition);
 444
 445         condition = condition_new(CONDITION_SECURITY, "ima", false, false);
 446         assert_se(condition);
 447         assert_se(condition_test(condition) == use_ima());
 448         condition_free(condition);
 449
 450         condition = condition_new(CONDITION_SECURITY, "smack", false, false);
 451         assert_se(condition);
 452         assert_se(condition_test(condition) == mac_smack_use());
 453         condition_free(condition);
 454
 455         condition = condition_new(CONDITION_SECURITY, "audit", false, false);
 456         assert_se(condition);
 457         assert_se(condition_test(condition) == use_audit());
 458         condition_free(condition);
 459
 460         condition = condition_new(CONDITION_SECURITY, "uefi-secureboot", false, false);
 461         assert_se(condition);
 462         assert_se(condition_test(condition) == is_efi_secure_boot());
 463         condition_free(condition);
 464 }
 465
 466 static void print_securities(void) {
 467         log_info("------ enabled security technologies ------");
 468         log_info("SELinux: %s", yes_no(mac_selinux_use()));
 469         log_info("AppArmor: %s", yes_no(mac_apparmor_use()));
 470         log_info("Tomoyo: %s", yes_no(mac_tomoyo_use()));
 471         log_info("IMA: %s", yes_no(use_ima()));
 472         log_info("SMACK: %s", yes_no(mac_smack_use()));
 473         log_info("Audit: %s", yes_no(use_audit()));
 474         log_info("UEFI secure boot: %s", yes_no(is_efi_secure_boot()));
 475         log_info("-------------------------------------------");
 476 }
 477
 478 static void test_condition_test_virtualization(void) {
 479         Condition *condition;
 480         const char *virt;
 481         int r;
 482
 483         condition = condition_new(CONDITION_VIRTUALIZATION, "garbage oifdsjfoidsjoj", false, false);
 484         assert_se(condition);
 485         r = condition_test(condition);
 486         log_info("ConditionVirtualization=garbage → %i", r);
 487         assert_se(r == 0);
 488         condition_free(condition);
 489
 490         condition = condition_new(CONDITION_VIRTUALIZATION, "container", false, false);
 491         assert_se(condition);
 492         r = condition_test(condition);
 493         log_info("ConditionVirtualization=container → %i", r);
 494         assert_se(r == !!detect_container());
 495         condition_free(condition);
 496
 497         condition = condition_new(CONDITION_VIRTUALIZATION, "vm", false, false);
 498         assert_se(condition);
 499         r = condition_test(condition);
 500         log_info("ConditionVirtualization=vm → %i", r);
 501         assert_se(r == (detect_vm() && !detect_container()));
 502         condition_free(condition);
 503
 504         condition = condition_new(CONDITION_VIRTUALIZATION, "private-users", false, false);
 505         assert_se(condition);
 506         r = condition_test(condition);
 507         log_info("ConditionVirtualization=private-users → %i", r);
 508         assert_se(r == !!running_in_userns());
 509         condition_free(condition);
 510
 511         NULSTR_FOREACH(virt,
 512                        "kvm\0"
 513                        "qemu\0"
 514                        "bochs\0"
 515                        "xen\0"
 516                        "uml\0"
 517                        "vmware\0"
 518                        "oracle\0"
 519                        "microsoft\0"
 520                        "zvm\0"
 521                        "parallels\0"
 522                        "bhyve\0"
 523                        "vm_other\0") {
 524
 525                 condition = condition_new(CONDITION_VIRTUALIZATION, virt, false, false);
 526                 assert_se(condition);
 527                 r = condition_test(condition);
 528                 log_info("ConditionVirtualization=%s → %i", virt, r);
 529                 assert_se(r >= 0);
 530                 condition_free(condition);
 531         }
 532 }
 533
 534 static void test_condition_test_user(void) {
 535         Condition *condition;
 536         char* uid;
 537         char* username;
 538         int r;
 539
 540         condition = condition_new(CONDITION_USER, "garbage oifdsjfoidsjoj", false, false);
 541         assert_se(condition);
 542         r = condition_test(condition);
 543         log_info("ConditionUser=garbage → %i", r);
 544         assert_se(r == 0);
 545         condition_free(condition);
 546
 547         assert_se(asprintf(&uid, "%"PRIu32, UINT32_C(0xFFFF)) > 0);
 548         condition = condition_new(CONDITION_USER, uid, false, false);
 549         assert_se(condition);
 550         r = condition_test(condition);
 551         log_info("ConditionUser=%s → %i", uid, r);
 552         assert_se(r == 0);
 553         condition_free(condition);
 554         free(uid);
 555
 556         assert_se(asprintf(&uid, "%u", (unsigned)getuid()) > 0);
 557         condition = condition_new(CONDITION_USER, uid, false, false);
 558         assert_se(condition);
 559         r = condition_test(condition);
 560         log_info("ConditionUser=%s → %i", uid, r);
 561         assert_se(r > 0);
 562         condition_free(condition);
 563         free(uid);
 564
 565         assert_se(asprintf(&uid, "%u", (unsigned)getuid()+1) > 0);
 566         condition = condition_new(CONDITION_USER, uid, false, false);
 567         assert_se(condition);
 568         r = condition_test(condition);
 569         log_info("ConditionUser=%s → %i", uid, r);
 570         assert_se(r == 0);
 571         condition_free(condition);
 572         free(uid);
 573
 574         username = getusername_malloc();
 575         assert_se(username);
 576         condition = condition_new(CONDITION_USER, username, false, false);
 577         assert_se(condition);
 578         r = condition_test(condition);
 579         log_info("ConditionUser=%s → %i", username, r);
 580         assert_se(r > 0);
 581         condition_free(condition);
 582         free(username);
 583
 584         username = (char*)(geteuid() == 0 ? NOBODY_USER_NAME : "root");
 585         condition = condition_new(CONDITION_USER, username, false, false);
 586         assert_se(condition);
 587         r = condition_test(condition);
 588         log_info("ConditionUser=%s → %i", username, r);
 589         assert_se(r == 0);
 590         condition_free(condition);
 591
 592         condition = condition_new(CONDITION_USER, "@system", false, false);
 593         assert_se(condition);
 594         r = condition_test(condition);
 595         log_info("ConditionUser=@system → %i", r);
 596         if (uid_is_system(getuid()) || uid_is_system(geteuid()))
 597                 assert_se(r > 0);
 598         else
 599                 assert_se(r == 0);
 600         condition_free(condition);
 601 }
 602
 603 static void test_condition_test_group(void) {
 604         Condition *condition;
 605         char* gid;
 606         char* groupname;
 607         gid_t *gids, max_gid;
 608         int ngroups_max, ngroups, r, i;
 609
 610         assert_se(0 < asprintf(&gid, "%u", UINT32_C(0xFFFF)));
 611         condition = condition_new(CONDITION_GROUP, gid, false, false);
 612         assert_se(condition);
 613         r = condition_test(condition);
 614         log_info("ConditionGroup=%s → %i", gid, r);
 615         assert_se(r == 0);
 616         condition_free(condition);
 617         free(gid);
 618
 619         assert_se(0 < asprintf(&gid, "%u", getgid()));
 620         condition = condition_new(CONDITION_GROUP, gid, false, false);
 621         assert_se(condition);
 622         r = condition_test(condition);
 623         log_info("ConditionGroup=%s → %i", gid, r);
 624         assert_se(r > 0);
 625         condition_free(condition);
 626         free(gid);
 627
 628         ngroups_max = sysconf(_SC_NGROUPS_MAX);
 629         assert(ngroups_max > 0);
 630
 631         gids = newa(gid_t, ngroups_max);
 632
 633         ngroups = getgroups(ngroups_max, gids);
 634         assert(ngroups >= 0);
 635
 636         max_gid = getgid();
 637         for (i = 0; i < ngroups; i++) {
 638                 assert_se(0 < asprintf(&gid, "%u", gids[i]));
 639                 condition = condition_new(CONDITION_GROUP, gid, false, false);
 640                 assert_se(condition);
 641                 r = condition_test(condition);
 642                 log_info("ConditionGroup=%s → %i", gid, r);
 643                 assert_se(r > 0);
 644                 condition_free(condition);
 645                 free(gid);
 646                 max_gid = gids[i] > max_gid ? gids[i] : max_gid;
 647
 648                 groupname = gid_to_name(gids[i]);
 649                 assert_se(groupname);
 650                 condition = condition_new(CONDITION_GROUP, groupname, false, false);
 651                 assert_se(condition);
 652                 r = condition_test(condition);
 653                 log_info("ConditionGroup=%s → %i", groupname, r);
 654                 assert_se(r > 0);
 655                 condition_free(condition);
 656                 free(groupname);
 657                 max_gid = gids[i] > max_gid ? gids[i] : max_gid;
 658         }
 659
 660         assert_se(0 < asprintf(&gid, "%u", max_gid+1));
 661         condition = condition_new(CONDITION_GROUP, gid, false, false);
 662         assert_se(condition);
 663         r = condition_test(condition);
 664         log_info("ConditionGroup=%s → %i", gid, r);
 665         assert_se(r == 0);
 666         condition_free(condition);
 667         free(gid);
 668
 669         groupname = (char*)(geteuid() == 0 ? NOBODY_GROUP_NAME : "root");
 670         condition = condition_new(CONDITION_GROUP, groupname, false, false);
 671         assert_se(condition);
 672         r = condition_test(condition);
 673         log_info("ConditionGroup=%s → %i", groupname, r);
 674         assert_se(r == 0);
 675         condition_free(condition);
 676 }
 677
 678 static void test_condition_test_cpus_one(const char *s, bool result) {
 679         Condition *condition;
 680         int r;
 681
 682         log_debug("%s=%s", condition_type_to_string(CONDITION_CPUS), s);
 683
 684         condition = condition_new(CONDITION_CPUS, s, false, false);
 685         assert_se(condition);
 686
 687         r = condition_test(condition);
 688         assert_se(r >= 0);
 689         assert_se(r == result);
 690         condition_free(condition);
 691 }
 692
 693 static void test_condition_test_cpus(void) {
 694         _cleanup_free_ char *t = NULL;
 695         int cpus;
 696
 697         cpus = cpus_in_affinity_mask();
 698         assert_se(cpus >= 0);
 699
 700         test_condition_test_cpus_one("> 0", true);
 701         test_condition_test_cpus_one(">= 0", true);
 702         test_condition_test_cpus_one("!= 0", true);
 703         test_condition_test_cpus_one("<= 0", false);
 704         test_condition_test_cpus_one("< 0", false);
 705         test_condition_test_cpus_one("= 0", false);
 706
 707         test_condition_test_cpus_one("> 100000", false);
 708         test_condition_test_cpus_one("= 100000", false);
 709         test_condition_test_cpus_one(">= 100000", false);
 710         test_condition_test_cpus_one("< 100000", true);
 711         test_condition_test_cpus_one("!= 100000", true);
 712         test_condition_test_cpus_one("<= 100000", true);
 713
 714         assert_se(asprintf(&t, "= %i", cpus) >= 0);
 715         test_condition_test_cpus_one(t, true);
 716         t = mfree(t);
 717
 718         assert_se(asprintf(&t, "<= %i", cpus) >= 0);
 719         test_condition_test_cpus_one(t, true);
 720         t = mfree(t);
 721
 722         assert_se(asprintf(&t, ">= %i", cpus) >= 0);
 723         test_condition_test_cpus_one(t, true);
 724         t = mfree(t);
 725
 726         assert_se(asprintf(&t, "!= %i", cpus) >= 0);
 727         test_condition_test_cpus_one(t, false);
 728         t = mfree(t);
 729
 730         assert_se(asprintf(&t, "< %i", cpus) >= 0);
 731         test_condition_test_cpus_one(t, false);
 732         t = mfree(t);
 733
 734         assert_se(asprintf(&t, "> %i", cpus) >= 0);
 735         test_condition_test_cpus_one(t, false);
 736         t = mfree(t);
 737 }
 738
 739 static void test_condition_test_memory_one(const char *s, bool result) {
 740         Condition *condition;
 741         int r;
 742
 743         log_debug("%s=%s", condition_type_to_string(CONDITION_MEMORY), s);
 744
 745         condition = condition_new(CONDITION_MEMORY, s, false, false);
 746         assert_se(condition);
 747
 748         r = condition_test(condition);
 749         assert_se(r >= 0);
 750         assert_se(r == result);
 751         condition_free(condition);
 752 }
 753
 754 static void test_condition_test_memory(void) {
 755         _cleanup_free_ char *t = NULL;
 756         uint64_t memory;
 757
 758         memory = physical_memory();
 759
 760         test_condition_test_memory_one("> 0", true);
 761         test_condition_test_memory_one(">= 0", true);
 762         test_condition_test_memory_one("!= 0", true);
 763         test_condition_test_memory_one("<= 0", false);
 764         test_condition_test_memory_one("< 0", false);
 765         test_condition_test_memory_one("= 0", false);
 766
 767         test_condition_test_memory_one("> 18446744073709547520", false);
 768         test_condition_test_memory_one("= 18446744073709547520", false);
 769         test_condition_test_memory_one(">= 18446744073709547520", false);
 770         test_condition_test_memory_one("< 18446744073709547520", true);
 771         test_condition_test_memory_one("!= 18446744073709547520", true);
 772         test_condition_test_memory_one("<= 18446744073709547520", true);
 773
 774         assert_se(asprintf(&t, "= %" PRIu64, memory) >= 0);
 775         test_condition_test_memory_one(t, true);
 776         t = mfree(t);
 777
 778         assert_se(asprintf(&t, "<= %" PRIu64, memory) >= 0);
 779         test_condition_test_memory_one(t, true);
 780         t = mfree(t);
 781
 782         assert_se(asprintf(&t, ">= %" PRIu64, memory) >= 0);
 783         test_condition_test_memory_one(t, true);
 784         t = mfree(t);
 785
 786         assert_se(asprintf(&t, "!= %" PRIu64, memory) >= 0);
 787         test_condition_test_memory_one(t, false);
 788         t = mfree(t);
 789
 790         assert_se(asprintf(&t, "< %" PRIu64, memory) >= 0);
 791         test_condition_test_memory_one(t, false);
 792         t = mfree(t);
 793
 794         assert_se(asprintf(&t, "> %" PRIu64, memory) >= 0);
 795         test_condition_test_memory_one(t, false);
 796         t = mfree(t);
 797 }
 798
 799 int main(int argc, char *argv[]) {
 800         test_setup_logging(LOG_DEBUG);
 801
 802         test_condition_test_path();
 803         test_condition_test_ac_power();
 804         test_condition_test_host();
 805         test_condition_test_architecture();
 806         test_condition_test_kernel_command_line();
 807         test_condition_test_kernel_version();
 808         test_condition_test_null();
 809         test_condition_test_security();
 810         print_securities();
 811         test_condition_test_virtualization();
 812         test_condition_test_user();
 813         test_condition_test_group();
 814         test_condition_test_control_group_controller();
 815         test_condition_test_cpus();
 816         test_condition_test_memory();
 817
 818         return 0;
 819 }