test/units/testsuite-65.sh

   1 #!/usr/bin/env bash
   2 # SPDX-License-Identifier: LGPL-2.1-or-later
   3 # shellcheck disable=SC2016
   4 set -eux
   5
   6 # shellcheck source=test/units/assert.sh
   7 . "$(dirname "$0")"/assert.sh
   8
   9 systemctl log-level debug
  10 export SYSTEMD_LOG_LEVEL=debug
  11
  12 # Sanity checks
  13 #
  14 # We can't really test time, critical-chain and plot verbs here, as
  15 # the testsuite service is a part of the boot transaction, so let's assume
  16 # they fail
  17 systemd-analyze || :
  18 systemd-analyze time || :
  19 systemd-analyze critical-chain || :
  20 # blame
  21 systemd-analyze blame
  22 systemd-run --wait --user --pipe -M testuser@.host systemd-analyze blame
  23 # plot
  24 systemd-analyze plot >/dev/null || :
  25 systemd-analyze plot --json=pretty >/dev/null || :
  26 systemd-analyze plot --json=short >/dev/null || :
  27 systemd-analyze plot --json=off >/dev/null || :
  28 systemd-analyze plot --json=pretty --no-legend >/dev/null || :
  29 systemd-analyze plot --json=short --no-legend >/dev/null || :
  30 systemd-analyze plot --json=off --no-legend >/dev/null || :
  31 systemd-analyze plot --table >/dev/null || :
  32 systemd-analyze plot --table --no-legend >/dev/null || :
  33 # legacy/deprecated options (moved to systemctl, but still usable from analyze)
  34 systemd-analyze log-level
  35 systemd-analyze log-level "$(systemctl log-level)"
  36 systemd-analyze get-log-level
  37 systemd-analyze set-log-level "$(systemctl log-level)"
  38 systemd-analyze log-target
  39 systemd-analyze log-target "$(systemctl log-target)"
  40 systemd-analyze get-log-target
  41 systemd-analyze set-log-target "$(systemctl log-target)"
  42 systemd-analyze service-watchdogs
  43 systemd-analyze service-watchdogs "$(systemctl service-watchdogs)"
  44 # dot
  45 systemd-analyze dot >/dev/null
  46 systemd-analyze dot systemd-journald.service >/dev/null
  47 systemd-analyze dot systemd-journald.service systemd-logind.service >/dev/null
  48 systemd-analyze dot --from-pattern="*" --from-pattern="*.service" systemd-journald.service >/dev/null
  49 systemd-analyze dot --to-pattern="*" --to-pattern="*.service" systemd-journald.service >/dev/null
  50 systemd-analyze dot --from-pattern="*.service" --to-pattern="*.service" systemd-journald.service >/dev/null
  51 systemd-analyze dot --order systemd-journald.service systemd-logind.service >/dev/null
  52 systemd-analyze dot --require systemd-journald.service systemd-logind.service >/dev/null
  53 systemd-analyze dot "systemd-*.service" >/dev/null
  54 (! systemd-analyze dot systemd-journald.service systemd-logind.service "*" bbb ccc)
  55 # dump
  56 systemd-analyze dump >/dev/null
  57 systemd-analyze dump "*" >/dev/null
  58 systemd-analyze dump "*.socket" >/dev/null
  59 systemd-analyze dump "*.socket" "*.service" aaaaaaa ... >/dev/null
  60 systemd-analyze dump systemd-journald.service >/dev/null
  61 systemd-analyze malloc >/dev/null
  62 (! systemd-analyze dump "")
  63 # unit-files
  64 systemd-analyze unit-files >/dev/null
  65 systemd-analyze unit-files systemd-journald.service >/dev/null
  66 systemd-analyze unit-files "*" >/dev/null
  67 systemd-analyze unit-files "*" aaaaaa "*.service" "*.target" >/dev/null
  68 systemd-analyze unit-files --user >/dev/null
  69 systemd-analyze unit-files --user "*" aaaaaa "*.service" "*.target" >/dev/null
  70 # unit-paths
  71 systemd-analyze unit-paths
  72 systemd-analyze unit-paths --user
  73 systemd-analyze unit-paths --global
  74 # exist-status
  75 systemd-analyze exit-status
  76 systemd-analyze exit-status STDOUT BPF
  77 systemd-analyze exit-status 0 1 {63..65}
  78 (! systemd-analyze exit-status STDOUT BPF "hello*")
  79 # capability
  80 systemd-analyze capability
  81 systemd-analyze capability cap_chown CAP_KILL
  82 systemd-analyze capability 0 1 {30..32}
  83 (! systemd-analyze capability cap_chown CAP_KILL "hello*")
  84 # condition
  85 mkdir -p /run/systemd/system
  86 UNIT_NAME="analyze-condition-$RANDOM.service"
  87 cat >"/run/systemd/system/$UNIT_NAME" <<EOF
  88 [Unit]
  89 AssertPathExists=/etc/os-release
  90 AssertEnvironment=!FOOBAR
  91 ConditionKernelVersion=>1.0
  92 ConditionPathExists=/etc/os-release
  93
  94 [Service]
  95 ExecStart=/bin/true
  96 EOF
  97 systemctl daemon-reload
  98 systemd-analyze condition --unit="$UNIT_NAME"
  99 systemd-analyze condition 'ConditionKernelVersion = ! <4.0' \
 100                           'ConditionKernelVersion = >=3.1' \
 101                           'ConditionACPower=|false' \
 102                           'ConditionArchitecture=|!arm' \
 103                           'AssertPathExists=/etc/os-release'
 104 (! systemd-analyze condition 'ConditionArchitecture=|!arm' 'AssertXYZ=foo')
 105 (! systemd-analyze condition 'ConditionKernelVersion=<1.0')
 106 (! systemd-analyze condition 'AssertKernelVersion=<1.0')
 107 # syscall-filter
 108 systemd-analyze syscall-filter >/dev/null
 109 systemd-analyze syscall-filter @chown @sync
 110 systemd-analyze syscall-filter @sync @sync @sync
 111 (! systemd-analyze syscall-filter @chown @sync @foobar)
 112 # filesystems (requires libbpf support)
 113 if systemctl --version | grep "+BPF_FRAMEWORK"; then
 114     systemd-analyze filesystems >/dev/null
 115     systemd-analyze filesystems @basic-api
 116     systemd-analyze filesystems @basic-api @basic-api @basic-api
 117     (! systemd-analyze filesystems @basic-api @basic-api @foobar @basic-api)
 118 fi
 119 # calendar
 120 systemd-analyze calendar '*-2-29 0:0:0'
 121 systemd-analyze calendar --iterations=5 '*-2-29 0:0:0'
 122 systemd-analyze calendar '*-* *:*:*'
 123 systemd-analyze calendar --iterations=5 '*-* *:*:*'
 124 systemd-analyze calendar --iterations=50 '*-* *:*:*'
 125 systemd-analyze calendar --iterations=0 '*-* *:*:*'
 126 systemd-analyze calendar --iterations=5 '01-01-22 01:00:00'
 127 systemd-analyze calendar --base-time=yesterday --iterations=5 '*-* *:*:*'
 128 (! systemd-analyze calendar --iterations=0 '*-* 99:*:*')
 129 (! systemd-analyze calendar --base-time=never '*-* *:*:*')
 130 (! systemd-analyze calendar 1)
 131 (! systemd-analyze calendar "")
 132 # timestamp
 133 systemd-analyze timestamp now
 134 systemd-analyze timestamp -- -1
 135 systemd-analyze timestamp yesterday now tomorrow
 136 (! systemd-analyze timestamp yesterday never tomorrow)
 137 (! systemd-analyze timestamp 1)
 138 (! systemd-analyze timestamp '*-2-29 0:0:0')
 139 (! systemd-analyze timestamp "")
 140 # timespan
 141 systemd-analyze timespan 1
 142 systemd-analyze timespan 1s 300s '1year 0.000001s'
 143 (! systemd-analyze timespan 1s 300s aaaaaa '1year 0.000001s')
 144 (! systemd-analyze timespan -- -1)
 145 (! systemd-analyze timespan '*-2-29 0:0:0')
 146 (! systemd-analyze timespan "")
 147 # cat-config
 148 systemd-analyze cat-config systemd/system.conf >/dev/null
 149 systemd-analyze cat-config /etc/systemd/system.conf >/dev/null
 150 systemd-analyze cat-config systemd/system.conf systemd/journald.conf >/dev/null
 151 systemd-analyze cat-config systemd/system.conf foo/bar systemd/journald.conf >/dev/null
 152 systemd-analyze cat-config foo/bar
 153
 154 if [[ ! -v ASAN_OPTIONS ]]; then
 155     # check that systemd-analyze cat-config paths work in a chroot
 156     mkdir -p /tmp/root
 157     mount --bind / /tmp/root
 158     systemd-analyze cat-config systemd/system-preset >/tmp/out1
 159     chroot /tmp/root systemd-analyze cat-config systemd/system-preset >/tmp/out2
 160     diff /tmp/out{1,2}
 161 fi
 162
 163 # verify
 164 mkdir -p /tmp/img/usr/lib/systemd/system/
 165 mkdir -p /tmp/img/opt/
 166
 167 touch /tmp/img/opt/script0.sh
 168 chmod +x /tmp/img/opt/script0.sh
 169
 170 cat <<EOF >/tmp/img/usr/lib/systemd/system/testfile.service
 171 [Service]
 172 ExecStart = /opt/script0.sh
 173 EOF
 174
 175 set +e
 176 # Default behaviour is to recurse through all dependencies when unit is loaded
 177 systemd-analyze verify --root=/tmp/img/ testfile.service \
 178     && { echo 'unexpected success'; exit 1; }
 179
 180 # As above, recurses through all dependencies when unit is loaded
 181 systemd-analyze verify --recursive-errors=yes --root=/tmp/img/ testfile.service \
 182     && { echo 'unexpected success'; exit 1; }
 183
 184 # Recurses through unit file and its direct dependencies when unit is loaded
 185 systemd-analyze verify --recursive-errors=one --root=/tmp/img/ testfile.service \
 186     && { echo 'unexpected success'; exit 1; }
 187
 188 set -e
 189
 190 # zero exit status since dependencies are ignored when unit is loaded
 191 systemd-analyze verify --recursive-errors=no --root=/tmp/img/ testfile.service
 192
 193 rm /tmp/img/usr/lib/systemd/system/testfile.service
 194
 195 cat <<EOF >/tmp/testfile.service
 196 [Unit]
 197 foo = bar
 198
 199 [Service]
 200 ExecStart = echo hello
 201 EOF
 202
 203 cat <<EOF >/tmp/testfile2.service
 204 [Unit]
 205 Requires = testfile.service
 206
 207 [Service]
 208 ExecStart = echo hello
 209 EOF
 210
 211 # Zero exit status since no additional dependencies are recursively loaded when the unit file is loaded
 212 systemd-analyze verify --recursive-errors=no /tmp/testfile2.service
 213
 214 set +e
 215 # Non-zero exit status since all associated dependencies are recursively loaded when the unit file is loaded
 216 systemd-analyze verify --recursive-errors=yes /tmp/testfile2.service \
 217     && { echo 'unexpected success'; exit 1; }
 218 set -e
 219
 220 rm /tmp/testfile.service
 221 rm /tmp/testfile2.service
 222
 223 cat <<EOF >/tmp/testfile.service
 224 [Service]
 225 ExecStart = echo hello
 226 DeviceAllow=/dev/sda
 227 EOF
 228
 229 # Prevent regression from #13380 and #20859 where we can't verify hidden files
 230 cp /tmp/testfile.service /tmp/.testfile.service
 231
 232 systemd-analyze verify /tmp/.testfile.service
 233
 234 rm /tmp/.testfile.service
 235
 236 # Alias a unit file's name on disk (see #20061)
 237 cp /tmp/testfile.service /tmp/testsrvc
 238
 239 systemd-analyze verify /tmp/testsrvc \
 240     && { echo 'unexpected success'; exit 1; }
 241
 242 systemd-analyze verify /tmp/testsrvc:alias.service
 243
 244 # Zero exit status since the value used for comparison determine exposure to security threats is by default 100
 245 systemd-analyze security --offline=true /tmp/testfile.service
 246
 247 set +e
 248 #The overall exposure level assigned to the unit is greater than the set threshold
 249 systemd-analyze security --threshold=90 --offline=true /tmp/testfile.service \
 250     && { echo 'unexpected success'; exit 1; }
 251 set -e
 252
 253 # Ensure we print the list of ACLs, see https://github.com/systemd/systemd/issues/23185
 254 systemd-analyze security --offline=true /tmp/testfile.service | grep -q -F "/dev/sda"
 255
 256 rm /tmp/testfile.service
 257
 258 cat <<EOF >/tmp/img/usr/lib/systemd/system/testfile.service
 259 [Service]
 260 ExecStart = echo hello
 261 PrivateNetwork = yes
 262 PrivateDevices = yes
 263 PrivateUsers = yes
 264 EOF
 265
 266 # The new overall exposure level assigned to the unit is less than the set thresholds
 267 # Verifies that the --offline= option works with --root=
 268 systemd-analyze security --threshold=90 --offline=true --root=/tmp/img/ testfile.service
 269
 270 # Added an additional "INVALID_ID" id to the .json to verify that nothing breaks when input is malformed
 271 # The PrivateNetwork id description and weight was changed to verify that 'security' is actually reading in
 272 # values from the .json file when required. The default weight for "PrivateNetwork" is 2500, and the new weight
 273 # assigned to that id in the .json file is 6000. This increased weight means that when the "PrivateNetwork" key is
 274 # set to 'yes' (as above in the case of testfile.service) in the content of the unit file, the overall exposure
 275 # level for the unit file should decrease to account for that increased weight.
 276 cat <<EOF >/tmp/testfile.json
 277 {"UserOrDynamicUser":
 278     {"description_bad": "Service runs as root user",
 279     "weight": 0,
 280     "range": 10
 281     },
 282 "SupplementaryGroups":
 283     {"description_good": "Service has no supplementary groups",
 284     "description_bad": "Service runs with supplementary groups",
 285     "description_na": "Service runs as root, option does not matter",
 286     "weight": 200,
 287     "range": 1
 288     },
 289 "PrivateDevices":
 290     {"description_good": "Service has no access to hardware devices",
 291     "description_bad": "Service potentially has access to hardware devices",
 292     "weight": 1000,
 293     "range": 1
 294     },
 295 "PrivateMounts":
 296     {"description_good": "Service cannot install system mounts",
 297     "description_bad": "Service may install system mounts",
 298     "weight": 1000,
 299     "range": 1
 300     },
 301 "PrivateNetwork":
 302     {"description_good": "Service doesn't have access to the host's network",
 303     "description_bad": "Service has access to the host's network",
 304     "weight": 6000,
 305     "range": 1
 306     },
 307 "PrivateTmp":
 308     {"description_good": "Service has no access to other software's temporary files",
 309     "description_bad": "Service has access to other software's temporary files",
 310     "weight": 1000,
 311     "range": 1
 312     },
 313 "PrivateUsers":
 314     {"description_good": "Service does not have access to other users",
 315     "description_bad": "Service has access to other users",
 316     "weight": 1000,
 317     "range": 1
 318     },
 319 "ProtectControlGroups":
 320     {"description_good": "Service cannot modify the control group file system",
 321     "description_bad": "Service may modify the control group file system",
 322     "weight": 1000,
 323     "range": 1
 324     },
 325 "ProtectKernelModules":
 326     {"description_good": "Service cannot load or read kernel modules",
 327     "description_bad": "Service may load or read kernel modules",
 328     "weight": 1000,
 329     "range": 1
 330     },
 331 "ProtectKernelTunables":
 332     {"description_good": "Service cannot alter kernel tunables (/proc/sys, …)",
 333     "description_bad": "Service may alter kernel tunables",
 334     "weight": 1000,
 335     "range": 1
 336     },
 337 "ProtectKernelLogs":
 338     {"description_good": "Service cannot read from or write to the kernel log ring buffer",
 339     "description_bad": "Service may read from or write to the kernel log ring buffer",
 340     "weight": 1000,
 341     "range": 1
 342     },
 343 "ProtectClock":
 344     {"description_good": "Service cannot write to the hardware clock or system clock",
 345     "description_bad": "Service may write to the hardware clock or system clock",
 346     "weight": 1000,
 347     "range": 1
 348     },
 349 "ProtectHome":
 350     {"weight": 1000,
 351     "range": 10
 352     },
 353 "ProtectHostname":
 354     {"description_good": "Service cannot change system host/domainname",
 355     "description_bad": "Service may change system host/domainname",
 356     "weight": 50,
 357     "range": 1
 358     },
 359 "ProtectSystem":
 360     {"weight": 1000,
 361     "range": 10
 362     },
 363 "RootDirectoryOrRootImage":
 364     {"description_good": "Service has its own root directory/image",
 365     "description_bad": "Service runs within the host's root directory",
 366     "weight": 200,
 367     "range": 1
 368     },
 369 "LockPersonality":
 370     {"description_good": "Service cannot change ABI personality",
 371     "description_bad": "Service may change ABI personality",
 372     "weight": 100,
 373     "range": 1
 374     },
 375 "MemoryDenyWriteExecute":
 376     {"description_good": "Service cannot create writable executable memory mappings",
 377     "description_bad": "Service may create writable executable memory mappings",
 378     "weight": 100,
 379     "range": 1
 380     },
 381 "NoNewPrivileges":
 382     {"description_good": "Service processes cannot acquire new privileges",
 383     "description_bad": "Service processes may acquire new privileges",
 384     "weight": 1000,
 385     "range": 1
 386     },
 387 "CapabilityBoundingSet_CAP_SYS_ADMIN":
 388     {"description_good": "Service has no administrator privileges",
 389     "description_bad": "Service has administrator privileges",
 390     "weight": 1500,
 391     "range": 1
 392     },
 393 "CapabilityBoundingSet_CAP_SET_UID_GID_PCAP":
 394     {"description_good": "Service cannot change UID/GID identities/capabilities",
 395     "description_bad": "Service may change UID/GID identities/capabilities",
 396     "weight": 1500,
 397     "range": 1
 398     },
 399 "CapabilityBoundingSet_CAP_SYS_PTRACE":
 400     {"description_good": "Service has no ptrace() debugging abilities",
 401     "description_bad": "Service has ptrace() debugging abilities",
 402     "weight": 1500,
 403     "range": 1
 404     },
 405 "CapabilityBoundingSet_CAP_SYS_TIME":
 406     {"description_good": "Service processes cannot change the system clock",
 407     "description_bad": "Service processes may change the system clock",
 408     "weight": 1000,
 409     "range": 1
 410     },
 411 "CapabilityBoundingSet_CAP_NET_ADMIN":
 412     {"description_good": "Service has no network configuration privileges",
 413     "description_bad": "Service has network configuration privileges",
 414     "weight": 1000,
 415     "range": 1
 416     },
 417 "CapabilityBoundingSet_CAP_SYS_RAWIO":
 418     {"description_good": "Service has no raw I/O access",
 419     "description_bad": "Service has raw I/O access",
 420     "weight": 1000,
 421     "range": 1
 422     },
 423 "CapabilityBoundingSet_CAP_SYS_MODULE":
 424     {"description_good": "Service cannot load kernel modules",
 425     "description_bad": "Service may load kernel modules",
 426     "weight": 1000,
 427     "range": 1
 428     },
 429 "CapabilityBoundingSet_CAP_AUDIT":
 430     {"description_good": "Service has no audit subsystem access",
 431     "description_bad": "Service has audit subsystem access",
 432     "weight": 500,
 433     "range": 1
 434     },
 435 "CapabilityBoundingSet_CAP_SYSLOG":
 436     {"description_good": "Service has no access to kernel logging",
 437     "description_bad": "Service has access to kernel logging",
 438     "weight": 500,
 439     "range": 1
 440     },
 441 "CapabilityBoundingSet_CAP_SYS_NICE_RESOURCE":
 442     {"description_good": "Service has no privileges to change resource use parameters",
 443     "description_bad": "Service has privileges to change resource use parameters",
 444     "weight": 500,
 445     "range": 1
 446     },
 447 "CapabilityBoundingSet_CAP_MKNOD":
 448     {"description_good": "Service cannot create device nodes",
 449     "description_bad": "Service may create device nodes",
 450     "weight": 500,
 451     "range": 1
 452     },
 453 "CapabilityBoundingSet_CAP_CHOWN_FSETID_SETFCAP":
 454     {"description_good": "Service cannot change file ownership/access mode/capabilities",
 455     "description_bad": "Service may change file ownership/access mode/capabilities unrestricted",
 456     "weight": 1000,
 457     "range": 1
 458     },
 459 "CapabilityBoundingSet_CAP_DAC_FOWNER_IPC_OWNER":
 460     {"description_good": "Service cannot override UNIX file/IPC permission checks",
 461     "description_bad": "Service may override UNIX file/IPC permission checks",
 462     "weight": 1000,
 463     "range": 1
 464     },
 465 "CapabilityBoundingSet_CAP_KILL":
 466     {"description_good": "Service cannot send UNIX signals to arbitrary processes",
 467     "description_bad": "Service may send UNIX signals to arbitrary processes",
 468     "weight": 500,
 469     "range": 1
 470     },
 471 "CapabilityBoundingSet_CAP_NET_BIND_SERVICE_BROADCAST_RAW":
 472     {"description_good": "Service has no elevated networking privileges",
 473     "description_bad": "Service has elevated networking privileges",
 474     "weight": 500,
 475     "range": 1
 476     },
 477 "CapabilityBoundingSet_CAP_SYS_BOOT":
 478     {"description_good": "Service cannot issue reboot()",
 479     "description_bad": "Service may issue reboot()",
 480     "weight": 100,
 481     "range": 1
 482     },
 483 "CapabilityBoundingSet_CAP_MAC":
 484     {"description_good": "Service cannot adjust SMACK MAC",
 485     "description_bad": "Service may adjust SMACK MAC",
 486     "weight": 100,
 487     "range": 1
 488     },
 489 "CapabilityBoundingSet_CAP_LINUX_IMMUTABLE":
 490     {"description_good": "Service cannot mark files immutable",
 491     "description_bad": "Service may mark files immutable",
 492     "weight": 75,
 493     "range": 1
 494     },
 495 "CapabilityBoundingSet_CAP_IPC_LOCK":
 496     {"description_good": "Service cannot lock memory into RAM",
 497     "description_bad": "Service may lock memory into RAM",
 498     "weight": 50,
 499     "range": 1
 500     },
 501 "CapabilityBoundingSet_CAP_SYS_CHROOT":
 502     {"description_good": "Service cannot issue chroot()",
 503     "description_bad": "Service may issue chroot()",
 504     "weight": 50,
 505     "range": 1
 506     },
 507 "CapabilityBoundingSet_CAP_BLOCK_SUSPEND":
 508     {"description_good": "Service cannot establish wake locks",
 509     "description_bad": "Service may establish wake locks",
 510     "weight": 25,
 511     "range": 1
 512     },
 513 "CapabilityBoundingSet_CAP_WAKE_ALARM":
 514     {"description_good": "Service cannot program timers that wake up the system",
 515     "description_bad": "Service may program timers that wake up the system",
 516     "weight": 25,
 517     "range": 1
 518     },
 519 "CapabilityBoundingSet_CAP_LEASE":
 520     {"description_good": "Service cannot create file leases",
 521     "description_bad": "Service may create file leases",
 522     "weight": 25,
 523     "range": 1
 524     },
 525 "CapabilityBoundingSet_CAP_SYS_TTY_CONFIG":
 526     {"description_good": "Service cannot issue vhangup()",
 527     "description_bad": "Service may issue vhangup()",
 528     "weight": 25,
 529     "range": 1
 530     },
 531 "CapabilityBoundingSet_CAP_SYS_PACCT":
 532     {"description_good": "Service cannot use acct()",
 533     "description_bad": "Service may use acct()",
 534     "weight": 25,
 535     "range": 1
 536     },
 537 "UMask":
 538     {"weight": 100,
 539     "range": 10
 540     },
 541 "KeyringMode":
 542     {"description_good": "Service doesn't share key material with other services",
 543     "description_bad": "Service shares key material with other service",
 544     "weight": 1000,
 545     "range": 1
 546     },
 547 "ProtectProc":
 548     {"description_good": "Service has restricted access to process tree(/proc hidepid=)",
 549     "description_bad": "Service has full access to process tree(/proc hidepid=)",
 550     "weight": 1000,
 551     "range": 3
 552     },
 553 "ProcSubset":
 554     {"description_good": "Service has no access to non-process/proc files(/proc subset=)",
 555     "description_bad": "Service has full access to non-process/proc files(/proc subset=)",
 556     "weight": 10,
 557     "range": 1
 558     },
 559 "NotifyAccess":
 560     {"description_good": "Service child processes cannot alter service state",
 561     "description_bad": "Service child processes may alter service state",
 562     "weight": 1000,
 563     "range": 1
 564     },
 565 "RemoveIPC":
 566     {"description_good": "Service user cannot leave SysV IPC objects around",
 567     "description_bad": "Service user may leave SysV IPC objects around",
 568     "description_na": "Service runs as root, option does not apply",
 569     "weight": 100,
 570     "range": 1
 571     },
 572 "Delegate":
 573     {"description_good": "Service does not maintain its own delegated control group subtree",
 574     "description_bad": "Service maintains its own delegated control group subtree",
 575     "weight": 100,
 576     "range": 1
 577     },
 578 "RestrictRealtime":
 579     {"description_good": "Service realtime scheduling access is restricted",
 580     "description_bad": "Service may acquire realtime scheduling",
 581     "weight": 500,
 582     "range": 1
 583     },
 584 "RestrictSUIDSGID":
 585     {"description_good": "SUID/SGIDfilecreationbyserviceisrestricted",
 586     "description_bad": "ServicemaycreateSUID/SGIDfiles",
 587     "weight": 1000,
 588     "range": 1
 589     },
 590 "RestrictNamespaces_user":
 591     {"description_good": "Servicecannotcreateusernamespaces",
 592     "description_bad": "Servicemaycreateusernamespaces",
 593     "weight": 1500,
 594     "range": 1
 595     },
 596 "RestrictNamespaces_mnt":
 597     {"description_good": "Service cannot create file system namespaces",
 598     "description_bad": "Service may create file system namespaces",
 599     "weight": 500,
 600     "range": 1
 601     },
 602 "RestrictNamespaces_ipc":
 603     {"description_good": "Service cannot create IPC namespaces",
 604     "description_bad": "Service may create IPC namespaces",
 605     "weight": 500,
 606     "range": 1
 607     },
 608 "RestrictNamespaces_pid":
 609     {"description_good": "Service cannot create process namespaces",
 610     "description_bad": "Service may create process namespaces",
 611     "weight": 500,
 612     "range": 1
 613     },
 614 "RestrictNamespaces_cgroup":
 615     {"description_good": "Service cannot create cgroup namespaces",
 616     "description_bad": "Service may create cgroup namespaces",
 617     "weight": 500,
 618     "range": 1
 619     },
 620 "RestrictNamespaces_net":
 621     {"description_good": "Service cannot create network namespaces",
 622     "description_bad": "Service may create network namespaces",
 623     "weight": 500,
 624     "range": 1
 625     },
 626 "RestrictNamespaces_uts":
 627     {"description_good": "Service cannot create hostname namespaces",
 628     "description_bad": "Service may create hostname namespaces",
 629     "weight": 100,
 630     "range": 1
 631     },
 632 "RestrictAddressFamilies_AF_INET_INET6":
 633     {"description_good": "Service cannot allocate Internet sockets",
 634     "description_bad": "Service may allocate Internet sockets",
 635     "weight": 1500,
 636     "range": 1
 637     },
 638 "RestrictAddressFamilies_AF_UNIX":
 639     {"description_good": "Service cannot allocate local sockets",
 640     "description_bad": "Service may allocate local sockets",
 641     "weight": 25,
 642     "range": 1
 643     },
 644 "RestrictAddressFamilies_AF_NETLINK":
 645     {"description_good": "Service cannot allocate netlink sockets",
 646     "description_bad": "Service may allocate netlink sockets",
 647     "weight": 200,
 648     "range": 1
 649     },
 650 "RestrictAddressFamilies_AF_PACKET":
 651     {"description_good": "Service cannot allocate packet sockets",
 652     "description_bad": "Service may allocate packet sockets",
 653     "weight": 1000,
 654     "range": 1
 655     },
 656 "RestrictAddressFamilies_OTHER":
 657     {"description_good": "Service cannot allocate exotic sockets",
 658     "description_bad": "Service may allocate exotic sockets",
 659     "weight": 1250,
 660     "range": 1
 661     },
 662 "SystemCallArchitectures":
 663     {"weight": 1000,
 664     "range": 10
 665     },
 666 "SystemCallFilter_swap":
 667     {"weight": 1000,
 668     "range": 10
 669     },
 670 "SystemCallFilter_obsolete":
 671     {"weight": 250,
 672     "range": 10
 673     },
 674 "SystemCallFilter_clock":
 675     {"weight": 1000,
 676     "range": 10
 677     },
 678 "SystemCallFilter_cpu_emulation":
 679     {"weight": 250,
 680     "range": 10
 681     },
 682 "SystemCallFilter_debug":
 683     {"weight": 1000,
 684     "range": 10
 685     },
 686 "SystemCallFilter_mount":
 687     {"weight": 1000,
 688     "range": 10
 689     },
 690 "SystemCallFilter_module":
 691     {"weight": 1000,
 692     "range": 10
 693     },
 694 "SystemCallFilter_raw_io":
 695     {"weight": 1000,
 696     "range": 10
 697     },
 698 "SystemCallFilter_reboot":
 699     {"weight": 1000,
 700     "range": 10
 701     },
 702 "SystemCallFilter_privileged":
 703     {"weight": 700,
 704     "range": 10
 705     },
 706 "SystemCallFilter_resources":
 707     {"weight": 700,
 708     "range": 10
 709     },
 710 "IPAddressDeny":
 711     {"weight": 1000,
 712     "range": 10
 713     },
 714 "DeviceAllow":
 715     {"weight": 1000,
 716     "range": 10
 717     },
 718 "AmbientCapabilities":
 719     {"description_good": "Service process does not receive ambient capabilities",
 720     "description_bad": "Service process receives ambient capabilities",
 721     "weight": 500,
 722     "range": 1
 723     },
 724 "INVALID_ID":
 725     {"weight": 1000,
 726     "range": 10
 727     }
 728 }
 729 EOF
 730
 731 # Reads in custom security requirements from the parsed .json file and uses these for comparison
 732 systemd-analyze security --threshold=90 --offline=true \
 733                            --security-policy=/tmp/testfile.json \
 734                            --root=/tmp/img/ testfile.service
 735
 736 # The strict profile adds a lot of sanboxing options
 737 systemd-analyze security --threshold=25 --offline=true \
 738                            --security-policy=/tmp/testfile.json \
 739                            --profile=strict \
 740                            --root=/tmp/img/ testfile.service
 741
 742 set +e
 743 # The trusted profile doesn't add any sanboxing options
 744 systemd-analyze security --threshold=25 --offline=true \
 745                            --security-policy=/tmp/testfile.json \
 746                            --profile=/usr/lib/systemd/portable/profile/trusted/service.conf \
 747                            --root=/tmp/img/ testfile.service \
 748     && { echo 'unexpected success'; exit 1; }
 749
 750 systemd-analyze security --threshold=50 --offline=true \
 751                            --security-policy=/tmp/testfile.json \
 752                            --root=/tmp/img/ testfile.service \
 753     && { echo 'unexpected success'; exit 1; }
 754 set -e
 755
 756 rm /tmp/img/usr/lib/systemd/system/testfile.service
 757
 758 if systemd-analyze --version | grep -q -F "+ELFUTILS"; then
 759     systemd-analyze inspect-elf --json=short /lib/systemd/systemd | grep -q -F '"elfType":"executable"'
 760 fi
 761
 762 systemd-analyze --threshold=90 security systemd-journald.service
 763
 764 # issue 23663
 765 check() {(
 766     set +x
 767     output=$(systemd-analyze security --offline="${2?}" "${3?}" | grep -F 'SystemCallFilter=')
 768     assert_in "System call ${1?} list" "$output"
 769     assert_in "[+✓] SystemCallFilter=~@swap" "$output"
 770     assert_in "[+✓] SystemCallFilter=~@resources" "$output"
 771     assert_in "[+✓] SystemCallFilter=~@reboot" "$output"
 772     assert_in "[+✓] SystemCallFilter=~@raw-io" "$output"
 773     assert_in "[-✗] SystemCallFilter=~@privileged" "$output"
 774     assert_in "[+✓] SystemCallFilter=~@obsolete" "$output"
 775     assert_in "[+✓] SystemCallFilter=~@mount" "$output"
 776     assert_in "[+✓] SystemCallFilter=~@module" "$output"
 777     assert_in "[+✓] SystemCallFilter=~@debug" "$output"
 778     assert_in "[+✓] SystemCallFilter=~@cpu-emulation" "$output"
 779     assert_in "[-✗] SystemCallFilter=~@clock" "$output"
 780 )}
 781
 782 export -n SYSTEMD_LOG_LEVEL
 783
 784 mkdir -p /run/systemd/system
 785 cat >/run/systemd/system/allow-list.service <<EOF
 786 [Service]
 787 ExecStart=false
 788 SystemCallFilter=@system-service
 789 SystemCallFilter=~@resources:ENOANO @privileged
 790 SystemCallFilter=@clock
 791 EOF
 792
 793 cat >/run/systemd/system/deny-list.service <<EOF
 794 [Service]
 795 ExecStart=false
 796 SystemCallFilter=~@known
 797 SystemCallFilter=@system-service
 798 SystemCallFilter=~@resources:ENOANO @privileged
 799 SystemCallFilter=@clock
 800 EOF
 801
 802 systemctl daemon-reload
 803
 804 check allow yes /run/systemd/system/allow-list.service
 805 check allow no allow-list.service
 806 check deny yes /run/systemd/system/deny-list.service
 807 check deny no deny-list.service
 808
 809 output=$(systemd-run -p "SystemCallFilter=@system-service" -p "SystemCallFilter=~@resources:ENOANO @privileged" -p "SystemCallFilter=@clock" sleep 60 2>&1)
 810 name=$(echo "$output" | awk '{ print $4 }')
 811
 812 check allow yes /run/systemd/transient/"$name"
 813 check allow no "$name"
 814
 815 output=$(systemd-run -p "SystemCallFilter=~@known" -p "SystemCallFilter=@system-service" -p "SystemCallFilter=~@resources:ENOANO @privileged" -p "SystemCallFilter=@clock" sleep 60 2>&1)
 816 name=$(echo "$output" | awk '{ print $4 }')
 817
 818 check deny yes /run/systemd/transient/"$name"
 819 check deny no "$name"
 820
 821 systemd-analyze log-level info
 822
 823 echo OK >/testok
 824
 825 exit 0