test/units/testsuite-43.sh

   1 #!/usr/bin/env bash
   2 # SPDX-License-Identifier: LGPL-2.1-or-later
   3 set -eux
   4 set -o pipefail
   5
   6 systemd-analyze log-level debug
   7
   8 runas() {
   9     declare userid=$1
  10     shift
  11     # shellcheck disable=SC2016
  12     su "$userid" -s /bin/sh -c 'XDG_RUNTIME_DIR=/run/user/$UID exec "$@"' -- sh "$@"
  13 }
  14
  15 runas testuser systemd-run --wait --user --unit=test-private-users \
  16     -p PrivateUsers=yes -P echo hello
  17
  18 runas testuser systemd-run --wait --user --unit=test-private-tmp-innerfile \
  19     -p PrivateUsers=yes -p PrivateTmp=yes \
  20     -P touch /tmp/innerfile.txt
  21 # File should not exist outside the job's tmp directory.
  22 test ! -e /tmp/innerfile.txt
  23
  24 touch /tmp/outerfile.txt
  25 # File should not appear in unit's private tmp.
  26 runas testuser systemd-run --wait --user --unit=test-private-tmp-outerfile \
  27     -p PrivateUsers=yes -p PrivateTmp=yes \
  28     -P test ! -e /tmp/outerfile.txt
  29
  30 # Confirm that creating a file in home works
  31 runas testuser systemd-run --wait --user --unit=test-unprotected-home \
  32     -P touch /home/testuser/works.txt
  33 test -e /home/testuser/works.txt
  34
  35 # Confirm that creating a file in home is blocked under read-only
  36 runas testuser systemd-run --wait --user --unit=test-protect-home-read-only \
  37     -p PrivateUsers=yes -p ProtectHome=read-only \
  38     -P bash -c '
  39         test -e /home/testuser/works.txt || exit 10
  40         touch /home/testuser/blocked.txt && exit 11
  41     ' \
  42         && { echo 'unexpected success'; exit 1; }
  43 test ! -e /home/testuser/blocked.txt
  44
  45 # Check that tmpfs hides the whole directory
  46 runas testuser systemd-run --wait --user --unit=test-protect-home-tmpfs \
  47     -p PrivateUsers=yes -p ProtectHome=tmpfs \
  48     -P test ! -e /home/testuser
  49
  50 # Confirm that home, /root, and /run/user are inaccessible under "yes"
  51 # shellcheck disable=SC2016
  52 runas testuser systemd-run --wait --user --unit=test-protect-home-yes \
  53     -p PrivateUsers=yes -p ProtectHome=yes \
  54     -P bash -c '
  55         test "$(stat -c %a /home)" = "0"
  56         test "$(stat -c %a /root)" = "0"
  57         test "$(stat -c %a /run/user)" = "0"
  58     '
  59
  60 # Confirm we cannot change groups because we only have one mapping in the user
  61 # namespace (no CAP_SETGID in the parent namespace to write the additional
  62 # mapping of the user supplied group and thus cannot change groups to an
  63 # unmapped group ID)
  64 runas testuser systemd-run --wait --user --unit=test-group-fail \
  65     -p PrivateUsers=yes -p Group=daemon \
  66     -P true \
  67     && { echo 'unexpected success'; exit 1; }
  68
  69 systemd-analyze log-level info
  70
  71 echo OK >/testok
  72
  73 exit 0