test/units/testsuite-65.sh

   1 #!/usr/bin/env bash
   2 # SPDX-License-Identifier: LGPL-2.1-or-later
   3 # shellcheck disable=SC2016
   4 set -eux
   5
   6 # shellcheck source=test/units/assert.sh
   7 . "$(dirname "$0")"/assert.sh
   8
   9 systemctl log-level debug
  10 export SYSTEMD_LOG_LEVEL=debug
  11
  12 # Sanity checks
  13 #
  14 # We can't really test time, blame, critical-chain and plot verbs here, as
  15 # the testsuite service is a part of the boot transaction, so let's assume
  16 # they fail
  17 systemd-analyze || :
  18 systemd-analyze time || :
  19 systemd-analyze blame || :
  20 systemd-analyze critical-chain || :
  21 systemd-analyze plot >/dev/null || :
  22 # legacy/deprecated options (moved to systemctl, but still usable from analyze)
  23 systemd-analyze log-level
  24 systemd-analyze log-level "$(systemctl log-level)"
  25 systemd-analyze get-log-level
  26 systemd-analyze set-log-level "$(systemctl log-level)"
  27 systemd-analyze log-target
  28 systemd-analyze log-target "$(systemctl log-target)"
  29 systemd-analyze get-log-target
  30 systemd-analyze set-log-target "$(systemctl log-target)"
  31 systemd-analyze service-watchdogs
  32 systemd-analyze service-watchdogs "$(systemctl service-watchdogs)"
  33 # dot
  34 systemd-analyze dot >/dev/null
  35 systemd-analyze dot systemd-journald.service >/dev/null
  36 systemd-analyze dot systemd-journald.service systemd-logind.service >/dev/null
  37 systemd-analyze dot --from-pattern="*" --from-pattern="*.service" systemd-journald.service >/dev/null
  38 systemd-analyze dot --to-pattern="*" --to-pattern="*.service" systemd-journald.service >/dev/null
  39 systemd-analyze dot --from-pattern="*.service" --to-pattern="*.service" systemd-journald.service >/dev/null
  40 systemd-analyze dot --order systemd-journald.service systemd-logind.service >/dev/null
  41 systemd-analyze dot --require systemd-journald.service systemd-logind.service >/dev/null
  42 systemd-analyze dot "systemd-*.service" >/dev/null
  43 (! systemd-analyze dot systemd-journald.service systemd-logind.service "*" bbb ccc)
  44 # dump
  45 systemd-analyze dump >/dev/null
  46 systemd-analyze dump "*" >/dev/null
  47 systemd-analyze dump "*.socket" >/dev/null
  48 systemd-analyze dump "*.socket" "*.service" aaaaaaa ... >/dev/null
  49 systemd-analyze dump systemd-journald.service >/dev/null
  50 (! systemd-analyze dump "")
  51 # unit-files
  52 systemd-analyze unit-files >/dev/null
  53 systemd-analyze unit-files systemd-journald.service >/dev/null
  54 systemd-analyze unit-files "*" >/dev/null
  55 systemd-analyze unit-files "*" aaaaaa "*.service" "*.target" >/dev/null
  56 systemd-analyze unit-files --user >/dev/null
  57 systemd-analyze unit-files --user "*" aaaaaa "*.service" "*.target" >/dev/null
  58 # unit-paths
  59 systemd-analyze unit-paths
  60 systemd-analyze unit-paths --user
  61 systemd-analyze unit-paths --global
  62 # exist-status
  63 systemd-analyze exit-status
  64 systemd-analyze exit-status STDOUT BPF
  65 systemd-analyze exit-status 0 1 {63..65}
  66 (! systemd-analyze exit-status STDOUT BPF "hello*")
  67 # capability
  68 systemd-analyze capability
  69 systemd-analyze capability cap_chown CAP_KILL
  70 systemd-analyze capability 0 1 {30..32}
  71 (! systemd-analyze capability cap_chown CAP_KILL "hello*")
  72 # condition
  73 mkdir -p /run/systemd/system
  74 UNIT_NAME="analyze-condition-$RANDOM.service"
  75 cat >"/run/systemd/system/$UNIT_NAME" <<EOF
  76 [Unit]
  77 AssertPathExists=/etc/os-release
  78 AssertEnvironment=!FOOBAR
  79 ConditionKernelVersion=>1.0
  80 ConditionPathExists=/etc/os-release
  81
  82 [Service]
  83 ExecStart=/bin/true
  84 EOF
  85 systemctl daemon-reload
  86 systemd-analyze condition --unit="$UNIT_NAME"
  87 systemd-analyze condition 'ConditionKernelVersion = ! <4.0' \
  88                           'ConditionKernelVersion = >=3.1' \
  89                           'ConditionACPower=|false' \
  90                           'ConditionArchitecture=|!arm' \
  91                           'AssertPathExists=/etc/os-release'
  92 (! systemd-analyze condition 'ConditionArchitecture=|!arm' 'AssertXYZ=foo')
  93 (! systemd-analyze condition 'ConditionKernelVersion=<1.0')
  94 (! systemd-analyze condition 'AssertKernelVersion=<1.0')
  95 # syscall-filter
  96 systemd-analyze syscall-filter >/dev/null
  97 systemd-analyze syscall-filter @chown @sync
  98 systemd-analyze syscall-filter @sync @sync @sync
  99 (! systemd-analyze syscall-filter @chown @sync @foobar)
 100 # filesystems (requires libbpf support)
 101 if systemctl --version | grep "+BPF_FRAMEWORK"; then
 102     systemd-analyze filesystems >/dev/null
 103     systemd-analyze filesystems @basic-api
 104     systemd-analyze filesystems @basic-api @basic-api @basic-api
 105     (! systemd-analyze filesystems @basic-api @basic-api @foobar @basic-api)
 106 fi
 107 # calendar
 108 systemd-analyze calendar '*-2-29 0:0:0'
 109 systemd-analyze calendar --iterations=5 '*-2-29 0:0:0'
 110 systemd-analyze calendar '*-* *:*:*'
 111 systemd-analyze calendar --iterations=5 '*-* *:*:*'
 112 systemd-analyze calendar --iterations=50 '*-* *:*:*'
 113 systemd-analyze calendar --iterations=0 '*-* *:*:*'
 114 systemd-analyze calendar --iterations=5 '01-01-22 01:00:00'
 115 systemd-analyze calendar --base-time=yesterday --iterations=5 '*-* *:*:*'
 116 (! systemd-analyze calendar --iterations=0 '*-* 99:*:*')
 117 (! systemd-analyze calendar --base-time=never '*-* *:*:*')
 118 (! systemd-analyze calendar 1)
 119 (! systemd-analyze calendar "")
 120 # timestamp
 121 systemd-analyze timestamp now
 122 systemd-analyze timestamp -- -1
 123 systemd-analyze timestamp yesterday now tomorrow
 124 (! systemd-analyze timestamp yesterday never tomorrow)
 125 (! systemd-analyze timestamp 1)
 126 (! systemd-analyze timestamp '*-2-29 0:0:0')
 127 (! systemd-analyze timestamp "")
 128 # timespan
 129 systemd-analyze timespan 1
 130 systemd-analyze timespan 1s 300s '1year 0.000001s'
 131 (! systemd-analyze timespan 1s 300s aaaaaa '1year 0.000001s')
 132 (! systemd-analyze timespan -- -1)
 133 (! systemd-analyze timespan '*-2-29 0:0:0')
 134 (! systemd-analyze timespan "")
 135 # cat-config
 136 systemd-analyze cat-config systemd/system.conf >/dev/null
 137 systemd-analyze cat-config /etc/systemd/system.conf >/dev/null
 138 systemd-analyze cat-config systemd/system.conf systemd/journald.conf >/dev/null
 139 systemd-analyze cat-config systemd/system.conf foo/bar systemd/journald.conf >/dev/null
 140 systemd-analyze cat-config foo/bar
 141
 142 if [[ ! -v ASAN_OPTIONS ]]; then
 143     # check that systemd-analyze cat-config paths work in a chroot
 144     mkdir -p /tmp/root
 145     mount --bind / /tmp/root
 146     systemd-analyze cat-config systemd/system-preset >/tmp/out1
 147     chroot /tmp/root systemd-analyze cat-config systemd/system-preset >/tmp/out2
 148     diff /tmp/out{1,2}
 149 fi
 150
 151 # verify
 152 mkdir -p /tmp/img/usr/lib/systemd/system/
 153 mkdir -p /tmp/img/opt/
 154
 155 touch /tmp/img/opt/script0.sh
 156 chmod +x /tmp/img/opt/script0.sh
 157
 158 cat <<EOF >/tmp/img/usr/lib/systemd/system/testfile.service
 159 [Service]
 160 ExecStart = /opt/script0.sh
 161 EOF
 162
 163 set +e
 164 # Default behaviour is to recurse through all dependencies when unit is loaded
 165 systemd-analyze verify --root=/tmp/img/ testfile.service \
 166     && { echo 'unexpected success'; exit 1; }
 167
 168 # As above, recurses through all dependencies when unit is loaded
 169 systemd-analyze verify --recursive-errors=yes --root=/tmp/img/ testfile.service \
 170     && { echo 'unexpected success'; exit 1; }
 171
 172 # Recurses through unit file and its direct dependencies when unit is loaded
 173 systemd-analyze verify --recursive-errors=one --root=/tmp/img/ testfile.service \
 174     && { echo 'unexpected success'; exit 1; }
 175
 176 set -e
 177
 178 # zero exit status since dependencies are ignored when unit is loaded
 179 systemd-analyze verify --recursive-errors=no --root=/tmp/img/ testfile.service
 180
 181 rm /tmp/img/usr/lib/systemd/system/testfile.service
 182
 183 cat <<EOF >/tmp/testfile.service
 184 [Unit]
 185 foo = bar
 186
 187 [Service]
 188 ExecStart = echo hello
 189 EOF
 190
 191 cat <<EOF >/tmp/testfile2.service
 192 [Unit]
 193 Requires = testfile.service
 194
 195 [Service]
 196 ExecStart = echo hello
 197 EOF
 198
 199 # Zero exit status since no additional dependencies are recursively loaded when the unit file is loaded
 200 systemd-analyze verify --recursive-errors=no /tmp/testfile2.service
 201
 202 set +e
 203 # Non-zero exit status since all associated dependencies are recursively loaded when the unit file is loaded
 204 systemd-analyze verify --recursive-errors=yes /tmp/testfile2.service \
 205     && { echo 'unexpected success'; exit 1; }
 206 set -e
 207
 208 rm /tmp/testfile.service
 209 rm /tmp/testfile2.service
 210
 211 cat <<EOF >/tmp/testfile.service
 212 [Service]
 213 ExecStart = echo hello
 214 DeviceAllow=/dev/sda
 215 EOF
 216
 217 # Prevent regression from #13380 and #20859 where we can't verify hidden files
 218 cp /tmp/testfile.service /tmp/.testfile.service
 219
 220 systemd-analyze verify /tmp/.testfile.service
 221
 222 rm /tmp/.testfile.service
 223
 224 # Alias a unit file's name on disk (see #20061)
 225 cp /tmp/testfile.service /tmp/testsrvc
 226
 227 systemd-analyze verify /tmp/testsrvc \
 228     && { echo 'unexpected success'; exit 1; }
 229
 230 systemd-analyze verify /tmp/testsrvc:alias.service
 231
 232 # Zero exit status since the value used for comparison determine exposure to security threats is by default 100
 233 systemd-analyze security --offline=true /tmp/testfile.service
 234
 235 set +e
 236 #The overall exposure level assigned to the unit is greater than the set threshold
 237 systemd-analyze security --threshold=90 --offline=true /tmp/testfile.service \
 238     && { echo 'unexpected success'; exit 1; }
 239 set -e
 240
 241 # Ensure we print the list of ACLs, see https://github.com/systemd/systemd/issues/23185
 242 systemd-analyze security --offline=true /tmp/testfile.service | grep -q -F "/dev/sda"
 243
 244 rm /tmp/testfile.service
 245
 246 cat <<EOF >/tmp/img/usr/lib/systemd/system/testfile.service
 247 [Service]
 248 ExecStart = echo hello
 249 PrivateNetwork = yes
 250 PrivateDevices = yes
 251 PrivateUsers = yes
 252 EOF
 253
 254 # The new overall exposure level assigned to the unit is less than the set thresholds
 255 # Verifies that the --offline= option works with --root=
 256 systemd-analyze security --threshold=90 --offline=true --root=/tmp/img/ testfile.service
 257
 258 # Added an additional "INVALID_ID" id to the .json to verify that nothing breaks when input is malformed
 259 # The PrivateNetwork id description and weight was changed to verify that 'security' is actually reading in
 260 # values from the .json file when required. The default weight for "PrivateNetwork" is 2500, and the new weight
 261 # assigned to that id in the .json file is 6000. This increased weight means that when the "PrivateNetwork" key is
 262 # set to 'yes' (as above in the case of testfile.service) in the content of the unit file, the overall exposure
 263 # level for the unit file should decrease to account for that increased weight.
 264 cat <<EOF >/tmp/testfile.json
 265 {"UserOrDynamicUser":
 266     {"description_bad": "Service runs as root user",
 267     "weight": 0,
 268     "range": 10
 269     },
 270 "SupplementaryGroups":
 271     {"description_good": "Service has no supplementary groups",
 272     "description_bad": "Service runs with supplementary groups",
 273     "description_na": "Service runs as root, option does not matter",
 274     "weight": 200,
 275     "range": 1
 276     },
 277 "PrivateDevices":
 278     {"description_good": "Service has no access to hardware devices",
 279     "description_bad": "Service potentially has access to hardware devices",
 280     "weight": 1000,
 281     "range": 1
 282     },
 283 "PrivateMounts":
 284     {"description_good": "Service cannot install system mounts",
 285     "description_bad": "Service may install system mounts",
 286     "weight": 1000,
 287     "range": 1
 288     },
 289 "PrivateNetwork":
 290     {"description_good": "Service doesn't have access to the host's network",
 291     "description_bad": "Service has access to the host's network",
 292     "weight": 6000,
 293     "range": 1
 294     },
 295 "PrivateTmp":
 296     {"description_good": "Service has no access to other software's temporary files",
 297     "description_bad": "Service has access to other software's temporary files",
 298     "weight": 1000,
 299     "range": 1
 300     },
 301 "PrivateUsers":
 302     {"description_good": "Service does not have access to other users",
 303     "description_bad": "Service has access to other users",
 304     "weight": 1000,
 305     "range": 1
 306     },
 307 "ProtectControlGroups":
 308     {"description_good": "Service cannot modify the control group file system",
 309     "description_bad": "Service may modify the control group file system",
 310     "weight": 1000,
 311     "range": 1
 312     },
 313 "ProtectKernelModules":
 314     {"description_good": "Service cannot load or read kernel modules",
 315     "description_bad": "Service may load or read kernel modules",
 316     "weight": 1000,
 317     "range": 1
 318     },
 319 "ProtectKernelTunables":
 320     {"description_good": "Service cannot alter kernel tunables (/proc/sys, …)",
 321     "description_bad": "Service may alter kernel tunables",
 322     "weight": 1000,
 323     "range": 1
 324     },
 325 "ProtectKernelLogs":
 326     {"description_good": "Service cannot read from or write to the kernel log ring buffer",
 327     "description_bad": "Service may read from or write to the kernel log ring buffer",
 328     "weight": 1000,
 329     "range": 1
 330     },
 331 "ProtectClock":
 332     {"description_good": "Service cannot write to the hardware clock or system clock",
 333     "description_bad": "Service may write to the hardware clock or system clock",
 334     "weight": 1000,
 335     "range": 1
 336     },
 337 "ProtectHome":
 338     {"weight": 1000,
 339     "range": 10
 340     },
 341 "ProtectHostname":
 342     {"description_good": "Service cannot change system host/domainname",
 343     "description_bad": "Service may change system host/domainname",
 344     "weight": 50,
 345     "range": 1
 346     },
 347 "ProtectSystem":
 348     {"weight": 1000,
 349     "range": 10
 350     },
 351 "RootDirectoryOrRootImage":
 352     {"description_good": "Service has its own root directory/image",
 353     "description_bad": "Service runs within the host's root directory",
 354     "weight": 200,
 355     "range": 1
 356     },
 357 "LockPersonality":
 358     {"description_good": "Service cannot change ABI personality",
 359     "description_bad": "Service may change ABI personality",
 360     "weight": 100,
 361     "range": 1
 362     },
 363 "MemoryDenyWriteExecute":
 364     {"description_good": "Service cannot create writable executable memory mappings",
 365     "description_bad": "Service may create writable executable memory mappings",
 366     "weight": 100,
 367     "range": 1
 368     },
 369 "NoNewPrivileges":
 370     {"description_good": "Service processes cannot acquire new privileges",
 371     "description_bad": "Service processes may acquire new privileges",
 372     "weight": 1000,
 373     "range": 1
 374     },
 375 "CapabilityBoundingSet_CAP_SYS_ADMIN":
 376     {"description_good": "Service has no administrator privileges",
 377     "description_bad": "Service has administrator privileges",
 378     "weight": 1500,
 379     "range": 1
 380     },
 381 "CapabilityBoundingSet_CAP_SET_UID_GID_PCAP":
 382     {"description_good": "Service cannot change UID/GID identities/capabilities",
 383     "description_bad": "Service may change UID/GID identities/capabilities",
 384     "weight": 1500,
 385     "range": 1
 386     },
 387 "CapabilityBoundingSet_CAP_SYS_PTRACE":
 388     {"description_good": "Service has no ptrace() debugging abilities",
 389     "description_bad": "Service has ptrace() debugging abilities",
 390     "weight": 1500,
 391     "range": 1
 392     },
 393 "CapabilityBoundingSet_CAP_SYS_TIME":
 394     {"description_good": "Service processes cannot change the system clock",
 395     "description_bad": "Service processes may change the system clock",
 396     "weight": 1000,
 397     "range": 1
 398     },
 399 "CapabilityBoundingSet_CAP_NET_ADMIN":
 400     {"description_good": "Service has no network configuration privileges",
 401     "description_bad": "Service has network configuration privileges",
 402     "weight": 1000,
 403     "range": 1
 404     },
 405 "CapabilityBoundingSet_CAP_SYS_RAWIO":
 406     {"description_good": "Service has no raw I/O access",
 407     "description_bad": "Service has raw I/O access",
 408     "weight": 1000,
 409     "range": 1
 410     },
 411 "CapabilityBoundingSet_CAP_SYS_MODULE":
 412     {"description_good": "Service cannot load kernel modules",
 413     "description_bad": "Service may load kernel modules",
 414     "weight": 1000,
 415     "range": 1
 416     },
 417 "CapabilityBoundingSet_CAP_AUDIT":
 418     {"description_good": "Service has no audit subsystem access",
 419     "description_bad": "Service has audit subsystem access",
 420     "weight": 500,
 421     "range": 1
 422     },
 423 "CapabilityBoundingSet_CAP_SYSLOG":
 424     {"description_good": "Service has no access to kernel logging",
 425     "description_bad": "Service has access to kernel logging",
 426     "weight": 500,
 427     "range": 1
 428     },
 429 "CapabilityBoundingSet_CAP_SYS_NICE_RESOURCE":
 430     {"description_good": "Service has no privileges to change resource use parameters",
 431     "description_bad": "Service has privileges to change resource use parameters",
 432     "weight": 500,
 433     "range": 1
 434     },
 435 "CapabilityBoundingSet_CAP_MKNOD":
 436     {"description_good": "Service cannot create device nodes",
 437     "description_bad": "Service may create device nodes",
 438     "weight": 500,
 439     "range": 1
 440     },
 441 "CapabilityBoundingSet_CAP_CHOWN_FSETID_SETFCAP":
 442     {"description_good": "Service cannot change file ownership/access mode/capabilities",
 443     "description_bad": "Service may change file ownership/access mode/capabilities unrestricted",
 444     "weight": 1000,
 445     "range": 1
 446     },
 447 "CapabilityBoundingSet_CAP_DAC_FOWNER_IPC_OWNER":
 448     {"description_good": "Service cannot override UNIX file/IPC permission checks",
 449     "description_bad": "Service may override UNIX file/IPC permission checks",
 450     "weight": 1000,
 451     "range": 1
 452     },
 453 "CapabilityBoundingSet_CAP_KILL":
 454     {"description_good": "Service cannot send UNIX signals to arbitrary processes",
 455     "description_bad": "Service may send UNIX signals to arbitrary processes",
 456     "weight": 500,
 457     "range": 1
 458     },
 459 "CapabilityBoundingSet_CAP_NET_BIND_SERVICE_BROADCAST_RAW":
 460     {"description_good": "Service has no elevated networking privileges",
 461     "description_bad": "Service has elevated networking privileges",
 462     "weight": 500,
 463     "range": 1
 464     },
 465 "CapabilityBoundingSet_CAP_SYS_BOOT":
 466     {"description_good": "Service cannot issue reboot()",
 467     "description_bad": "Service may issue reboot()",
 468     "weight": 100,
 469     "range": 1
 470     },
 471 "CapabilityBoundingSet_CAP_MAC":
 472     {"description_good": "Service cannot adjust SMACK MAC",
 473     "description_bad": "Service may adjust SMACK MAC",
 474     "weight": 100,
 475     "range": 1
 476     },
 477 "CapabilityBoundingSet_CAP_LINUX_IMMUTABLE":
 478     {"description_good": "Service cannot mark files immutable",
 479     "description_bad": "Service may mark files immutable",
 480     "weight": 75,
 481     "range": 1
 482     },
 483 "CapabilityBoundingSet_CAP_IPC_LOCK":
 484     {"description_good": "Service cannot lock memory into RAM",
 485     "description_bad": "Service may lock memory into RAM",
 486     "weight": 50,
 487     "range": 1
 488     },
 489 "CapabilityBoundingSet_CAP_SYS_CHROOT":
 490     {"description_good": "Service cannot issue chroot()",
 491     "description_bad": "Service may issue chroot()",
 492     "weight": 50,
 493     "range": 1
 494     },
 495 "CapabilityBoundingSet_CAP_BLOCK_SUSPEND":
 496     {"description_good": "Service cannot establish wake locks",
 497     "description_bad": "Service may establish wake locks",
 498     "weight": 25,
 499     "range": 1
 500     },
 501 "CapabilityBoundingSet_CAP_WAKE_ALARM":
 502     {"description_good": "Service cannot program timers that wake up the system",
 503     "description_bad": "Service may program timers that wake up the system",
 504     "weight": 25,
 505     "range": 1
 506     },
 507 "CapabilityBoundingSet_CAP_LEASE":
 508     {"description_good": "Service cannot create file leases",
 509     "description_bad": "Service may create file leases",
 510     "weight": 25,
 511     "range": 1
 512     },
 513 "CapabilityBoundingSet_CAP_SYS_TTY_CONFIG":
 514     {"description_good": "Service cannot issue vhangup()",
 515     "description_bad": "Service may issue vhangup()",
 516     "weight": 25,
 517     "range": 1
 518     },
 519 "CapabilityBoundingSet_CAP_SYS_PACCT":
 520     {"description_good": "Service cannot use acct()",
 521     "description_bad": "Service may use acct()",
 522     "weight": 25,
 523     "range": 1
 524     },
 525 "UMask":
 526     {"weight": 100,
 527     "range": 10
 528     },
 529 "KeyringMode":
 530     {"description_good": "Service doesn't share key material with other services",
 531     "description_bad": "Service shares key material with other service",
 532     "weight": 1000,
 533     "range": 1
 534     },
 535 "ProtectProc":
 536     {"description_good": "Service has restricted access to process tree(/proc hidepid=)",
 537     "description_bad": "Service has full access to process tree(/proc hidepid=)",
 538     "weight": 1000,
 539     "range": 3
 540     },
 541 "ProcSubset":
 542     {"description_good": "Service has no access to non-process/proc files(/proc subset=)",
 543     "description_bad": "Service has full access to non-process/proc files(/proc subset=)",
 544     "weight": 10,
 545     "range": 1
 546     },
 547 "NotifyAccess":
 548     {"description_good": "Service child processes cannot alter service state",
 549     "description_bad": "Service child processes may alter service state",
 550     "weight": 1000,
 551     "range": 1
 552     },
 553 "RemoveIPC":
 554     {"description_good": "Service user cannot leave SysV IPC objects around",
 555     "description_bad": "Service user may leave SysV IPC objects around",
 556     "description_na": "Service runs as root, option does not apply",
 557     "weight": 100,
 558     "range": 1
 559     },
 560 "Delegate":
 561     {"description_good": "Service does not maintain its own delegated control group subtree",
 562     "description_bad": "Service maintains its own delegated control group subtree",
 563     "weight": 100,
 564     "range": 1
 565     },
 566 "RestrictRealtime":
 567     {"description_good": "Service realtime scheduling access is restricted",
 568     "description_bad": "Service may acquire realtime scheduling",
 569     "weight": 500,
 570     "range": 1
 571     },
 572 "RestrictSUIDSGID":
 573     {"description_good": "SUID/SGIDfilecreationbyserviceisrestricted",
 574     "description_bad": "ServicemaycreateSUID/SGIDfiles",
 575     "weight": 1000,
 576     "range": 1
 577     },
 578 "RestrictNamespaces_user":
 579     {"description_good": "Servicecannotcreateusernamespaces",
 580     "description_bad": "Servicemaycreateusernamespaces",
 581     "weight": 1500,
 582     "range": 1
 583     },
 584 "RestrictNamespaces_mnt":
 585     {"description_good": "Service cannot create file system namespaces",
 586     "description_bad": "Service may create file system namespaces",
 587     "weight": 500,
 588     "range": 1
 589     },
 590 "RestrictNamespaces_ipc":
 591     {"description_good": "Service cannot create IPC namespaces",
 592     "description_bad": "Service may create IPC namespaces",
 593     "weight": 500,
 594     "range": 1
 595     },
 596 "RestrictNamespaces_pid":
 597     {"description_good": "Service cannot create process namespaces",
 598     "description_bad": "Service may create process namespaces",
 599     "weight": 500,
 600     "range": 1
 601     },
 602 "RestrictNamespaces_cgroup":
 603     {"description_good": "Service cannot create cgroup namespaces",
 604     "description_bad": "Service may create cgroup namespaces",
 605     "weight": 500,
 606     "range": 1
 607     },
 608 "RestrictNamespaces_net":
 609     {"description_good": "Service cannot create network namespaces",
 610     "description_bad": "Service may create network namespaces",
 611     "weight": 500,
 612     "range": 1
 613     },
 614 "RestrictNamespaces_uts":
 615     {"description_good": "Service cannot create hostname namespaces",
 616     "description_bad": "Service may create hostname namespaces",
 617     "weight": 100,
 618     "range": 1
 619     },
 620 "RestrictAddressFamilies_AF_INET_INET6":
 621     {"description_good": "Service cannot allocate Internet sockets",
 622     "description_bad": "Service may allocate Internet sockets",
 623     "weight": 1500,
 624     "range": 1
 625     },
 626 "RestrictAddressFamilies_AF_UNIX":
 627     {"description_good": "Service cannot allocate local sockets",
 628     "description_bad": "Service may allocate local sockets",
 629     "weight": 25,
 630     "range": 1
 631     },
 632 "RestrictAddressFamilies_AF_NETLINK":
 633     {"description_good": "Service cannot allocate netlink sockets",
 634     "description_bad": "Service may allocate netlink sockets",
 635     "weight": 200,
 636     "range": 1
 637     },
 638 "RestrictAddressFamilies_AF_PACKET":
 639     {"description_good": "Service cannot allocate packet sockets",
 640     "description_bad": "Service may allocate packet sockets",
 641     "weight": 1000,
 642     "range": 1
 643     },
 644 "RestrictAddressFamilies_OTHER":
 645     {"description_good": "Service cannot allocate exotic sockets",
 646     "description_bad": "Service may allocate exotic sockets",
 647     "weight": 1250,
 648     "range": 1
 649     },
 650 "SystemCallArchitectures":
 651     {"weight": 1000,
 652     "range": 10
 653     },
 654 "SystemCallFilter_swap":
 655     {"weight": 1000,
 656     "range": 10
 657     },
 658 "SystemCallFilter_obsolete":
 659     {"weight": 250,
 660     "range": 10
 661     },
 662 "SystemCallFilter_clock":
 663     {"weight": 1000,
 664     "range": 10
 665     },
 666 "SystemCallFilter_cpu_emulation":
 667     {"weight": 250,
 668     "range": 10
 669     },
 670 "SystemCallFilter_debug":
 671     {"weight": 1000,
 672     "range": 10
 673     },
 674 "SystemCallFilter_mount":
 675     {"weight": 1000,
 676     "range": 10
 677     },
 678 "SystemCallFilter_module":
 679     {"weight": 1000,
 680     "range": 10
 681     },
 682 "SystemCallFilter_raw_io":
 683     {"weight": 1000,
 684     "range": 10
 685     },
 686 "SystemCallFilter_reboot":
 687     {"weight": 1000,
 688     "range": 10
 689     },
 690 "SystemCallFilter_privileged":
 691     {"weight": 700,
 692     "range": 10
 693     },
 694 "SystemCallFilter_resources":
 695     {"weight": 700,
 696     "range": 10
 697     },
 698 "IPAddressDeny":
 699     {"weight": 1000,
 700     "range": 10
 701     },
 702 "DeviceAllow":
 703     {"weight": 1000,
 704     "range": 10
 705     },
 706 "AmbientCapabilities":
 707     {"description_good": "Service process does not receive ambient capabilities",
 708     "description_bad": "Service process receives ambient capabilities",
 709     "weight": 500,
 710     "range": 1
 711     },
 712 "INVALID_ID":
 713     {"weight": 1000,
 714     "range": 10
 715     }
 716 }
 717 EOF
 718
 719 # Reads in custom security requirements from the parsed .json file and uses these for comparison
 720 systemd-analyze security --threshold=90 --offline=true \
 721                            --security-policy=/tmp/testfile.json \
 722                            --root=/tmp/img/ testfile.service
 723
 724 # The strict profile adds a lot of sanboxing options
 725 systemd-analyze security --threshold=25 --offline=true \
 726                            --security-policy=/tmp/testfile.json \
 727                            --profile=strict \
 728                            --root=/tmp/img/ testfile.service
 729
 730 set +e
 731 # The trusted profile doesn't add any sanboxing options
 732 systemd-analyze security --threshold=25 --offline=true \
 733                            --security-policy=/tmp/testfile.json \
 734                            --profile=/usr/lib/systemd/portable/profile/trusted/service.conf \
 735                            --root=/tmp/img/ testfile.service \
 736     && { echo 'unexpected success'; exit 1; }
 737
 738 systemd-analyze security --threshold=50 --offline=true \
 739                            --security-policy=/tmp/testfile.json \
 740                            --root=/tmp/img/ testfile.service \
 741     && { echo 'unexpected success'; exit 1; }
 742 set -e
 743
 744 rm /tmp/img/usr/lib/systemd/system/testfile.service
 745
 746 if systemd-analyze --version | grep -q -F "+ELFUTILS"; then
 747     systemd-analyze inspect-elf --json=short /lib/systemd/systemd | grep -q -F '"elfType":"executable"'
 748 fi
 749
 750 systemd-analyze --threshold=90 security systemd-journald.service
 751
 752 # issue 23663
 753 check() {(
 754     set +x
 755     output=$(systemd-analyze security --offline="${2?}" "${3?}" | grep -F 'SystemCallFilter=')
 756     assert_in "System call ${1?} list" "$output"
 757     assert_in "[+✓] SystemCallFilter=~@swap" "$output"
 758     assert_in "[+✓] SystemCallFilter=~@resources" "$output"
 759     assert_in "[+✓] SystemCallFilter=~@reboot" "$output"
 760     assert_in "[+✓] SystemCallFilter=~@raw-io" "$output"
 761     assert_in "[-✗] SystemCallFilter=~@privileged" "$output"
 762     assert_in "[+✓] SystemCallFilter=~@obsolete" "$output"
 763     assert_in "[+✓] SystemCallFilter=~@mount" "$output"
 764     assert_in "[+✓] SystemCallFilter=~@module" "$output"
 765     assert_in "[+✓] SystemCallFilter=~@debug" "$output"
 766     assert_in "[+✓] SystemCallFilter=~@cpu-emulation" "$output"
 767     assert_in "[-✗] SystemCallFilter=~@clock" "$output"
 768 )}
 769
 770 export -n SYSTEMD_LOG_LEVEL
 771
 772 mkdir -p /run/systemd/system
 773 cat >/run/systemd/system/allow-list.service <<EOF
 774 [Service]
 775 ExecStart=false
 776 SystemCallFilter=@system-service
 777 SystemCallFilter=~@resources:ENOANO @privileged
 778 SystemCallFilter=@clock
 779 EOF
 780
 781 cat >/run/systemd/system/deny-list.service <<EOF
 782 [Service]
 783 ExecStart=false
 784 SystemCallFilter=~@known
 785 SystemCallFilter=@system-service
 786 SystemCallFilter=~@resources:ENOANO @privileged
 787 SystemCallFilter=@clock
 788 EOF
 789
 790 systemctl daemon-reload
 791
 792 check allow yes /run/systemd/system/allow-list.service
 793 check allow no allow-list.service
 794 check deny yes /run/systemd/system/deny-list.service
 795 check deny no deny-list.service
 796
 797 output=$(systemd-run -p "SystemCallFilter=@system-service" -p "SystemCallFilter=~@resources:ENOANO @privileged" -p "SystemCallFilter=@clock" sleep 60 2>&1)
 798 name=$(echo "$output" | awk '{ print $4 }')
 799
 800 check allow yes /run/systemd/transient/"$name"
 801 check allow no "$name"
 802
 803 output=$(systemd-run -p "SystemCallFilter=~@known" -p "SystemCallFilter=@system-service" -p "SystemCallFilter=~@resources:ENOANO @privileged" -p "SystemCallFilter=@clock" sleep 60 2>&1)
 804 name=$(echo "$output" | awk '{ print $4 }')
 805
 806 check deny yes /run/systemd/transient/"$name"
 807 check deny no "$name"
 808
 809 systemd-analyze log-level info
 810
 811 echo OK >/testok
 812
 813 exit 0