src/test/test-execute.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <grp.h>
   4 #include <pwd.h>
   5 #include <stdio.h>
   6 #include <sys/prctl.h>
   7 #include <sys/types.h>
   8
   9 #include "capability-util.h"
  10 #include "cpu-set-util.h"
  11 #include "errno-list.h"
  12 #include "fileio.h"
  13 #include "fs-util.h"
  14 #include "macro.h"
  15 #include "manager.h"
  16 #include "missing_prctl.h"
  17 #include "mkdir.h"
  18 #include "path-util.h"
  19 #include "rm-rf.h"
  20 #if HAVE_SECCOMP
  21 #include "seccomp-util.h"
  22 #endif
  23 #include "service.h"
  24 #include "stat-util.h"
  25 #include "test-helper.h"
  26 #include "tests.h"
  27 #include "unit.h"
  28 #include "user-util.h"
  29 #include "util.h"
  30 #include "virt.h"
  31
  32 static bool can_unshare;
  33
  34 typedef void (*test_function_t)(Manager *m);
  35
  36 static int cld_dumped_to_killed(int code) {
  37         /* Depending on the system, seccomp version, … some signals might result in dumping, others in plain
  38          * killing. Let's ignore the difference here, and map both cases to CLD_KILLED */
  39         return code == CLD_DUMPED ? CLD_KILLED : code;
  40 }
  41
  42 static void check(const char *func, Manager *m, Unit *unit, int status_expected, int code_expected) {
  43         Service *service = NULL;
  44         usec_t ts;
  45         usec_t timeout = 2 * USEC_PER_MINUTE;
  46
  47         assert_se(m);
  48         assert_se(unit);
  49
  50         service = SERVICE(unit);
  51         printf("%s\n", unit->id);
  52         exec_context_dump(&service->exec_context, stdout, "\t");
  53         ts = now(CLOCK_MONOTONIC);
  54         while (!IN_SET(service->state, SERVICE_DEAD, SERVICE_FAILED)) {
  55                 int r;
  56                 usec_t n;
  57
  58                 r = sd_event_run(m->event, 100 * USEC_PER_MSEC);
  59                 assert_se(r >= 0);
  60
  61                 n = now(CLOCK_MONOTONIC);
  62                 if (ts + timeout < n) {
  63                         log_error("Test timeout when testing %s", unit->id);
  64                         r = unit_kill(unit, KILL_ALL, SIGKILL, NULL);
  65                         if (r < 0)
  66                                 log_error_errno(r, "Failed to kill %s: %m", unit->id);
  67                         exit(EXIT_FAILURE);
  68                 }
  69         }
  70         exec_status_dump(&service->main_exec_status, stdout, "\t");
  71
  72         if (cld_dumped_to_killed(service->main_exec_status.code) != cld_dumped_to_killed(code_expected)) {
  73                 log_error("%s: %s: exit code %d, expected %d",
  74                           func, unit->id,
  75                           service->main_exec_status.code, code_expected);
  76                 abort();
  77         }
  78
  79         if (service->main_exec_status.status != status_expected) {
  80                 log_error("%s: %s: exit status %d, expected %d",
  81                           func, unit->id,
  82                           service->main_exec_status.status, status_expected);
  83                 abort();
  84         }
  85 }
  86
  87 static bool check_nobody_user_and_group(void) {
  88         static int cache = -1;
  89         struct passwd *p;
  90         struct group *g;
  91
  92         if (cache >= 0)
  93                 return !!cache;
  94
  95         if (!synthesize_nobody())
  96                 goto invalid;
  97
  98         p = getpwnam(NOBODY_USER_NAME);
  99         if (!p ||
 100             !streq(p->pw_name, NOBODY_USER_NAME) ||
 101             p->pw_uid != UID_NOBODY ||
 102             p->pw_gid != GID_NOBODY)
 103                 goto invalid;
 104
 105         p = getpwuid(UID_NOBODY);
 106         if (!p ||
 107             !streq(p->pw_name, NOBODY_USER_NAME) ||
 108             p->pw_uid != UID_NOBODY ||
 109             p->pw_gid != GID_NOBODY)
 110                 goto invalid;
 111
 112         g = getgrnam(NOBODY_GROUP_NAME);
 113         if (!g ||
 114             !streq(g->gr_name, NOBODY_GROUP_NAME) ||
 115             g->gr_gid != GID_NOBODY)
 116                 goto invalid;
 117
 118         g = getgrgid(GID_NOBODY);
 119         if (!g ||
 120             !streq(g->gr_name, NOBODY_GROUP_NAME) ||
 121             g->gr_gid != GID_NOBODY)
 122                 goto invalid;
 123
 124         cache = 1;
 125         return true;
 126
 127 invalid:
 128         cache = 0;
 129         return false;
 130 }
 131
 132 static bool check_user_has_group_with_same_name(const char *name) {
 133         struct passwd *p;
 134         struct group *g;
 135
 136         assert(name);
 137
 138         p = getpwnam(name);
 139         if (!p ||
 140             !streq(p->pw_name, name))
 141                 return false;
 142
 143         g = getgrgid(p->pw_gid);
 144         if (!g ||
 145             !streq(g->gr_name, name))
 146                 return false;
 147
 148         return true;
 149 }
 150
 151 static bool is_inaccessible_available(void) {
 152         const char *p;
 153
 154         FOREACH_STRING(p,
 155                 "/run/systemd/inaccessible/reg",
 156                 "/run/systemd/inaccessible/dir",
 157                 "/run/systemd/inaccessible/chr",
 158                 "/run/systemd/inaccessible/blk",
 159                 "/run/systemd/inaccessible/fifo",
 160                 "/run/systemd/inaccessible/sock"
 161         ) {
 162                 if (access(p, F_OK) < 0)
 163                         return false;
 164         }
 165
 166         return true;
 167 }
 168
 169 static void test(const char *func, Manager *m, const char *unit_name, int status_expected, int code_expected) {
 170         Unit *unit;
 171
 172         assert_se(unit_name);
 173
 174         assert_se(manager_load_startable_unit_or_warn(m, unit_name, NULL, &unit) >= 0);
 175         assert_se(unit_start(unit) >= 0);
 176         check(func, m, unit, status_expected, code_expected);
 177 }
 178
 179 static void test_exec_bindpaths(Manager *m) {
 180         assert_se(mkdir_p("/tmp/test-exec-bindpaths", 0755) >= 0);
 181         assert_se(mkdir_p("/tmp/test-exec-bindreadonlypaths", 0755) >= 0);
 182
 183         test(__func__, m, "exec-bindpaths.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 184
 185         (void) rm_rf("/tmp/test-exec-bindpaths", REMOVE_ROOT|REMOVE_PHYSICAL);
 186         (void) rm_rf("/tmp/test-exec-bindreadonlypaths", REMOVE_ROOT|REMOVE_PHYSICAL);
 187 }
 188
 189 static void test_exec_cpuaffinity(Manager *m) {
 190         _cleanup_(cpu_set_reset) CPUSet c = {};
 191
 192         assert_se(cpu_set_realloc(&c, 8192) >= 0); /* just allocate the maximum possible size */
 193         assert_se(sched_getaffinity(0, c.allocated, c.set) >= 0);
 194
 195         if (!CPU_ISSET_S(0, c.allocated, c.set)) {
 196                 log_notice("Cannot use CPU 0, skipping %s", __func__);
 197                 return;
 198         }
 199
 200         test(__func__, m, "exec-cpuaffinity1.service", 0, CLD_EXITED);
 201         test(__func__, m, "exec-cpuaffinity2.service", 0, CLD_EXITED);
 202
 203         if (!CPU_ISSET_S(1, c.allocated, c.set) ||
 204             !CPU_ISSET_S(2, c.allocated, c.set)) {
 205                 log_notice("Cannot use CPU 1 or 2, skipping remaining tests in %s", __func__);
 206                 return;
 207         }
 208
 209         test(__func__, m, "exec-cpuaffinity3.service", 0, CLD_EXITED);
 210 }
 211
 212 static void test_exec_workingdirectory(Manager *m) {
 213         assert_se(mkdir_p("/tmp/test-exec_workingdirectory", 0755) >= 0);
 214
 215         test(__func__, m, "exec-workingdirectory.service", 0, CLD_EXITED);
 216         test(__func__, m, "exec-workingdirectory-trailing-dot.service", 0, CLD_EXITED);
 217
 218         (void) rm_rf("/tmp/test-exec_workingdirectory", REMOVE_ROOT|REMOVE_PHYSICAL);
 219 }
 220
 221 static void test_exec_personality(Manager *m) {
 222 #if defined(__x86_64__)
 223         test(__func__, m, "exec-personality-x86-64.service", 0, CLD_EXITED);
 224
 225 #elif defined(__s390__)
 226         test(__func__, m, "exec-personality-s390.service", 0, CLD_EXITED);
 227
 228 #elif defined(__powerpc64__)
 229 #  if __BYTE_ORDER == __BIG_ENDIAN
 230         test(__func__, m, "exec-personality-ppc64.service", 0, CLD_EXITED);
 231 #  else
 232         test(__func__, m, "exec-personality-ppc64le.service", 0, CLD_EXITED);
 233 #  endif
 234
 235 #elif defined(__aarch64__)
 236         test(__func__, m, "exec-personality-aarch64.service", 0, CLD_EXITED);
 237
 238 #elif defined(__i386__)
 239         test(__func__, m, "exec-personality-x86.service", 0, CLD_EXITED);
 240 #else
 241         log_notice("Unknown personality, skipping %s", __func__);
 242 #endif
 243 }
 244
 245 static void test_exec_ignoresigpipe(Manager *m) {
 246         test(__func__, m, "exec-ignoresigpipe-yes.service", 0, CLD_EXITED);
 247         test(__func__, m, "exec-ignoresigpipe-no.service", SIGPIPE, CLD_KILLED);
 248 }
 249
 250 static void test_exec_privatetmp(Manager *m) {
 251         assert_se(touch("/tmp/test-exec_privatetmp") >= 0);
 252
 253         test(__func__, m, "exec-privatetmp-yes.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 254         test(__func__, m, "exec-privatetmp-no.service", 0, CLD_EXITED);
 255
 256         unlink("/tmp/test-exec_privatetmp");
 257 }
 258
 259 static void test_exec_privatedevices(Manager *m) {
 260         int r;
 261
 262         if (detect_container() > 0) {
 263                 log_notice("Testing in container, skipping %s", __func__);
 264                 return;
 265         }
 266         if (!is_inaccessible_available()) {
 267                 log_notice("Testing without inaccessible, skipping %s", __func__);
 268                 return;
 269         }
 270
 271         test(__func__, m, "exec-privatedevices-yes.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 272         test(__func__, m, "exec-privatedevices-no.service", 0, CLD_EXITED);
 273         test(__func__, m, "exec-privatedevices-disabled-by-prefix.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 274
 275         /* We use capsh to test if the capabilities are
 276          * properly set, so be sure that it exists */
 277         r = find_binary("capsh", NULL);
 278         if (r < 0) {
 279                 log_notice_errno(r, "Could not find capsh binary, skipping remaining tests in %s: %m", __func__);
 280                 return;
 281         }
 282
 283         test(__func__, m, "exec-privatedevices-yes-capability-mknod.service", 0, CLD_EXITED);
 284         test(__func__, m, "exec-privatedevices-no-capability-mknod.service", 0, CLD_EXITED);
 285         test(__func__, m, "exec-privatedevices-yes-capability-sys-rawio.service", 0, CLD_EXITED);
 286         test(__func__, m, "exec-privatedevices-no-capability-sys-rawio.service", 0, CLD_EXITED);
 287 }
 288
 289 static void test_exec_protecthome(Manager *m) {
 290         if (!can_unshare) {
 291                 log_notice("Cannot reliably unshare, skipping %s", __func__);
 292                 return;
 293         }
 294
 295         test(__func__, m, "exec-protecthome-tmpfs-vs-protectsystem-strict.service", 0, CLD_EXITED);
 296 }
 297
 298 static void test_exec_protectkernelmodules(Manager *m) {
 299         int r;
 300
 301         if (detect_container() > 0) {
 302                 log_notice("Testing in container, skipping %s", __func__);
 303                 return;
 304         }
 305         if (!is_inaccessible_available()) {
 306                 log_notice("Testing without inaccessible, skipping %s", __func__);
 307                 return;
 308         }
 309
 310         r = find_binary("capsh", NULL);
 311         if (r < 0) {
 312                 log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
 313                 return;
 314         }
 315
 316         test(__func__, m, "exec-protectkernelmodules-no-capabilities.service", 0, CLD_EXITED);
 317         test(__func__, m, "exec-protectkernelmodules-yes-capabilities.service", 0, CLD_EXITED);
 318         test(__func__, m, "exec-protectkernelmodules-yes-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 319 }
 320
 321 static void test_exec_readonlypaths(Manager *m) {
 322
 323         test(__func__, m, "exec-readonlypaths-simple.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 324
 325         if (path_is_read_only_fs("/var") > 0) {
 326                 log_notice("Directory /var is readonly, skipping remaining tests in %s", __func__);
 327                 return;
 328         }
 329
 330         test(__func__, m, "exec-readonlypaths.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 331         test(__func__, m, "exec-readonlypaths-with-bindpaths.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 332         test(__func__, m, "exec-readonlypaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 333 }
 334
 335 static void test_exec_readwritepaths(Manager *m) {
 336
 337         if (path_is_read_only_fs("/") > 0) {
 338                 log_notice("Root directory is readonly, skipping %s", __func__);
 339                 return;
 340         }
 341
 342         test(__func__, m, "exec-readwritepaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 343 }
 344
 345 static void test_exec_inaccessiblepaths(Manager *m) {
 346
 347         if (!is_inaccessible_available()) {
 348                 log_notice("Testing without inaccessible, skipping %s", __func__);
 349                 return;
 350         }
 351
 352         test(__func__, m, "exec-inaccessiblepaths-sys.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 353
 354         if (path_is_read_only_fs("/") > 0) {
 355                 log_notice("Root directory is readonly, skipping remaining tests in %s", __func__);
 356                 return;
 357         }
 358
 359         test(__func__, m, "exec-inaccessiblepaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 360 }
 361
 362 static void test_exec_temporaryfilesystem(Manager *m) {
 363
 364         test(__func__, m, "exec-temporaryfilesystem-options.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 365         test(__func__, m, "exec-temporaryfilesystem-ro.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 366         test(__func__, m, "exec-temporaryfilesystem-rw.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 367         test(__func__, m, "exec-temporaryfilesystem-usr.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 368 }
 369
 370 static void test_exec_systemcallfilter(Manager *m) {
 371 #if HAVE_SECCOMP
 372         int r;
 373
 374         if (!is_seccomp_available()) {
 375                 log_notice("Seccomp not available, skipping %s", __func__);
 376                 return;
 377         }
 378
 379         test(__func__, m, "exec-systemcallfilter-not-failing.service", 0, CLD_EXITED);
 380         test(__func__, m, "exec-systemcallfilter-not-failing2.service", 0, CLD_EXITED);
 381         test(__func__, m, "exec-systemcallfilter-failing.service", SIGSYS, CLD_KILLED);
 382         test(__func__, m, "exec-systemcallfilter-failing2.service", SIGSYS, CLD_KILLED);
 383
 384         r = find_binary("python3", NULL);
 385         if (r < 0) {
 386                 log_notice_errno(r, "Skipping remaining tests in %s, could not find python3 binary: %m", __func__);
 387                 return;
 388         }
 389
 390         test(__func__, m, "exec-systemcallfilter-with-errno-name.service", errno_from_name("EILSEQ"), CLD_EXITED);
 391         test(__func__, m, "exec-systemcallfilter-with-errno-number.service", 255, CLD_EXITED);
 392         test(__func__, m, "exec-systemcallfilter-with-errno-multi.service", errno_from_name("EILSEQ"), CLD_EXITED);
 393 #endif
 394 }
 395
 396 static void test_exec_systemcallerrornumber(Manager *m) {
 397 #if HAVE_SECCOMP
 398         int r;
 399
 400         if (!is_seccomp_available()) {
 401                 log_notice("Seccomp not available, skipping %s", __func__);
 402                 return;
 403         }
 404
 405         r = find_binary("python3", NULL);
 406         if (r < 0) {
 407                 log_notice_errno(r, "Skipping %s, could not find python3 binary: %m", __func__);
 408                 return;
 409         }
 410
 411         test(__func__, m, "exec-systemcallerrornumber-name.service", errno_from_name("EACCES"), CLD_EXITED);
 412         test(__func__, m, "exec-systemcallerrornumber-number.service", 255, CLD_EXITED);
 413 #endif
 414 }
 415
 416 static void test_exec_restrictnamespaces(Manager *m) {
 417 #if HAVE_SECCOMP
 418         if (!is_seccomp_available()) {
 419                 log_notice("Seccomp not available, skipping %s", __func__);
 420                 return;
 421         }
 422
 423         test(__func__, m, "exec-restrictnamespaces-no.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 424         test(__func__, m, "exec-restrictnamespaces-yes.service", 1, CLD_EXITED);
 425         test(__func__, m, "exec-restrictnamespaces-mnt.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 426         test(__func__, m, "exec-restrictnamespaces-mnt-blacklist.service", 1, CLD_EXITED);
 427         test(__func__, m, "exec-restrictnamespaces-merge-and.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 428         test(__func__, m, "exec-restrictnamespaces-merge-or.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 429         test(__func__, m, "exec-restrictnamespaces-merge-all.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 430 #endif
 431 }
 432
 433 static void test_exec_systemcallfilter_system(Manager *m) {
 434 #if HAVE_SECCOMP
 435         if (!is_seccomp_available()) {
 436                 log_notice("Seccomp not available, skipping %s", __func__);
 437                 return;
 438         }
 439
 440         test(__func__, m, "exec-systemcallfilter-system-user.service", 0, CLD_EXITED);
 441
 442         if (!check_nobody_user_and_group()) {
 443                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 444                 return;
 445         }
 446
 447         if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) {
 448                 log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__);
 449                 return;
 450         }
 451
 452         test(__func__, m, "exec-systemcallfilter-system-user-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 453 #endif
 454 }
 455
 456 static void test_exec_user(Manager *m) {
 457         test(__func__, m, "exec-user.service", 0, CLD_EXITED);
 458
 459         if (!check_nobody_user_and_group()) {
 460                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 461                 return;
 462         }
 463
 464         if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) {
 465                 log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__);
 466                 return;
 467         }
 468
 469         test(__func__, m, "exec-user-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 470 }
 471
 472 static void test_exec_group(Manager *m) {
 473         test(__func__, m, "exec-group.service", 0, CLD_EXITED);
 474
 475         if (!check_nobody_user_and_group()) {
 476                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 477                 return;
 478         }
 479
 480         if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) {
 481                 log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__);
 482                 return;
 483         }
 484
 485         test(__func__, m, "exec-group-" NOBODY_GROUP_NAME ".service", 0, CLD_EXITED);
 486 }
 487
 488 static void test_exec_supplementarygroups(Manager *m) {
 489         test(__func__, m, "exec-supplementarygroups.service", 0, CLD_EXITED);
 490         test(__func__, m, "exec-supplementarygroups-single-group.service", 0, CLD_EXITED);
 491         test(__func__, m, "exec-supplementarygroups-single-group-user.service", 0, CLD_EXITED);
 492         test(__func__, m, "exec-supplementarygroups-multiple-groups-default-group-user.service", 0, CLD_EXITED);
 493         test(__func__, m, "exec-supplementarygroups-multiple-groups-withgid.service", 0, CLD_EXITED);
 494         test(__func__, m, "exec-supplementarygroups-multiple-groups-withuid.service", 0, CLD_EXITED);
 495 }
 496
 497 static void test_exec_dynamicuser(Manager *m) {
 498
 499         test(__func__, m, "exec-dynamicuser-fixeduser.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 500         if (check_user_has_group_with_same_name("adm"))
 501                 test(__func__, m, "exec-dynamicuser-fixeduser-adm.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 502         if (check_user_has_group_with_same_name("games"))
 503                 test(__func__, m, "exec-dynamicuser-fixeduser-games.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 504         test(__func__, m, "exec-dynamicuser-fixeduser-one-supplementarygroup.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 505         test(__func__, m, "exec-dynamicuser-supplementarygroups.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 506         test(__func__, m, "exec-dynamicuser-statedir.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 507
 508         (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 509         (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 510         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 511         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 512
 513         test(__func__, m, "exec-dynamicuser-statedir-migrate-step1.service", 0, CLD_EXITED);
 514         test(__func__, m, "exec-dynamicuser-statedir-migrate-step2.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 515
 516         (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 517         (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 518         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 519         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 520 }
 521
 522 static void test_exec_environment(Manager *m) {
 523         test(__func__, m, "exec-environment-no-substitute.service", 0, CLD_EXITED);
 524         test(__func__, m, "exec-environment.service", 0, CLD_EXITED);
 525         test(__func__, m, "exec-environment-multiple.service", 0, CLD_EXITED);
 526         test(__func__, m, "exec-environment-empty.service", 0, CLD_EXITED);
 527 }
 528
 529 static void test_exec_environmentfile(Manager *m) {
 530         static const char e[] =
 531                 "VAR1='word1 word2'\n"
 532                 "VAR2=word3 \n"
 533                 "# comment1\n"
 534                 "\n"
 535                 "; comment2\n"
 536                 " ; # comment3\n"
 537                 "line without an equal\n"
 538                 "VAR3='$word 5 6'\n"
 539                 "VAR4='new\nline'\n"
 540                 "VAR5=password\\with\\backslashes";
 541         int r;
 542
 543         r = write_string_file("/tmp/test-exec_environmentfile.conf", e, WRITE_STRING_FILE_CREATE);
 544         assert_se(r == 0);
 545
 546         test(__func__, m, "exec-environmentfile.service", 0, CLD_EXITED);
 547
 548         (void) unlink("/tmp/test-exec_environmentfile.conf");
 549 }
 550
 551 static void test_exec_passenvironment(Manager *m) {
 552         /* test-execute runs under MANAGER_USER which, by default, forwards all
 553          * variables present in the environment, but only those that are
 554          * present _at the time it is created_!
 555          *
 556          * So these PassEnvironment checks are still expected to work, since we
 557          * are ensuring the variables are not present at manager creation (they
 558          * are unset explicitly in main) and are only set here.
 559          *
 560          * This is still a good approximation of how a test for MANAGER_SYSTEM
 561          * would work.
 562          */
 563         assert_se(setenv("VAR1", "word1 word2", 1) == 0);
 564         assert_se(setenv("VAR2", "word3", 1) == 0);
 565         assert_se(setenv("VAR3", "$word 5 6", 1) == 0);
 566         assert_se(setenv("VAR4", "new\nline", 1) == 0);
 567         assert_se(setenv("VAR5", "passwordwithbackslashes", 1) == 0);
 568         test(__func__, m, "exec-passenvironment.service", 0, CLD_EXITED);
 569         test(__func__, m, "exec-passenvironment-repeated.service", 0, CLD_EXITED);
 570         test(__func__, m, "exec-passenvironment-empty.service", 0, CLD_EXITED);
 571         assert_se(unsetenv("VAR1") == 0);
 572         assert_se(unsetenv("VAR2") == 0);
 573         assert_se(unsetenv("VAR3") == 0);
 574         assert_se(unsetenv("VAR4") == 0);
 575         assert_se(unsetenv("VAR5") == 0);
 576         test(__func__, m, "exec-passenvironment-absent.service", 0, CLD_EXITED);
 577 }
 578
 579 static void test_exec_umask(Manager *m) {
 580         test(__func__, m, "exec-umask-default.service", 0, CLD_EXITED);
 581         test(__func__, m, "exec-umask-0177.service", 0, CLD_EXITED);
 582 }
 583
 584 static void test_exec_runtimedirectory(Manager *m) {
 585         test(__func__, m, "exec-runtimedirectory.service", 0, CLD_EXITED);
 586         test(__func__, m, "exec-runtimedirectory-mode.service", 0, CLD_EXITED);
 587         test(__func__, m, "exec-runtimedirectory-owner.service", 0, CLD_EXITED);
 588
 589         if (!check_nobody_user_and_group()) {
 590                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 591                 return;
 592         }
 593
 594         if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) {
 595                 log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__);
 596                 return;
 597         }
 598
 599         test(__func__, m, "exec-runtimedirectory-owner-" NOBODY_GROUP_NAME ".service", 0, CLD_EXITED);
 600 }
 601
 602 static void test_exec_capabilityboundingset(Manager *m) {
 603         int r;
 604
 605         r = find_binary("capsh", NULL);
 606         if (r < 0) {
 607                 log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
 608                 return;
 609         }
 610
 611         if (have_effective_cap(CAP_CHOWN) <= 0 ||
 612             have_effective_cap(CAP_FOWNER) <= 0 ||
 613             have_effective_cap(CAP_KILL) <= 0) {
 614                 log_notice("Skipping %s, this process does not have enough capabilities", __func__);
 615                 return;
 616         }
 617
 618         test(__func__, m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED);
 619         test(__func__, m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED);
 620         test(__func__, m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED);
 621         test(__func__, m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED);
 622 }
 623
 624 static void test_exec_basic(Manager *m) {
 625         test(__func__, m, "exec-basic.service", 0, CLD_EXITED);
 626 }
 627
 628 static void test_exec_ambientcapabilities(Manager *m) {
 629         int r;
 630
 631         /* Check if the kernel has support for ambient capabilities. Run
 632          * the tests only if that's the case. Clearing all ambient
 633          * capabilities is fine, since we are expecting them to be unset
 634          * in the first place for the tests. */
 635         r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
 636         if (r < 0 && IN_SET(errno, EINVAL, EOPNOTSUPP, ENOSYS)) {
 637                 log_notice("Skipping %s, the kernel does not support ambient capabilities", __func__);
 638                 return;
 639         }
 640
 641         if (have_effective_cap(CAP_CHOWN) <= 0 ||
 642             have_effective_cap(CAP_NET_RAW) <= 0) {
 643                 log_notice("Skipping %s, this process does not have enough capabilities", __func__);
 644                 return;
 645         }
 646
 647         test(__func__, m, "exec-ambientcapabilities.service", 0, CLD_EXITED);
 648         test(__func__, m, "exec-ambientcapabilities-merge.service", 0, CLD_EXITED);
 649
 650         if (!check_nobody_user_and_group()) {
 651                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 652                 return;
 653         }
 654
 655         if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) {
 656                 log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__);
 657                 return;
 658         }
 659
 660         test(__func__, m, "exec-ambientcapabilities-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 661         test(__func__, m, "exec-ambientcapabilities-merge-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 662 }
 663
 664 static void test_exec_privatenetwork(Manager *m) {
 665         int r;
 666
 667         r = find_binary("ip", NULL);
 668         if (r < 0) {
 669                 log_notice_errno(r, "Skipping %s, could not find ip binary: %m", __func__);
 670                 return;
 671         }
 672
 673         test(__func__, m, "exec-privatenetwork-yes.service", can_unshare ? 0 : EXIT_NETWORK, CLD_EXITED);
 674 }
 675
 676 static void test_exec_oomscoreadjust(Manager *m) {
 677         test(__func__, m, "exec-oomscoreadjust-positive.service", 0, CLD_EXITED);
 678
 679         if (detect_container() > 0) {
 680                 log_notice("Testing in container, skipping remaining tests in %s", __func__);
 681                 return;
 682         }
 683         test(__func__, m, "exec-oomscoreadjust-negative.service", 0, CLD_EXITED);
 684 }
 685
 686 static void test_exec_ioschedulingclass(Manager *m) {
 687         test(__func__, m, "exec-ioschedulingclass-none.service", 0, CLD_EXITED);
 688         test(__func__, m, "exec-ioschedulingclass-idle.service", 0, CLD_EXITED);
 689         test(__func__, m, "exec-ioschedulingclass-best-effort.service", 0, CLD_EXITED);
 690
 691         if (detect_container() > 0) {
 692                 log_notice("Testing in container, skipping remaining tests in %s", __func__);
 693                 return;
 694         }
 695         test(__func__, m, "exec-ioschedulingclass-realtime.service", 0, CLD_EXITED);
 696 }
 697
 698 static void test_exec_unsetenvironment(Manager *m) {
 699         test(__func__, m, "exec-unsetenvironment.service", 0, CLD_EXITED);
 700 }
 701
 702 static void test_exec_specifier(Manager *m) {
 703         test(__func__, m, "exec-specifier.service", 0, CLD_EXITED);
 704         test(__func__, m, "exec-specifier@foo-bar.service", 0, CLD_EXITED);
 705         test(__func__, m, "exec-specifier-interpolation.service", 0, CLD_EXITED);
 706 }
 707
 708 static void test_exec_standardinput(Manager *m) {
 709         test(__func__, m, "exec-standardinput-data.service", 0, CLD_EXITED);
 710         test(__func__, m, "exec-standardinput-file.service", 0, CLD_EXITED);
 711 }
 712
 713 static void test_exec_standardoutput(Manager *m) {
 714         test(__func__, m, "exec-standardoutput-file.service", 0, CLD_EXITED);
 715 }
 716
 717 static void test_exec_standardoutput_append(Manager *m) {
 718         test(__func__, m, "exec-standardoutput-append.service", 0, CLD_EXITED);
 719 }
 720
 721 typedef struct test_entry {
 722         test_function_t f;
 723         const char *name;
 724 } test_entry;
 725
 726 #define entry(x) {x, #x}
 727
 728 static int run_tests(UnitFileScope scope, const test_entry tests[], char **patterns) {
 729         const test_entry *test = NULL;
 730         _cleanup_(manager_freep) Manager *m = NULL;
 731         int r;
 732
 733         assert_se(tests);
 734
 735         r = manager_new(scope, MANAGER_TEST_RUN_BASIC, &m);
 736         if (MANAGER_SKIP_TEST(r))
 737                 return log_tests_skipped_errno(r, "manager_new");
 738         assert_se(r >= 0);
 739         assert_se(manager_startup(m, NULL, NULL) >= 0);
 740
 741         for (test = tests; test && test->f; test++)
 742                 if (strv_fnmatch_or_empty(patterns, test->name, FNM_NOESCAPE))
 743                         test->f(m);
 744                 else
 745                         log_info("Skipping %s because it does not match any pattern.", test->name);
 746
 747         return 0;
 748 }
 749
 750
 751 int main(int argc, char *argv[]) {
 752         _cleanup_(rm_rf_physical_and_freep) char *runtime_dir = NULL;
 753         _cleanup_free_ char *test_execute_path = NULL;
 754
 755         static const test_entry user_tests[] = {
 756                 entry(test_exec_basic),
 757                 entry(test_exec_ambientcapabilities),
 758                 entry(test_exec_bindpaths),
 759                 entry(test_exec_capabilityboundingset),
 760                 entry(test_exec_cpuaffinity),
 761                 entry(test_exec_environment),
 762                 entry(test_exec_environmentfile),
 763                 entry(test_exec_group),
 764                 entry(test_exec_ignoresigpipe),
 765                 entry(test_exec_inaccessiblepaths),
 766                 entry(test_exec_ioschedulingclass),
 767                 entry(test_exec_oomscoreadjust),
 768                 entry(test_exec_passenvironment),
 769                 entry(test_exec_personality),
 770                 entry(test_exec_privatedevices),
 771                 entry(test_exec_privatenetwork),
 772                 entry(test_exec_privatetmp),
 773                 entry(test_exec_protecthome),
 774                 entry(test_exec_protectkernelmodules),
 775                 entry(test_exec_readonlypaths),
 776                 entry(test_exec_readwritepaths),
 777                 entry(test_exec_restrictnamespaces),
 778                 entry(test_exec_runtimedirectory),
 779                 entry(test_exec_standardinput),
 780                 entry(test_exec_standardoutput),
 781                 entry(test_exec_standardoutput_append),
 782                 entry(test_exec_supplementarygroups),
 783                 entry(test_exec_systemcallerrornumber),
 784                 entry(test_exec_systemcallfilter),
 785                 entry(test_exec_temporaryfilesystem),
 786                 entry(test_exec_umask),
 787                 entry(test_exec_unsetenvironment),
 788                 entry(test_exec_user),
 789                 entry(test_exec_workingdirectory),
 790                 {},
 791         };
 792         static const test_entry system_tests[] = {
 793                 entry(test_exec_dynamicuser),
 794                 entry(test_exec_specifier),
 795                 entry(test_exec_systemcallfilter_system),
 796                 {},
 797         };
 798         int r;
 799
 800         test_setup_logging(LOG_DEBUG);
 801
 802 #if HAS_FEATURE_ADDRESS_SANITIZER
 803         if (is_run_on_travis_ci()) {
 804                 log_notice("Running on TravisCI under ASan, skipping, see https://github.com/systemd/systemd/issues/10696");
 805                 return EXIT_TEST_SKIP;
 806         }
 807 #endif
 808
 809         (void) unsetenv("USER");
 810         (void) unsetenv("LOGNAME");
 811         (void) unsetenv("SHELL");
 812         (void) unsetenv("HOME");
 813
 814         can_unshare = have_namespaces();
 815
 816         /* It is needed otherwise cgroup creation fails */
 817         if (getuid() != 0)
 818                 return log_tests_skipped("not root");
 819
 820         r = enter_cgroup_subroot();
 821         if (r == -ENOMEDIUM)
 822                 return log_tests_skipped("cgroupfs not available");
 823
 824         assert_se(runtime_dir = setup_fake_runtime_dir());
 825         test_execute_path = path_join(get_testdata_dir(), "test-execute");
 826         assert_se(set_unit_path(test_execute_path) >= 0);
 827
 828         /* Unset VAR1, VAR2 and VAR3 which are used in the PassEnvironment test
 829          * cases, otherwise (and if they are present in the environment),
 830          * `manager_default_environment` will copy them into the default
 831          * environment which is passed to each created job, which will make the
 832          * tests that expect those not to be present to fail.
 833          */
 834         assert_se(unsetenv("VAR1") == 0);
 835         assert_se(unsetenv("VAR2") == 0);
 836         assert_se(unsetenv("VAR3") == 0);
 837
 838         r = run_tests(UNIT_FILE_USER, user_tests, argv + 1);
 839         if (r != 0)
 840                 return r;
 841
 842         r = run_tests(UNIT_FILE_SYSTEM, system_tests, argv + 1);
 843         if (r != 0)
 844                 return r;
 845
 846 #if HAVE_SECCOMP
 847         /* The following tests are for 1beab8b0d0ff2d7d1436b52d4a0c3d56dc908962. */
 848         if (!is_seccomp_available()) {
 849                 log_notice("Seccomp not available, skipping unshare() filtered tests.");
 850                 return 0;
 851         }
 852
 853         _cleanup_hashmap_free_ Hashmap *s = NULL;
 854         assert_se(s = hashmap_new(NULL));
 855         r = seccomp_syscall_resolve_name("unshare");
 856         assert_se(r != __NR_SCMP_ERROR);
 857         assert_se(hashmap_put(s, UINT32_TO_PTR(r + 1), INT_TO_PTR(-1)) >= 0);
 858         assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EOPNOTSUPP), true) >= 0);
 859         assert_se(unshare(CLONE_NEWNS) < 0);
 860         assert_se(errno == EOPNOTSUPP);
 861
 862         can_unshare = false;
 863
 864         r = run_tests(UNIT_FILE_USER, user_tests, argv + 1);
 865         if (r != 0)
 866                 return r;
 867
 868         return run_tests(UNIT_FILE_SYSTEM, system_tests, argv + 1);
 869 #else
 870         return 0;
 871 #endif
 872 }