+/* SPDX-License-Identifier: LGPL-2.1+ */
/***
This file is part of systemd.
#include <sys/prctl.h>
#include <sys/types.h>
+#include "errno-list.h"
#include "fileio.h"
#include "fs-util.h"
#include "macro.h"
#include "mkdir.h"
#include "path-util.h"
#include "rm-rf.h"
-#ifdef HAVE_SECCOMP
+#if HAVE_SECCOMP
#include "seccomp-util.h"
#endif
+#include "stat-util.h"
#include "test-helper.h"
+#include "tests.h"
#include "unit.h"
#include "util.h"
#include "virt.h"
static void check(Manager *m, Unit *unit, int status_expected, int code_expected) {
Service *service = NULL;
usec_t ts;
- usec_t timeout = 2 * USEC_PER_SEC;
+ usec_t timeout = 2 * USEC_PER_MINUTE;
assert_se(m);
assert_se(unit);
printf("%s\n", unit->id);
exec_context_dump(&service->exec_context, stdout, "\t");
ts = now(CLOCK_MONOTONIC);
- while (service->state != SERVICE_DEAD && service->state != SERVICE_FAILED) {
+ while (!IN_SET(service->state, SERVICE_DEAD, SERVICE_FAILED)) {
int r;
usec_t n;
assert_se(service->main_exec_status.code == code_expected);
}
+static bool is_inaccessible_available(void) {
+ char *p;
+
+ FOREACH_STRING(p,
+ "/run/systemd/inaccessible/reg",
+ "/run/systemd/inaccessible/dir",
+ "/run/systemd/inaccessible/chr",
+ "/run/systemd/inaccessible/blk",
+ "/run/systemd/inaccessible/fifo",
+ "/run/systemd/inaccessible/sock"
+ ) {
+ if (access(p, F_OK) < 0)
+ return false;
+ }
+
+ return true;
+}
+
static void test(Manager *m, const char *unit_name, int status_expected, int code_expected) {
Unit *unit;
check(m, unit, status_expected, code_expected);
}
+static void test_exec_bind_paths(Manager *m) {
+ assert_se(mkdir_p("/tmp/test-exec_bind_paths", 0755) >= 0);
+ assert_se(mkdir_p("/tmp/test-exec_bind_readonly_paths", 0755) >= 0);
+
+ test(m, "exec-bind-paths.service", 0, CLD_EXITED);
+
+ (void) rm_rf("/tmp/test-exec_bind_paths", REMOVE_ROOT|REMOVE_PHYSICAL);
+ (void) rm_rf("/tmp/test-exec_bind_readonly_paths", REMOVE_ROOT|REMOVE_PHYSICAL);
+}
+
static void test_exec_workingdirectory(Manager *m) {
assert_se(mkdir_p("/tmp/test-exec_workingdirectory", 0755) >= 0);
static void test_exec_privatedevices(Manager *m) {
if (detect_container() > 0) {
- log_notice("testing in container, skipping private device tests");
+ log_notice("testing in container, skipping %s", __func__);
+ return;
+ }
+ if (!is_inaccessible_available()) {
+ log_notice("testing without inaccessible, skipping %s", __func__);
return;
}
+
test(m, "exec-privatedevices-yes.service", 0, CLD_EXITED);
test(m, "exec-privatedevices-no.service", 0, CLD_EXITED);
}
+static void test_exec_privatedevices_capabilities(Manager *m) {
+ int r;
+
+ if (detect_container() > 0) {
+ log_notice("testing in container, skipping %s", __func__);
+ return;
+ }
+ if (!is_inaccessible_available()) {
+ log_notice("testing without inaccessible, skipping %s", __func__);
+ return;
+ }
+
+ /* We use capsh to test if the capabilities are
+ * properly set, so be sure that it exists */
+ r = find_binary("capsh", NULL);
+ if (r < 0) {
+ log_error_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
+ return;
+ }
+
+ test(m, "exec-privatedevices-yes-capability-mknod.service", 0, CLD_EXITED);
+ test(m, "exec-privatedevices-no-capability-mknod.service", 0, CLD_EXITED);
+ test(m, "exec-privatedevices-yes-capability-sys-rawio.service", 0, CLD_EXITED);
+ test(m, "exec-privatedevices-no-capability-sys-rawio.service", 0, CLD_EXITED);
+}
+
+static void test_exec_protectkernelmodules(Manager *m) {
+ int r;
+
+ if (detect_container() > 0) {
+ log_notice("testing in container, skipping %s", __func__);
+ return;
+ }
+ if (!is_inaccessible_available()) {
+ log_notice("testing without inaccessible, skipping %s", __func__);
+ return;
+ }
+
+ r = find_binary("capsh", NULL);
+ if (r < 0) {
+ log_error_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
+ return;
+ }
+
+
+ test(m, "exec-protectkernelmodules-no-capabilities.service", 0, CLD_EXITED);
+ test(m, "exec-protectkernelmodules-yes-capabilities.service", 0, CLD_EXITED);
+ test(m, "exec-protectkernelmodules-yes-mount-propagation.service", 0, CLD_EXITED);
+}
+
+static void test_exec_readonlypaths(Manager *m) {
+
+ if (path_is_read_only_fs("/var") > 0)
+ return;
+
+ test(m, "exec-readonlypaths.service", 0, CLD_EXITED);
+ test(m, "exec-readonlypaths-mount-propagation.service", 0, CLD_EXITED);
+ test(m, "exec-readonlypaths-with-bindpaths.service", 0, CLD_EXITED);
+}
+
+static void test_exec_readwritepaths(Manager *m) {
+
+ if (path_is_read_only_fs("/") > 0)
+ return;
+
+ test(m, "exec-readwritepaths-mount-propagation.service", 0, CLD_EXITED);
+}
+
+static void test_exec_inaccessiblepaths(Manager *m) {
+
+ if (path_is_read_only_fs("/") > 0)
+ return;
+
+ test(m, "exec-inaccessiblepaths-mount-propagation.service", 0, CLD_EXITED);
+}
+
+static void test_exec_inaccessiblepaths_proc(Manager *m) {
+ if (!is_inaccessible_available()) {
+ log_notice("testing without inaccessible, skipping %s", __func__);
+ return;
+ }
+
+ test(m, "exec-inaccessiblepaths-proc.service", 0, CLD_EXITED);
+}
+
static void test_exec_systemcallfilter(Manager *m) {
-#ifdef HAVE_SECCOMP
+#if HAVE_SECCOMP
if (!is_seccomp_available())
return;
test(m, "exec-systemcallfilter-not-failing.service", 0, CLD_EXITED);
test(m, "exec-systemcallfilter-not-failing2.service", 0, CLD_EXITED);
test(m, "exec-systemcallfilter-failing.service", SIGSYS, CLD_KILLED);
test(m, "exec-systemcallfilter-failing2.service", SIGSYS, CLD_KILLED);
+ test(m, "exec-systemcallfilter-with-errno-name.service", errno_from_name("EILSEQ"), CLD_EXITED);
+ test(m, "exec-systemcallfilter-with-errno-number.service", 255, CLD_EXITED);
#endif
}
static void test_exec_systemcallerrornumber(Manager *m) {
-#ifdef HAVE_SECCOMP
- if (is_seccomp_available())
- test(m, "exec-systemcallerrornumber.service", 1, CLD_EXITED);
+#if HAVE_SECCOMP
+ if (!is_seccomp_available())
+ return;
+ test(m, "exec-systemcallerrornumber-name.service", errno_from_name("EACCES"), CLD_EXITED);
+ test(m, "exec-systemcallerrornumber-number.service", 255, CLD_EXITED);
+#endif
+}
+
+static void test_exec_restrict_namespaces(Manager *m) {
+#if HAVE_SECCOMP
+ if (!is_seccomp_available())
+ return;
+
+ test(m, "exec-restrict-namespaces-no.service", 0, CLD_EXITED);
+ test(m, "exec-restrict-namespaces-yes.service", 1, CLD_EXITED);
+ test(m, "exec-restrict-namespaces-mnt.service", 0, CLD_EXITED);
+ test(m, "exec-restrict-namespaces-mnt-blacklist.service", 1, CLD_EXITED);
#endif
}
static void test_exec_systemcall_system_mode_with_user(Manager *m) {
-#ifdef HAVE_SECCOMP
+#if HAVE_SECCOMP
if (!is_seccomp_available())
return;
if (getpwnam("nobody"))
else if (getpwnam("nfsnobody"))
test(m, "exec-systemcallfilter-system-user-nfsnobody.service", 0, CLD_EXITED);
else
- log_error_errno(errno, "Skipping test_exec_systemcall_system_mode_with_user, could not find nobody/nfsnobody user: %m");
+ log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody user: %m", __func__);
#endif
}
else if (getpwnam("nfsnobody"))
test(m, "exec-user-nfsnobody.service", 0, CLD_EXITED);
else
- log_error_errno(errno, "Skipping test_exec_user, could not find nobody/nfsnobody user: %m");
+ log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody user: %m", __func__);
}
static void test_exec_group(Manager *m) {
else if (getgrnam("nfsnobody"))
test(m, "exec-group-nfsnobody.service", 0, CLD_EXITED);
else
- log_error_errno(errno, "Skipping test_exec_group, could not find nobody/nfsnobody group: %m");
+ log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody group: %m", __func__);
+}
+
+static void test_exec_supplementary_groups(Manager *m) {
+ test(m, "exec-supplementarygroups.service", 0, CLD_EXITED);
+ test(m, "exec-supplementarygroups-single-group.service", 0, CLD_EXITED);
+ test(m, "exec-supplementarygroups-single-group-user.service", 0, CLD_EXITED);
+ test(m, "exec-supplementarygroups-multiple-groups-default-group-user.service", 0, CLD_EXITED);
+ test(m, "exec-supplementarygroups-multiple-groups-withgid.service", 0, CLD_EXITED);
+ test(m, "exec-supplementarygroups-multiple-groups-withuid.service", 0, CLD_EXITED);
+}
+
+static void test_exec_dynamic_user(Manager *m) {
+ test(m, "exec-dynamicuser-fixeduser.service", 0, CLD_EXITED);
+ test(m, "exec-dynamicuser-fixeduser-one-supplementarygroup.service", 0, CLD_EXITED);
+ test(m, "exec-dynamicuser-supplementarygroups.service", 0, CLD_EXITED);
+ test(m, "exec-dynamicuser-state-dir.service", 0, CLD_EXITED);
}
static void test_exec_environment(Manager *m) {
else if (getgrnam("nfsnobody"))
test(m, "exec-runtimedirectory-owner-nfsnobody.service", 0, CLD_EXITED);
else
- log_error_errno(errno, "Skipping test_exec_runtimedirectory-owner, could not find nobody/nfsnobody group: %m");
+ log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody group: %m", __func__);
}
static void test_exec_capabilityboundingset(Manager *m) {
int r;
- /* We use capsh to test if the capabilities are
- * properly set, so be sure that it exists */
r = find_binary("capsh", NULL);
if (r < 0) {
- log_error_errno(r, "Skipping test_exec_capabilityboundingset, could not find capsh binary: %m");
+ log_error_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
return;
}
test(m, "exec-capabilityambientset-nfsnobody.service", 0, CLD_EXITED);
test(m, "exec-capabilityambientset-merge-nfsnobody.service", 0, CLD_EXITED);
} else
- log_error_errno(errno, "Skipping test_exec_capabilityambientset, could not find nobody/nfsnobody user: %m");
+ log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody user: %m", __func__);
} else
- log_error_errno(errno, "Skipping test_exec_capabilityambientset, the kernel does not support ambient capabilities: %m");
+ log_error_errno(errno, "Skipping %s, the kernel does not support ambient capabilities: %m", __func__);
}
static void test_exec_privatenetwork(Manager *m) {
r = find_binary("ip", NULL);
if (r < 0) {
- log_error_errno(r, "Skipping test_exec_privatenetwork, could not find ip binary: %m");
+ log_error_errno(r, "Skipping %s, could not find ip binary: %m", __func__);
return;
}
test(m, "exec-spec-interpolation.service", 0, CLD_EXITED);
}
-static int run_tests(UnitFileScope scope, test_function_t *tests) {
- test_function_t *test = NULL;
+static void test_exec_read_only_path_suceed(Manager *m) {
+ test(m, "exec-read-only-path-succeed.service", 0, CLD_EXITED);
+}
+
+static void test_exec_unset_environment(Manager *m) {
+ test(m, "exec-unset-environment.service", 0, CLD_EXITED);
+}
+
+static void test_exec_specifier(Manager *m) {
+ test(m, "exec-specifier.service", 0, CLD_EXITED);
+}
+
+static void test_exec_stdin_data(Manager *m) {
+ test(m, "exec-stdin-data.service", 0, CLD_EXITED);
+}
+
+static void test_exec_stdio_file(Manager *m) {
+ test(m, "exec-stdio-file.service", 0, CLD_EXITED);
+}
+
+static int run_tests(UnitFileScope scope, const test_function_t *tests) {
+ const test_function_t *test = NULL;
Manager *m = NULL;
int r;
assert_se(tests);
- r = manager_new(scope, true, &m);
+ r = manager_new(scope, MANAGER_TEST_RUN_MINIMAL, &m);
if (MANAGER_SKIP_TEST(r)) {
- printf("Skipping test: manager_new: %s\n", strerror(-r));
+ log_notice_errno(r, "Skipping test: manager_new: %m");
return EXIT_TEST_SKIP;
}
assert_se(r >= 0);
}
int main(int argc, char *argv[]) {
- test_function_t user_tests[] = {
+ static const test_function_t user_tests[] = {
+ test_exec_bind_paths,
test_exec_workingdirectory,
test_exec_personality,
test_exec_ignoresigpipe,
test_exec_privatetmp,
test_exec_privatedevices,
+ test_exec_privatedevices_capabilities,
+ test_exec_protectkernelmodules,
+ test_exec_readonlypaths,
+ test_exec_readwritepaths,
+ test_exec_inaccessiblepaths,
+ test_exec_inaccessiblepaths_proc,
test_exec_privatenetwork,
test_exec_systemcallfilter,
test_exec_systemcallerrornumber,
+ test_exec_restrict_namespaces,
test_exec_user,
test_exec_group,
+ test_exec_supplementary_groups,
test_exec_environment,
test_exec_environmentfile,
test_exec_passenvironment,
test_exec_oomscoreadjust,
test_exec_ioschedulingclass,
test_exec_spec_interpolation,
+ test_exec_read_only_path_suceed,
+ test_exec_unset_environment,
+ test_exec_stdin_data,
+ test_exec_stdio_file,
NULL,
};
- test_function_t system_tests[] = {
+ static const test_function_t system_tests[] = {
test_exec_systemcall_system_mode_with_user,
+ test_exec_dynamic_user,
+ test_exec_specifier,
NULL,
};
int r;
+ log_set_max_level(LOG_DEBUG);
log_parse_environment();
log_open();
/* It is needed otherwise cgroup creation fails */
if (getuid() != 0) {
- printf("Skipping test: not root\n");
+ puts("Skipping test: not root");
+ return EXIT_TEST_SKIP;
+ }
+
+ r = enter_cgroup_subroot();
+ if (r == -ENOMEDIUM) {
+ puts("Skipping test: cgroupfs not available");
return EXIT_TEST_SKIP;
}
assert_se(setenv("XDG_RUNTIME_DIR", "/tmp/", 1) == 0);
- assert_se(set_unit_path(TEST_DIR "/test-execute/") >= 0);
+ assert_se(set_unit_path(get_testdata_dir("/test-execute")) >= 0);
/* Unset VAR1, VAR2 and VAR3 which are used in the PassEnvironment test
* cases, otherwise (and if they are present in the environment),
projects / thirdparty / systemd.git / blobdiff