test/units/testsuite-07.exec-context.sh

   1 #!/usr/bin/env bash
   2 # SPDX-License-Identifier: LGPL-2.1-or-later
   3 set -eux
   4 set -o pipefail
   5
   6 # Make sure the unit's exec context matches its configuration
   7 # See: https://github.com/systemd/systemd/pull/29552
   8
   9 # Even though hidepid= was introduced in kernel 3.3, we support only
  10 # the post 5.8 implementation that allows us to apply the option per-instance,
  11 # instead of the whole namespace. To distinguish between these two implementations
  12 # lets check if we can mount procfs with a named value (e.g. hidepid=off), since
  13 # support for this was introduced in the same commit as the per-instance stuff
  14 proc_supports_option() {
  15     local option="${1:?}"
  16     local proc_tmp ec
  17
  18     proc_tmp="$(mktemp -d)"
  19     mount -t proc -o "$option" proc "$proc_tmp" && ec=0 || ec=$?
  20     mountpoint -q "$proc_tmp" && umount -q "$proc_tmp"
  21     rm -rf "$proc_tmp"
  22
  23     return $ec
  24 }
  25
  26 # In coverage builds we disable ProtectSystem= and ProtectHome= via a service.d
  27 # dropin in /etc. This dropin has, unfortunately, higher priority than
  28 # the transient stuff from systemd-run. Let's just skip the following tests
  29 # in that case instead of complicating the test setup even more */
  30 if [[ -z "${COVERAGE_BUILD_DIR:-}" ]]; then
  31     systemd-run --wait --pipe -p ProtectSystem=yes \
  32         bash -xec "test ! -w /usr; test ! -w /boot; test -w /etc; test -w /var"
  33     systemd-run --wait --pipe -p ProtectSystem=full \
  34         bash -xec "test ! -w /usr; test ! -w /boot; test ! -w /etc; test -w /var"
  35     systemd-run --wait --pipe -p ProtectSystem=strict \
  36         bash -xec "test ! -w /; test ! -w /etc; test ! -w /var; test -w /dev; test -w /proc"
  37     systemd-run --wait --pipe -p ProtectSystem=no \
  38         bash -xec "test -w /; test -w /etc; test -w /var; test -w /dev; test -w /proc"
  39
  40     MARK="$(mktemp /root/.exec-context.XXX)"
  41     systemd-run --wait --pipe -p ProtectHome=yes \
  42         bash -xec "test ! -w /home; test ! -w /root; test ! -w /run/user; test ! -e $MARK"
  43     systemd-run --wait --pipe -p ProtectHome=read-only \
  44         bash -xec "test ! -w /home; test ! -w /root; test ! -w /run/user; test -e $MARK"
  45     systemd-run --wait --pipe -p ProtectHome=tmpfs \
  46         bash -xec "test -w /home; test -w /root; test -w /run/user; test ! -e $MARK"
  47     systemd-run --wait --pipe -p ProtectHome=no \
  48         bash -xec "test -w /home; test -w /root; test -w /run/user; test -e $MARK"
  49     rm -f "$MARK"
  50 fi
  51
  52 if proc_supports_option "hidepid=off"; then
  53     systemd-run --wait --pipe -p ProtectProc=noaccess -p User=testuser \
  54         bash -xec 'test -e /proc/1; test ! -r /proc/1; test -r /proc/$$$$/comm'
  55     systemd-run --wait --pipe -p ProtectProc=invisible -p User=testuser \
  56         bash -xec 'test ! -e /proc/1; test -r /proc/$$$$/comm'
  57     systemd-run --wait --pipe -p ProtectProc=ptraceable -p User=testuser \
  58         bash -xec 'test ! -e /proc/1; test -r /proc/$$$$/comm'
  59     systemd-run --wait --pipe -p ProtectProc=ptraceable -p User=testuser -p AmbientCapabilities=CAP_SYS_PTRACE \
  60         bash -xec 'test -r /proc/1; test -r /proc/$$$$/comm'
  61     systemd-run --wait --pipe -p ProtectProc=default -p User=testuser \
  62         bash -xec 'test -r /proc/1; test -r /proc/$$$$/comm'
  63 fi
  64
  65 if proc_supports_option "subset=pid"; then
  66     systemd-run --wait --pipe -p ProcSubset=pid -p User=testuser \
  67         bash -xec "test -r /proc/1/comm; test ! -e /proc/cpuinfo"
  68     systemd-run --wait --pipe -p ProcSubset=all -p User=testuser \
  69         bash -xec "test -r /proc/1/comm; test -r /proc/cpuinfo"
  70 fi
  71
  72 if ! systemd-detect-virt -cq; then
  73     systemd-run --wait --pipe -p ProtectKernelLogs=yes -p User=testuser \
  74         bash -xec "test ! -r /dev/kmsg"
  75     systemd-run --wait --pipe -p ProtectKernelLogs=no -p User=testuser \
  76         bash -xec "test -r /dev/kmsg"
  77
  78     # Check if we correctly serialize, deserialize, and set directives that
  79     # have more complex internal handling
  80     #
  81     # Funny detail: this originally used the underlying rootfs device, but that,
  82     # for some reason, caused "divide error" in kernel, followed by a kernel panic
  83     TEMPFILE="$(mktemp)"
  84     LODEV="$(losetup --show -f "$TEMPFILE")"
  85     ROOT_DEV_MAJ_MIN="$(lsblk -nro MAJ:MIN "$LODEV")"
  86     EXPECTED_IO_MAX="$ROOT_DEV_MAJ_MIN rbps=1000 wbps=1000000000000 riops=2000000000 wiops=4000"
  87     EXPECTED_IO_LATENCY="$ROOT_DEV_MAJ_MIN target=69000"
  88     SERVICE_NAME="test-io-directives-$RANDOM.service"
  89     CGROUP_PATH="/sys/fs/cgroup/system.slice/$SERVICE_NAME"
  90
  91     # IO*=
  92     ARGUMENTS=(
  93         # Throw in a couple of invalid entries just to test things out
  94         -p IOReadBandwidthMax="/foo/bar 1M"
  95         -p IOReadBandwidthMax="/foo/baz 1M"
  96         -p IOReadBandwidthMax="$LODEV 1M"
  97         -p IOReadBandwidthMax="$LODEV 1K"
  98         -p IOWriteBandwidthMax="$LODEV 1G"
  99         -p IOWriteBandwidthMax="$LODEV 1T"
 100         -p IOReadIOPSMax="$LODEV 2G"
 101         -p IOWriteIOPSMax="$LODEV 4K"
 102         -p IODeviceLatencyTargetSec="$LODEV 666ms"
 103         -p IODeviceLatencyTargetSec="/foo/bar 69ms"
 104         -p IODeviceLatencyTargetSec="$LODEV 69ms"
 105         -p IOReadBandwidthMax="/foo/bar 1M"
 106         -p IOReadBandwidthMax="/foo/baz 1M"
 107         # TODO: IODeviceWeight= doesn't work on loop devices and virtual disks
 108         -p IODeviceWeight="$LODEV 999"
 109         -p IODeviceWeight="/foo/bar 999"
 110     )
 111
 112     # io.latency not available by default on Debian stable
 113     if [ -e /sys/fs/cgroup/system.slice/io.latency ]; then
 114         systemd-run --wait --pipe --unit "$SERVICE_NAME" "${ARGUMENTS[@]}" \
 115             bash -xec "diff <(echo $EXPECTED_IO_MAX) $CGROUP_PATH/io.max; diff <(echo $EXPECTED_IO_LATENCY) $CGROUP_PATH/io.latency"
 116     fi
 117
 118     # CPUScheduling=
 119     ARGUMENTS=(
 120         -p CPUSchedulingPolicy=rr   # ID: 2
 121         -p CPUSchedulingPolicy=fifo # ID: 1
 122         -p CPUSchedulingPriority=5  # Actual prio: 94 (99 - prio)
 123         -p CPUSchedulingPriority=10 # Actual prio: 89 (99 - prio)
 124     )
 125
 126     systemd-run --wait --pipe --unit "$SERVICE_NAME" "${ARGUMENTS[@]}" \
 127         bash -xec 'grep -E "^policy\s*:\s*1$" /proc/self/sched; grep -E "^prio\s*:\s*89$" /proc/self/sched'
 128
 129     # Device*=
 130     ARGUMENTS=(
 131         -p DevicePolicy=closed
 132         -p DevicePolicy=strict
 133         -p DeviceAllow="char-mem rm"  # Allow read & mknod for /dev/{null,zero,...}
 134         -p DeviceAllow="/dev/loop0 rw"
 135         -p DeviceAllow="/dev/loop0 w" # Allow write for /dev/loop0
 136         # Everything else should be disallowed per the strict policy
 137     )
 138
 139     systemd-run --wait --pipe --unit "$SERVICE_NAME" "${ARGUMENTS[@]}" \
 140         bash -xec 'test -r /dev/null; test ! -w /dev/null; test ! -r /dev/loop0; test -w /dev/loop0; test ! -r /dev/tty; test ! -w /dev/tty'
 141
 142     # SocketBind*=
 143     ARGUMENTS=(
 144         -p SocketBindAllow=
 145         -p SocketBindAllow=1234
 146         -p SocketBindAllow=ipv4:udp:any
 147         -p SocketBindAllow=ipv6:6666
 148         # Everything but the last assignment is superfluous, but it still exercises
 149         # the parsing machinery
 150         -p SocketBindDeny=
 151         -p SocketBindDeny=1111
 152         -p SocketBindDeny=ipv4:1111
 153         -p SocketBindDeny=ipv4:any
 154         -p SocketBindDeny=ipv4:tcp:any
 155         -p SocketBindDeny=ipv4:udp:10000-11000
 156         -p SocketBindDeny=ipv6:1111
 157         -p SocketBindDeny=any
 158     )
 159
 160     # We should fail with EPERM when trying to bind to a socket not on the allow list
 161     # (nc exits with 2 in that case)
 162     systemd-run --wait -p SuccessExitStatus="1 2" --pipe "${ARGUMENTS[@]}" \
 163         bash -xec 'timeout 1s nc -l 127.0.0.1 9999; exit 42'
 164     systemd-run --wait -p SuccessExitStatus="1 2" --pipe "${ARGUMENTS[@]}" \
 165         bash -xec 'timeout 1s nc -l ::1 9999; exit 42'
 166     systemd-run --wait -p SuccessExitStatus="1 2" --pipe "${ARGUMENTS[@]}" \
 167         bash -xec 'timeout 1s nc -6 -u -l ::1 9999; exit 42'
 168     systemd-run --wait -p SuccessExitStatus="1 2" --pipe "${ARGUMENTS[@]}" \
 169         bash -xec 'timeout 1s nc -4 -l 127.0.0.1 6666; exit 42'
 170     # Consequently, we should succeed when binding to a socket on the allow list
 171     # and keep listening on it until we're killed by `timeout` (EC 124)
 172     systemd-run --wait --pipe -p SuccessExitStatus=124 "${ARGUMENTS[@]}" \
 173         bash -xec 'timeout 1s nc -4 -l 127.0.0.1 1234; exit 1'
 174     systemd-run --wait --pipe -p SuccessExitStatus=124 "${ARGUMENTS[@]}" \
 175         bash -xec 'timeout 1s nc -4 -u -l 127.0.0.1 5678; exit 1'
 176     systemd-run --wait --pipe -p SuccessExitStatus=124 "${ARGUMENTS[@]}" \
 177         bash -xec 'timeout 1s nc -6 -l ::1 1234; exit 1'
 178     systemd-run --wait --pipe -p SuccessExitStatus=124 "${ARGUMENTS[@]}" \
 179         bash -xec 'timeout 1s nc -6 -l ::1 6666; exit 1'
 180
 181     losetup -d "$LODEV"
 182     rm -f "$TEMPFILE"
 183 fi
 184
 185 systemd-run --wait --pipe -p BindPaths="/etc /home:/mnt:norbind -/foo/bar/baz:/usr:rbind" \
 186     bash -xec "mountpoint /etc; test -d /etc/systemd; mountpoint /mnt; ! mountpoint /usr"
 187 systemd-run --wait --pipe -p BindReadOnlyPaths="/etc /home:/mnt:norbind -/foo/bar/baz:/usr:rbind" \
 188     bash -xec "test ! -w /etc; test ! -w /mnt; ! mountpoint /usr"
 189
 190 # Ensure that clean-up codepaths work correctly if activation ultimately fails
 191 (! systemd-run --wait --pipe -p DynamicUser=yes -p WorkingDirectory=/nonexistent echo hello)