src/test/test-execute.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2014 Ronny Chevalier
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <grp.h>
  21 #include <pwd.h>
  22 #include <stdio.h>
  23 #include <sys/prctl.h>
  24 #include <sys/types.h>
  25
  26 #include "fileio.h"
  27 #include "fs-util.h"
  28 #include "macro.h"
  29 #include "manager.h"
  30 #include "mkdir.h"
  31 #include "path-util.h"
  32 #include "rm-rf.h"
  33 #include "test-helper.h"
  34 #include "unit.h"
  35 #include "util.h"
  36
  37 typedef void (*test_function_t)(Manager *m);
  38
  39 static void check(Manager *m, Unit *unit, int status_expected, int code_expected) {
  40         Service *service = NULL;
  41         usec_t ts;
  42         usec_t timeout = 2 * USEC_PER_SEC;
  43
  44         assert_se(m);
  45         assert_se(unit);
  46
  47         service = SERVICE(unit);
  48         printf("%s\n", unit->id);
  49         exec_context_dump(&service->exec_context, stdout, "\t");
  50         ts = now(CLOCK_MONOTONIC);
  51         while (service->state != SERVICE_DEAD && service->state != SERVICE_FAILED) {
  52                 int r;
  53                 usec_t n;
  54
  55                 r = sd_event_run(m->event, 100 * USEC_PER_MSEC);
  56                 assert_se(r >= 0);
  57
  58                 n = now(CLOCK_MONOTONIC);
  59                 if (ts + timeout < n) {
  60                         log_error("Test timeout when testing %s", unit->id);
  61                         exit(EXIT_FAILURE);
  62                 }
  63         }
  64         exec_status_dump(&service->main_exec_status, stdout, "\t");
  65         assert_se(service->main_exec_status.status == status_expected);
  66         assert_se(service->main_exec_status.code == code_expected);
  67 }
  68
  69 static void test(Manager *m, const char *unit_name, int status_expected, int code_expected) {
  70         Unit *unit;
  71
  72         assert_se(unit_name);
  73
  74         assert_se(manager_load_unit(m, unit_name, NULL, NULL, &unit) >= 0);
  75         assert_se(UNIT_VTABLE(unit)->start(unit) >= 0);
  76         check(m, unit, status_expected, code_expected);
  77 }
  78
  79 static void test_exec_workingdirectory(Manager *m) {
  80         assert_se(mkdir_p("/tmp/test-exec_workingdirectory", 0755) >= 0);
  81
  82         test(m, "exec-workingdirectory.service", 0, CLD_EXITED);
  83
  84         (void) rm_rf("/tmp/test-exec_workingdirectory", REMOVE_ROOT|REMOVE_PHYSICAL);
  85 }
  86
  87 static void test_exec_personality(Manager *m) {
  88 #if defined(__x86_64__)
  89         test(m, "exec-personality-x86-64.service", 0, CLD_EXITED);
  90
  91 #elif defined(__s390__)
  92         test(m, "exec-personality-s390.service", 0, CLD_EXITED);
  93
  94 #elif defined(__i386__)
  95         test(m, "exec-personality-x86.service", 0, CLD_EXITED);
  96 #endif
  97 }
  98
  99 static void test_exec_ignoresigpipe(Manager *m) {
 100         test(m, "exec-ignoresigpipe-yes.service", 0, CLD_EXITED);
 101         test(m, "exec-ignoresigpipe-no.service", SIGPIPE, CLD_KILLED);
 102 }
 103
 104 static void test_exec_privatetmp(Manager *m) {
 105         assert_se(touch("/tmp/test-exec_privatetmp") >= 0);
 106
 107         test(m, "exec-privatetmp-yes.service", 0, CLD_EXITED);
 108         test(m, "exec-privatetmp-no.service", 0, CLD_EXITED);
 109
 110         unlink("/tmp/test-exec_privatetmp");
 111 }
 112
 113 static void test_exec_privatedevices(Manager *m) {
 114         test(m, "exec-privatedevices-yes.service", 0, CLD_EXITED);
 115         test(m, "exec-privatedevices-no.service", 0, CLD_EXITED);
 116 }
 117
 118 static void test_exec_systemcallfilter(Manager *m) {
 119 #ifdef HAVE_SECCOMP
 120         test(m, "exec-systemcallfilter-not-failing.service", 0, CLD_EXITED);
 121         test(m, "exec-systemcallfilter-not-failing2.service", 0, CLD_EXITED);
 122         test(m, "exec-systemcallfilter-failing.service", SIGSYS, CLD_KILLED);
 123         test(m, "exec-systemcallfilter-failing2.service", SIGSYS, CLD_KILLED);
 124 #endif
 125 }
 126
 127 static void test_exec_systemcallerrornumber(Manager *m) {
 128 #ifdef HAVE_SECCOMP
 129         test(m, "exec-systemcallerrornumber.service", 1, CLD_EXITED);
 130 #endif
 131 }
 132
 133 static void test_exec_systemcall_system_mode_with_user(Manager *m) {
 134 #ifdef HAVE_SECCOMP
 135         if (getpwnam("nobody"))
 136                 test(m, "exec-systemcallfilter-system-user.service", 0, CLD_EXITED);
 137         else if (getpwnam("nfsnobody"))
 138                 test(m, "exec-systemcallfilter-system-user-nfsnobody.service", 0, CLD_EXITED);
 139         else
 140                 log_error_errno(errno, "Skipping test_exec_systemcall_system_mode_with_user, could not find nobody/nfsnobody user: %m");
 141 #endif
 142 }
 143
 144 static void test_exec_user(Manager *m) {
 145         if (getpwnam("nobody"))
 146                 test(m, "exec-user.service", 0, CLD_EXITED);
 147         else if (getpwnam("nfsnobody"))
 148                 test(m, "exec-user-nfsnobody.service", 0, CLD_EXITED);
 149         else
 150                 log_error_errno(errno, "Skipping test_exec_user, could not find nobody/nfsnobody user: %m");
 151 }
 152
 153 static void test_exec_group(Manager *m) {
 154         if (getgrnam("nobody"))
 155                 test(m, "exec-group.service", 0, CLD_EXITED);
 156         else if (getgrnam("nfsnobody"))
 157                 test(m, "exec-group-nfsnobody.service", 0, CLD_EXITED);
 158         else
 159                 log_error_errno(errno, "Skipping test_exec_group, could not find nobody/nfsnobody group: %m");
 160 }
 161
 162 static void test_exec_environment(Manager *m) {
 163         test(m, "exec-environment.service", 0, CLD_EXITED);
 164         test(m, "exec-environment-multiple.service", 0, CLD_EXITED);
 165         test(m, "exec-environment-empty.service", 0, CLD_EXITED);
 166 }
 167
 168 static void test_exec_environmentfile(Manager *m) {
 169         static const char e[] =
 170                 "VAR1='word1 word2'\n"
 171                 "VAR2=word3 \n"
 172                 "# comment1\n"
 173                 "\n"
 174                 "; comment2\n"
 175                 " ; # comment3\n"
 176                 "line without an equal\n"
 177                 "VAR3='$word 5 6'\n";
 178         int r;
 179
 180         r = write_string_file("/tmp/test-exec_environmentfile.conf", e, WRITE_STRING_FILE_CREATE);
 181         assert_se(r == 0);
 182
 183         test(m, "exec-environmentfile.service", 0, CLD_EXITED);
 184
 185         unlink("/tmp/test-exec_environmentfile.conf");
 186 }
 187
 188 static void test_exec_passenvironment(Manager *m) {
 189         /* test-execute runs under MANAGER_USER which, by default, forwards all
 190          * variables present in the environment, but only those that are
 191          * present _at the time it is created_!
 192          *
 193          * So these PassEnvironment checks are still expected to work, since we
 194          * are ensuring the variables are not present at manager creation (they
 195          * are unset explicitly in main) and are only set here.
 196          *
 197          * This is still a good approximation of how a test for MANAGER_SYSTEM
 198          * would work.
 199          */
 200         assert_se(setenv("VAR1", "word1 word2", 1) == 0);
 201         assert_se(setenv("VAR2", "word3", 1) == 0);
 202         assert_se(setenv("VAR3", "$word 5 6", 1) == 0);
 203         test(m, "exec-passenvironment.service", 0, CLD_EXITED);
 204         test(m, "exec-passenvironment-repeated.service", 0, CLD_EXITED);
 205         test(m, "exec-passenvironment-empty.service", 0, CLD_EXITED);
 206         assert_se(unsetenv("VAR1") == 0);
 207         assert_se(unsetenv("VAR2") == 0);
 208         assert_se(unsetenv("VAR3") == 0);
 209         test(m, "exec-passenvironment-absent.service", 0, CLD_EXITED);
 210 }
 211
 212 static void test_exec_umask(Manager *m) {
 213         test(m, "exec-umask-default.service", 0, CLD_EXITED);
 214         test(m, "exec-umask-0177.service", 0, CLD_EXITED);
 215 }
 216
 217 static void test_exec_runtimedirectory(Manager *m) {
 218         test(m, "exec-runtimedirectory.service", 0, CLD_EXITED);
 219         test(m, "exec-runtimedirectory-mode.service", 0, CLD_EXITED);
 220         if (getgrnam("nobody"))
 221                 test(m, "exec-runtimedirectory-owner.service", 0, CLD_EXITED);
 222         else if (getgrnam("nfsnobody"))
 223                 test(m, "exec-runtimedirectory-owner-nfsnobody.service", 0, CLD_EXITED);
 224         else
 225                 log_error_errno(errno, "Skipping test_exec_runtimedirectory-owner, could not find nobody/nfsnobody group: %m");
 226 }
 227
 228 static void test_exec_capabilityboundingset(Manager *m) {
 229         int r;
 230
 231         /* We use capsh to test if the capabilities are
 232          * properly set, so be sure that it exists */
 233         r = find_binary("capsh", NULL);
 234         if (r < 0) {
 235                 log_error_errno(r, "Skipping test_exec_capabilityboundingset, could not find capsh binary: %m");
 236                 return;
 237         }
 238
 239         test(m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED);
 240         test(m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED);
 241         test(m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED);
 242         test(m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED);
 243 }
 244
 245 static void test_exec_capabilityambientset(Manager *m) {
 246         int r;
 247
 248         /* Check if the kernel has support for ambient capabilities. Run
 249          * the tests only if that's the case. Clearing all ambient
 250          * capabilities is fine, since we are expecting them to be unset
 251          * in the first place for the tests. */
 252         r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
 253         if (r >= 0 || errno != EINVAL) {
 254                 if (getpwnam("nobody")) {
 255                         test(m, "exec-capabilityambientset.service", 0, CLD_EXITED);
 256                         test(m, "exec-capabilityambientset-merge.service", 0, CLD_EXITED);
 257                 } else if (getpwnam("nfsnobody")) {
 258                         test(m, "exec-capabilityambientset-nfsnobody.service", 0, CLD_EXITED);
 259                         test(m, "exec-capabilityambientset-merge-nfsnobody.service", 0, CLD_EXITED);
 260                 } else
 261                         log_error_errno(errno, "Skipping test_exec_capabilityambientset, could not find nobody/nfsnobody user: %m");
 262         } else
 263                 log_error_errno(errno, "Skipping test_exec_capabilityambientset, the kernel does not support ambient capabilities: %m");
 264 }
 265
 266 static void test_exec_privatenetwork(Manager *m) {
 267         int r;
 268
 269         r = find_binary("ip", NULL);
 270         if (r < 0) {
 271                 log_error_errno(r, "Skipping test_exec_privatenetwork, could not find ip binary: %m");
 272                 return;
 273         }
 274
 275         test(m, "exec-privatenetwork-yes.service", 0, CLD_EXITED);
 276 }
 277
 278 static void test_exec_oomscoreadjust(Manager *m) {
 279         test(m, "exec-oomscoreadjust-positive.service", 0, CLD_EXITED);
 280         test(m, "exec-oomscoreadjust-negative.service", 0, CLD_EXITED);
 281 }
 282
 283 static void test_exec_ioschedulingclass(Manager *m) {
 284         test(m, "exec-ioschedulingclass-none.service", 0, CLD_EXITED);
 285         test(m, "exec-ioschedulingclass-idle.service", 0, CLD_EXITED);
 286         test(m, "exec-ioschedulingclass-realtime.service", 0, CLD_EXITED);
 287         test(m, "exec-ioschedulingclass-best-effort.service", 0, CLD_EXITED);
 288 }
 289
 290 static void test_exec_spec_interpolation(Manager *m) {
 291         test(m, "exec-spec-interpolation.service", 0, CLD_EXITED);
 292 }
 293
 294 static int run_tests(UnitFileScope scope, test_function_t *tests) {
 295         test_function_t *test = NULL;
 296         Manager *m = NULL;
 297         int r;
 298
 299         assert_se(tests);
 300
 301         r = manager_new(scope, true, &m);
 302         if (MANAGER_SKIP_TEST(r)) {
 303                 printf("Skipping test: manager_new: %s\n", strerror(-r));
 304                 return EXIT_TEST_SKIP;
 305         }
 306         assert_se(r >= 0);
 307         assert_se(manager_startup(m, NULL, NULL) >= 0);
 308
 309         for (test = tests; test && *test; test++)
 310                 (*test)(m);
 311
 312         manager_free(m);
 313
 314         return 0;
 315 }
 316
 317 int main(int argc, char *argv[]) {
 318         test_function_t user_tests[] = {
 319                 test_exec_workingdirectory,
 320                 test_exec_personality,
 321                 test_exec_ignoresigpipe,
 322                 test_exec_privatetmp,
 323                 test_exec_privatedevices,
 324                 test_exec_privatenetwork,
 325                 test_exec_systemcallfilter,
 326                 test_exec_systemcallerrornumber,
 327                 test_exec_user,
 328                 test_exec_group,
 329                 test_exec_environment,
 330                 test_exec_environmentfile,
 331                 test_exec_passenvironment,
 332                 test_exec_umask,
 333                 test_exec_runtimedirectory,
 334                 test_exec_capabilityboundingset,
 335                 test_exec_capabilityambientset,
 336                 test_exec_oomscoreadjust,
 337                 test_exec_ioschedulingclass,
 338                 test_exec_spec_interpolation,
 339                 NULL,
 340         };
 341         test_function_t system_tests[] = {
 342                 test_exec_systemcall_system_mode_with_user,
 343                 NULL,
 344         };
 345         int r;
 346
 347         log_parse_environment();
 348         log_open();
 349
 350         /* It is needed otherwise cgroup creation fails */
 351         if (getuid() != 0) {
 352                 printf("Skipping test: not root\n");
 353                 return EXIT_TEST_SKIP;
 354         }
 355
 356         assert_se(setenv("XDG_RUNTIME_DIR", "/tmp/", 1) == 0);
 357         assert_se(set_unit_path(TEST_DIR "/test-execute/") >= 0);
 358
 359         /* Unset VAR1, VAR2 and VAR3 which are used in the PassEnvironment test
 360          * cases, otherwise (and if they are present in the environment),
 361          * `manager_default_environment` will copy them into the default
 362          * environment which is passed to each created job, which will make the
 363          * tests that expect those not to be present to fail.
 364          */
 365         assert_se(unsetenv("VAR1") == 0);
 366         assert_se(unsetenv("VAR2") == 0);
 367         assert_se(unsetenv("VAR3") == 0);
 368
 369         r = run_tests(UNIT_FILE_USER, user_tests);
 370         if (r != 0)
 371                 return r;
 372
 373         return run_tests(UNIT_FILE_SYSTEM, system_tests);
 374 }