]>
Commit | Line | Data |
---|---|---|
db9ecf05 | 1 | /* SPDX-License-Identifier: LGPL-2.1-or-later */ |
281e05b6 | 2 | |
ff4ca461 | 3 | #include <stdio.h> |
4e032f65 | 4 | #include <sys/mount.h> |
70d7aea5 | 5 | #include <sys/prctl.h> |
ff4ca461 | 6 | #include <sys/types.h> |
281e05b6 | 7 | |
42867dfe YW |
8 | #include "sd-event.h" |
9 | ||
3ebd5986 | 10 | #include "build-path.h" |
b7856f92 | 11 | #include "capability-util.h" |
4e79aeaa | 12 | #include "cpu-set-util.h" |
8c35c10d | 13 | #include "copy.h" |
42867dfe | 14 | #include "dropin.h" |
b4891260 | 15 | #include "errno-list.h" |
42867dfe | 16 | #include "fd-util.h" |
03bd70dd | 17 | #include "fileio.h" |
f4f15635 | 18 | #include "fs-util.h" |
281e05b6 | 19 | #include "macro.h" |
f4f15635 | 20 | #include "manager.h" |
a22692d7 | 21 | #include "missing_prctl.h" |
281e05b6 | 22 | #include "mkdir.h" |
4e032f65 | 23 | #include "mount-util.h" |
ff4ca461 | 24 | #include "path-util.h" |
42867dfe | 25 | #include "process-util.h" |
c6878637 | 26 | #include "rm-rf.h" |
83f12b27 | 27 | #include "seccomp-util.h" |
57b7a260 | 28 | #include "service.h" |
42867dfe YW |
29 | #include "signal-util.h" |
30 | #include "static-destruct.h" | |
34b86909 | 31 | #include "stat-util.h" |
70aece81 | 32 | #include "sysctl-util.h" |
cc100a5a | 33 | #include "tests.h" |
8c35c10d | 34 | #include "tmpfile-util.h" |
f4f15635 | 35 | #include "unit.h" |
57c2efa0 | 36 | #include "user-util.h" |
4dd4cb8f | 37 | #include "virt.h" |
281e05b6 | 38 | |
4e032f65 YW |
39 | #define PRIVATE_UNIT_DIR "/run/test-execute-unit-dir" |
40 | ||
42867dfe | 41 | static char *user_runtime_unit_dir = NULL; |
5f00dc4d | 42 | static bool can_unshare; |
8a87a16b | 43 | static bool have_net_dummy; |
76808638 | 44 | static bool have_netns; |
b6349ffd | 45 | static unsigned n_ran_tests = 0; |
b7172f34 | 46 | |
42867dfe YW |
47 | STATIC_DESTRUCTOR_REGISTER(user_runtime_unit_dir, freep); |
48 | ||
281e05b6 RC |
49 | typedef void (*test_function_t)(Manager *m); |
50 | ||
c3ab2c38 LP |
51 | static int cld_dumped_to_killed(int code) { |
52 | /* Depending on the system, seccomp version, … some signals might result in dumping, others in plain | |
53 | * killing. Let's ignore the difference here, and map both cases to CLD_KILLED */ | |
54 | return code == CLD_DUMPED ? CLD_KILLED : code; | |
55 | } | |
56 | ||
31cd5f63 | 57 | static void wait_for_service_finish(Manager *m, Unit *unit) { |
281e05b6 RC |
58 | Service *service = NULL; |
59 | usec_t ts; | |
8adb3d63 | 60 | usec_t timeout = 2 * USEC_PER_MINUTE; |
281e05b6 | 61 | |
26d79ab8 DDM |
62 | ASSERT_NOT_NULL(m); |
63 | ASSERT_NOT_NULL(unit); | |
281e05b6 | 64 | |
75c8b980 FS |
65 | /* Bump the timeout when running in plain QEMU, as some more involved tests might start hitting the |
66 | * default 2m timeout (like exec-dynamicuser-statedir.service) */ | |
67 | if (detect_virtualization() == VIRTUALIZATION_QEMU) | |
68 | timeout *= 2; | |
69 | ||
281e05b6 RC |
70 | service = SERVICE(unit); |
71 | printf("%s\n", unit->id); | |
72 | exec_context_dump(&service->exec_context, stdout, "\t"); | |
73 | ts = now(CLOCK_MONOTONIC); | |
ec2ce0c5 | 74 | while (!IN_SET(service->state, SERVICE_DEAD, SERVICE_FAILED)) { |
281e05b6 RC |
75 | int r; |
76 | usec_t n; | |
77 | ||
78 | r = sd_event_run(m->event, 100 * USEC_PER_MSEC); | |
26d79ab8 | 79 | ASSERT_OK(r); |
281e05b6 RC |
80 | |
81 | n = now(CLOCK_MONOTONIC); | |
82 | if (ts + timeout < n) { | |
83 | log_error("Test timeout when testing %s", unit->id); | |
a721cd00 | 84 | r = unit_kill(unit, KILL_ALL, SIGKILL, SI_USER, 0, NULL); |
f7f8e8cb EV |
85 | if (r < 0) |
86 | log_error_errno(r, "Failed to kill %s: %m", unit->id); | |
281e05b6 RC |
87 | exit(EXIT_FAILURE); |
88 | } | |
89 | } | |
31cd5f63 AZ |
90 | } |
91 | ||
fe65d692 ZJS |
92 | static void check_main_result(const char *file, unsigned line, const char *func, |
93 | Manager *m, Unit *unit, int status_expected, int code_expected) { | |
31cd5f63 AZ |
94 | Service *service = NULL; |
95 | ||
26d79ab8 DDM |
96 | ASSERT_NOT_NULL(m); |
97 | ASSERT_NOT_NULL(unit); | |
31cd5f63 AZ |
98 | |
99 | wait_for_service_finish(m, unit); | |
100 | ||
101 | service = SERVICE(unit); | |
281e05b6 | 102 | exec_status_dump(&service->main_exec_status, stdout, "\t"); |
18f8c5d4 | 103 | |
c3ab2c38 | 104 | if (cld_dumped_to_killed(service->main_exec_status.code) != cld_dumped_to_killed(code_expected)) { |
aa272751 YW |
105 | log_error("%s:%u:%s %s: can_unshare=%s: exit code %d, expected %d", |
106 | file, line, func, unit->id, yes_no(can_unshare), | |
6aed6a11 ZJS |
107 | service->main_exec_status.code, code_expected); |
108 | abort(); | |
18f8c5d4 LP |
109 | } |
110 | ||
111 | if (service->main_exec_status.status != status_expected) { | |
aa272751 YW |
112 | log_error("%s:%u:%s: %s: can_unshare=%s: exit status %d, expected %d", |
113 | file, line, func, unit->id, yes_no(can_unshare), | |
18f8c5d4 LP |
114 | service->main_exec_status.status, status_expected); |
115 | abort(); | |
6aed6a11 | 116 | } |
281e05b6 RC |
117 | } |
118 | ||
fe65d692 ZJS |
119 | static void check_service_result(const char *file, unsigned line, const char *func, |
120 | Manager *m, Unit *unit, ServiceResult result_expected) { | |
31cd5f63 AZ |
121 | Service *service = NULL; |
122 | ||
26d79ab8 DDM |
123 | ASSERT_NOT_NULL(m); |
124 | ASSERT_NOT_NULL(unit); | |
31cd5f63 AZ |
125 | |
126 | wait_for_service_finish(m, unit); | |
127 | ||
128 | service = SERVICE(unit); | |
129 | ||
130 | if (service->result != result_expected) { | |
aa272751 YW |
131 | log_error("%s:%u:%s: %s: can_unshare=%s: service end result %s, expected %s", |
132 | file, line, func, unit->id, yes_no(can_unshare), | |
31cd5f63 AZ |
133 | service_result_to_string(service->result), |
134 | service_result_to_string(result_expected)); | |
135 | abort(); | |
136 | } | |
137 | } | |
138 | ||
57c2efa0 YW |
139 | static bool check_nobody_user_and_group(void) { |
140 | static int cache = -1; | |
141 | struct passwd *p; | |
142 | struct group *g; | |
143 | ||
144 | if (cache >= 0) | |
145 | return !!cache; | |
146 | ||
147 | if (!synthesize_nobody()) | |
148 | goto invalid; | |
149 | ||
150 | p = getpwnam(NOBODY_USER_NAME); | |
151 | if (!p || | |
152 | !streq(p->pw_name, NOBODY_USER_NAME) || | |
153 | p->pw_uid != UID_NOBODY || | |
154 | p->pw_gid != GID_NOBODY) | |
155 | goto invalid; | |
156 | ||
157 | p = getpwuid(UID_NOBODY); | |
158 | if (!p || | |
159 | !streq(p->pw_name, NOBODY_USER_NAME) || | |
160 | p->pw_uid != UID_NOBODY || | |
161 | p->pw_gid != GID_NOBODY) | |
162 | goto invalid; | |
163 | ||
164 | g = getgrnam(NOBODY_GROUP_NAME); | |
165 | if (!g || | |
166 | !streq(g->gr_name, NOBODY_GROUP_NAME) || | |
167 | g->gr_gid != GID_NOBODY) | |
168 | goto invalid; | |
169 | ||
170 | g = getgrgid(GID_NOBODY); | |
171 | if (!g || | |
172 | !streq(g->gr_name, NOBODY_GROUP_NAME) || | |
173 | g->gr_gid != GID_NOBODY) | |
174 | goto invalid; | |
175 | ||
176 | cache = 1; | |
177 | return true; | |
178 | ||
179 | invalid: | |
180 | cache = 0; | |
181 | return false; | |
182 | } | |
183 | ||
9f82d685 YW |
184 | static bool check_user_has_group_with_same_name(const char *name) { |
185 | struct passwd *p; | |
186 | struct group *g; | |
187 | ||
26d79ab8 | 188 | ASSERT_NOT_NULL(name); |
9f82d685 YW |
189 | |
190 | p = getpwnam(name); | |
191 | if (!p || | |
192 | !streq(p->pw_name, name)) | |
193 | return false; | |
194 | ||
195 | g = getgrgid(p->pw_gid); | |
196 | if (!g || | |
197 | !streq(g->gr_name, name)) | |
198 | return false; | |
199 | ||
200 | return true; | |
201 | } | |
202 | ||
6086d2da | 203 | static bool is_inaccessible_available(void) { |
6086d2da | 204 | FOREACH_STRING(p, |
5980d463 ZJS |
205 | "/run/systemd/inaccessible/reg", |
206 | "/run/systemd/inaccessible/dir", | |
207 | "/run/systemd/inaccessible/chr", | |
208 | "/run/systemd/inaccessible/blk", | |
209 | "/run/systemd/inaccessible/fifo", | |
210 | "/run/systemd/inaccessible/sock") | |
6086d2da DP |
211 | if (access(p, F_OK) < 0) |
212 | return false; | |
6086d2da DP |
213 | |
214 | return true; | |
215 | } | |
216 | ||
fc6172b1 RP |
217 | static void start_parent_slices(Unit *unit) { |
218 | Unit *slice; | |
219 | ||
220 | slice = UNIT_GET_SLICE(unit); | |
221 | if (slice) { | |
222 | start_parent_slices(slice); | |
223 | int r = unit_start(slice, NULL); | |
26d79ab8 DDM |
224 | if (r != -EALREADY) |
225 | ASSERT_OK(r); | |
fc6172b1 RP |
226 | } |
227 | } | |
228 | ||
70aece81 NR |
229 | static bool apparmor_restrict_unprivileged_userns(void) { |
230 | _cleanup_free_ char *v = NULL; | |
231 | int r; | |
232 | ||
233 | /* If kernel.apparmor_restrict_unprivileged_userns=1, then we cannot | |
234 | * use unprivileged user namespaces. */ | |
235 | r = sysctl_read("kernel/apparmor_restrict_unprivileged_userns", &v); | |
236 | if (r < 0) { | |
237 | if (r != -ENOENT) | |
238 | log_debug_errno(r, "Failed to read kernel.apparmor_restrict_unprivileged_userns sysctl, ignoring: %m"); | |
239 | ||
240 | return false; | |
241 | } | |
242 | ||
243 | return streq(v, "1"); | |
244 | } | |
245 | ||
d0c6136f NR |
246 | static bool have_userns_privileges(void) { |
247 | pid_t pid; | |
248 | int r; | |
249 | ||
70aece81 NR |
250 | if (apparmor_restrict_unprivileged_userns()) |
251 | return false; | |
252 | ||
d0c6136f NR |
253 | r = safe_fork("(sd-test-check-userns)", |
254 | FORK_RESET_SIGNALS | | |
255 | FORK_CLOSE_ALL_FDS | | |
256 | FORK_DEATHSIG_SIGKILL, | |
257 | &pid); | |
26d79ab8 | 258 | ASSERT_OK(r); |
d0c6136f NR |
259 | if (r == 0) { |
260 | /* Keep CAP_SYS_ADMIN if we have it to ensure we give an | |
261 | * accurate result to the caller. Some kernels have a | |
262 | * kernel.unprivileged_userns_clone sysctl which can be | |
263 | * configured to make CLONE_NEWUSER require CAP_SYS_ADMIN. | |
264 | * Additionally, AppArmor may restrict unprivileged user | |
265 | * namespace creation. */ | |
266 | r = capability_bounding_set_drop(UINT64_C(1) << CAP_SYS_ADMIN, /* right_now = */ true); | |
267 | if (r < 0) { | |
268 | log_debug_errno(r, "Failed to drop capabilities: %m"); | |
269 | _exit(2); | |
270 | } | |
271 | ||
272 | r = RET_NERRNO(unshare(CLONE_NEWUSER)); | |
273 | if (r < 0 && !ERRNO_IS_NEG_PRIVILEGE(r)) | |
274 | log_debug_errno(r, "Failed to create user namespace: %m"); | |
275 | ||
276 | _exit(r >= 0 ? EXIT_SUCCESS : ERRNO_IS_NEG_PRIVILEGE(r) ? EXIT_FAILURE : 2); | |
277 | } | |
278 | ||
279 | /* The exit code records the result of the check: | |
280 | * EXIT_SUCCESS => we can use user namespaces | |
281 | * EXIT_FAILURE => we can NOT use user namespaces | |
282 | * 2 => some other error occurred */ | |
283 | r = wait_for_terminate_and_check("(sd-test-check-userns)", pid, 0); | |
284 | if (!IN_SET(r, EXIT_SUCCESS, EXIT_FAILURE)) | |
285 | log_debug("Failed to check if user namespaces can be used, assuming not."); | |
286 | ||
287 | return r == EXIT_SUCCESS; | |
288 | } | |
289 | ||
fe65d692 ZJS |
290 | static void _test(const char *file, unsigned line, const char *func, |
291 | Manager *m, const char *unit_name, int status_expected, int code_expected) { | |
281e05b6 RC |
292 | Unit *unit; |
293 | ||
26d79ab8 | 294 | ASSERT_NOT_NULL(unit_name); |
281e05b6 | 295 | |
26d79ab8 | 296 | ASSERT_OK(manager_load_startable_unit_or_warn(m, unit_name, NULL, &unit)); |
fc6172b1 RP |
297 | /* We need to start the slices as well otherwise the slice cgroups might be pruned |
298 | * in on_cgroup_empty_event. */ | |
299 | start_parent_slices(unit); | |
26d79ab8 | 300 | ASSERT_OK(unit_start(unit, NULL)); |
fe65d692 | 301 | check_main_result(file, line, func, m, unit, status_expected, code_expected); |
b6349ffd LB |
302 | |
303 | ++n_ran_tests; | |
31cd5f63 | 304 | } |
fe65d692 ZJS |
305 | #define test(m, unit_name, status_expected, code_expected) \ |
306 | _test(PROJECT_FILE, __LINE__, __func__, m, unit_name, status_expected, code_expected) | |
31cd5f63 | 307 | |
fe65d692 ZJS |
308 | static void _test_service(const char *file, unsigned line, const char *func, |
309 | Manager *m, const char *unit_name, ServiceResult result_expected) { | |
31cd5f63 AZ |
310 | Unit *unit; |
311 | ||
26d79ab8 | 312 | ASSERT_NOT_NULL(unit_name); |
31cd5f63 | 313 | |
26d79ab8 DDM |
314 | ASSERT_OK(manager_load_startable_unit_or_warn(m, unit_name, NULL, &unit)); |
315 | ASSERT_OK(unit_start(unit, NULL)); | |
fe65d692 | 316 | check_service_result(file, line, func, m, unit, result_expected); |
281e05b6 | 317 | } |
fe65d692 ZJS |
318 | #define test_service(m, unit_name, result_expected) \ |
319 | _test_service(PROJECT_FILE, __LINE__, __func__, m, unit_name, result_expected) | |
281e05b6 | 320 | |
f0e018e7 | 321 | static void test_exec_bindpaths(Manager *m) { |
26d79ab8 DDM |
322 | ASSERT_OK(mkdir_p("/tmp/test-exec-bindpaths", 0755)); |
323 | ASSERT_OK(mkdir_p("/tmp/test-exec-bindreadonlypaths", 0755)); | |
d053b72b | 324 | |
fe65d692 | 325 | test(m, "exec-bindpaths.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); |
d053b72b | 326 | |
f0e018e7 YW |
327 | (void) rm_rf("/tmp/test-exec-bindpaths", REMOVE_ROOT|REMOVE_PHYSICAL); |
328 | (void) rm_rf("/tmp/test-exec-bindreadonlypaths", REMOVE_ROOT|REMOVE_PHYSICAL); | |
d053b72b YW |
329 | } |
330 | ||
4e79aeaa | 331 | static void test_exec_cpuaffinity(Manager *m) { |
167a776d | 332 | _cleanup_(cpu_set_reset) CPUSet c = {}; |
4e79aeaa | 333 | |
26d79ab8 DDM |
334 | ASSERT_OK(cpu_set_realloc(&c, 8192)); /* just allocate the maximum possible size */ |
335 | ASSERT_OK_ERRNO(sched_getaffinity(0, c.allocated, c.set)); | |
4e79aeaa | 336 | |
167a776d | 337 | if (!CPU_ISSET_S(0, c.allocated, c.set)) { |
4e79aeaa YW |
338 | log_notice("Cannot use CPU 0, skipping %s", __func__); |
339 | return; | |
340 | } | |
341 | ||
fe65d692 ZJS |
342 | test(m, "exec-cpuaffinity1.service", 0, CLD_EXITED); |
343 | test(m, "exec-cpuaffinity2.service", 0, CLD_EXITED); | |
4e79aeaa | 344 | |
167a776d ZJS |
345 | if (!CPU_ISSET_S(1, c.allocated, c.set) || |
346 | !CPU_ISSET_S(2, c.allocated, c.set)) { | |
4e79aeaa YW |
347 | log_notice("Cannot use CPU 1 or 2, skipping remaining tests in %s", __func__); |
348 | return; | |
349 | } | |
350 | ||
fe65d692 | 351 | test(m, "exec-cpuaffinity3.service", 0, CLD_EXITED); |
4e79aeaa YW |
352 | } |
353 | ||
b7cca6cc YW |
354 | static void test_exec_credentials(Manager *m) { |
355 | test(m, "exec-set-credential.service", 0, CLD_EXITED); | |
356 | test(m, "exec-load-credential.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_CREDENTIALS, CLD_EXITED); | |
357 | test(m, "exec-credentials-dir-specifier.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_CREDENTIALS, CLD_EXITED); | |
358 | } | |
359 | ||
281e05b6 | 360 | static void test_exec_workingdirectory(Manager *m) { |
26d79ab8 | 361 | ASSERT_OK(mkdir_p("/tmp/test-exec_workingdirectory", 0755)); |
281e05b6 | 362 | |
fe65d692 ZJS |
363 | test(m, "exec-workingdirectory.service", 0, CLD_EXITED); |
364 | test(m, "exec-workingdirectory-trailing-dot.service", 0, CLD_EXITED); | |
281e05b6 | 365 | |
c6878637 | 366 | (void) rm_rf("/tmp/test-exec_workingdirectory", REMOVE_ROOT|REMOVE_PHYSICAL); |
281e05b6 RC |
367 | } |
368 | ||
8c35c10d | 369 | static void test_exec_execsearchpath(Manager *m) { |
26d79ab8 | 370 | ASSERT_OK(mkdir_p("/tmp/test-exec_execsearchpath", 0755)); |
8c35c10d | 371 | |
26d79ab8 | 372 | ASSERT_OK(copy_file("/bin/ls", "/tmp/test-exec_execsearchpath/ls_temp", 0, 0777, COPY_REPLACE)); |
8c35c10d | 373 | |
374 | test(m, "exec-execsearchpath.service", 0, CLD_EXITED); | |
375 | ||
26d79ab8 | 376 | ASSERT_OK(rm_rf("/tmp/test-exec_execsearchpath", REMOVE_ROOT|REMOVE_PHYSICAL)); |
8c35c10d | 377 | |
378 | test(m, "exec-execsearchpath.service", EXIT_EXEC, CLD_EXITED); | |
379 | } | |
380 | ||
381 | static void test_exec_execsearchpath_specifier(Manager *m) { | |
382 | test(m, "exec-execsearchpath-unit-specifier.service", 0, CLD_EXITED); | |
383 | } | |
384 | ||
385 | static void test_exec_execsearchpath_environment(Manager *m) { | |
386 | test(m, "exec-execsearchpath-environment.service", 0, CLD_EXITED); | |
387 | test(m, "exec-execsearchpath-environment-path-set.service", 0, CLD_EXITED); | |
388 | } | |
389 | ||
390 | static void test_exec_execsearchpath_environment_files(Manager *m) { | |
391 | static const char path_not_set[] = | |
392 | "VAR1='word1 word2'\n" | |
393 | "VAR2=word3 \n" | |
394 | "# comment1\n" | |
395 | "\n" | |
396 | "; comment2\n" | |
397 | " ; # comment3\n" | |
398 | "line without an equal\n" | |
399 | "VAR3='$word 5 6'\n" | |
400 | "VAR4='new\nline'\n" | |
401 | "VAR5=password\\with\\backslashes"; | |
402 | ||
403 | static const char path_set[] = | |
404 | "VAR1='word1 word2'\n" | |
405 | "VAR2=word3 \n" | |
406 | "# comment1\n" | |
407 | "\n" | |
408 | "; comment2\n" | |
409 | " ; # comment3\n" | |
410 | "line without an equal\n" | |
411 | "VAR3='$word 5 6'\n" | |
412 | "VAR4='new\nline'\n" | |
413 | "VAR5=password\\with\\backslashes\n" | |
414 | "PATH=/usr"; | |
415 | ||
416 | int r; | |
417 | ||
418 | r = write_string_file("/tmp/test-exec_execsearchpath_environmentfile.conf", path_not_set, WRITE_STRING_FILE_CREATE); | |
26d79ab8 | 419 | ASSERT_OK(r); |
8c35c10d | 420 | |
421 | test(m, "exec-execsearchpath-environmentfile.service", 0, CLD_EXITED); | |
422 | ||
423 | (void) unlink("/tmp/test-exec_environmentfile.conf"); | |
424 | ||
425 | ||
426 | r = write_string_file("/tmp/test-exec_execsearchpath_environmentfile-set.conf", path_set, WRITE_STRING_FILE_CREATE); | |
26d79ab8 | 427 | ASSERT_OK(r); |
8c35c10d | 428 | |
429 | test(m, "exec-execsearchpath-environmentfile-set.service", 0, CLD_EXITED); | |
430 | ||
431 | (void) unlink("/tmp/test-exec_environmentfile-set.conf"); | |
432 | } | |
433 | ||
434 | static void test_exec_execsearchpath_passenvironment(Manager *m) { | |
26d79ab8 DDM |
435 | ASSERT_OK_ERRNO(setenv("VAR1", "word1 word2", 1)); |
436 | ASSERT_OK_ERRNO(setenv("VAR2", "word3", 1)); | |
437 | ASSERT_OK_ERRNO(setenv("VAR3", "$word 5 6", 1)); | |
438 | ASSERT_OK_ERRNO(setenv("VAR4", "new\nline", 1)); | |
439 | ASSERT_OK_ERRNO(setenv("VAR5", "passwordwithbackslashes", 1)); | |
8c35c10d | 440 | |
441 | test(m, "exec-execsearchpath-passenvironment.service", 0, CLD_EXITED); | |
442 | ||
26d79ab8 | 443 | ASSERT_OK_ERRNO(setenv("PATH", "/usr", 1)); |
8c35c10d | 444 | test(m, "exec-execsearchpath-passenvironment-set.service", 0, CLD_EXITED); |
445 | ||
26d79ab8 DDM |
446 | ASSERT_OK_ERRNO(unsetenv("VAR1")); |
447 | ASSERT_OK_ERRNO(unsetenv("VAR2")); | |
448 | ASSERT_OK_ERRNO(unsetenv("VAR3")); | |
449 | ASSERT_OK_ERRNO(unsetenv("VAR4")); | |
450 | ASSERT_OK_ERRNO(unsetenv("VAR5")); | |
451 | ASSERT_OK_ERRNO(unsetenv("PATH")); | |
8c35c10d | 452 | } |
453 | ||
281e05b6 | 454 | static void test_exec_personality(Manager *m) { |
281e05b6 | 455 | #if defined(__x86_64__) |
fe65d692 | 456 | test(m, "exec-personality-x86-64.service", 0, CLD_EXITED); |
7517f51e | 457 | |
1b0cc135 LB |
458 | #elif defined(__s390x__) |
459 | test(m, "exec-personality-s390x.service", 0, CLD_EXITED); | |
460 | ||
7517f51e | 461 | #elif defined(__s390__) |
fe65d692 | 462 | test(m, "exec-personality-s390.service", 0, CLD_EXITED); |
7517f51e | 463 | |
12591863 JS |
464 | #elif defined(__powerpc64__) |
465 | # if __BYTE_ORDER == __BIG_ENDIAN | |
fe65d692 | 466 | test(m, "exec-personality-ppc64.service", 0, CLD_EXITED); |
12591863 | 467 | # else |
fe65d692 | 468 | test(m, "exec-personality-ppc64le.service", 0, CLD_EXITED); |
12591863 JS |
469 | # endif |
470 | ||
471 | #elif defined(__aarch64__) | |
fe65d692 | 472 | test(m, "exec-personality-aarch64.service", 0, CLD_EXITED); |
12591863 | 473 | |
5798eb4c | 474 | #elif defined(__i386__) |
fe65d692 | 475 | test(m, "exec-personality-x86.service", 0, CLD_EXITED); |
f106a639 | 476 | #elif defined(__loongarch_lp64) |
646b0112 | 477 | test(m, "exec-personality-loongarch64.service", 0, CLD_EXITED); |
f0e018e7 YW |
478 | #else |
479 | log_notice("Unknown personality, skipping %s", __func__); | |
281e05b6 RC |
480 | #endif |
481 | } | |
482 | ||
483 | static void test_exec_ignoresigpipe(Manager *m) { | |
fe65d692 ZJS |
484 | test(m, "exec-ignoresigpipe-yes.service", 0, CLD_EXITED); |
485 | test(m, "exec-ignoresigpipe-no.service", SIGPIPE, CLD_KILLED); | |
281e05b6 RC |
486 | } |
487 | ||
488 | static void test_exec_privatetmp(Manager *m) { | |
26d79ab8 | 489 | ASSERT_OK(touch("/tmp/test-exec_privatetmp")); |
281e05b6 | 490 | |
d0c6136f NR |
491 | if (MANAGER_IS_SYSTEM(m) || have_userns_privileges()) { |
492 | test(m, "exec-privatetmp-yes.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); | |
493 | test(m, "exec-privatetmp-disabled-by-prefix.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); | |
494 | } | |
495 | ||
fe65d692 | 496 | test(m, "exec-privatetmp-no.service", 0, CLD_EXITED); |
281e05b6 | 497 | |
5000cea8 | 498 | (void) unlink("/tmp/test-exec_privatetmp"); |
281e05b6 RC |
499 | } |
500 | ||
501 | static void test_exec_privatedevices(Manager *m) { | |
f0e018e7 YW |
502 | int r; |
503 | ||
4dd4cb8f | 504 | if (detect_container() > 0) { |
f0e018e7 | 505 | log_notice("Testing in container, skipping %s", __func__); |
4dd4cb8f SM |
506 | return; |
507 | } | |
6086d2da | 508 | if (!is_inaccessible_available()) { |
f0e018e7 | 509 | log_notice("Testing without inaccessible, skipping %s", __func__); |
6086d2da DP |
510 | return; |
511 | } | |
512 | ||
d0c6136f NR |
513 | if (MANAGER_IS_SYSTEM(m) || have_userns_privileges()) { |
514 | test(m, "exec-privatedevices-yes.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); | |
515 | if (access("/dev/kmsg", F_OK) >= 0) | |
516 | test(m, "exec-privatedevices-bind.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); | |
517 | test(m, "exec-privatedevices-disabled-by-prefix.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); | |
518 | test(m, "exec-privatedevices-yes-with-group.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); | |
519 | } | |
520 | ||
fe65d692 | 521 | test(m, "exec-privatedevices-no.service", 0, CLD_EXITED); |
6086d2da | 522 | |
0608ba98 ZJS |
523 | /* We use capsh to test if the capabilities are |
524 | * properly set, so be sure that it exists */ | |
f7bc0c32 | 525 | r = find_executable("capsh", NULL); |
0608ba98 | 526 | if (r < 0) { |
5cd33ccc | 527 | log_notice_errno(r, "Could not find capsh binary, skipping remaining tests in %s: %m", __func__); |
6086d2da DP |
528 | return; |
529 | } | |
530 | ||
d0c6136f NR |
531 | if (MANAGER_IS_SYSTEM(m) || have_userns_privileges()) { |
532 | test(m, "exec-privatedevices-yes-capability-mknod.service", can_unshare || MANAGER_IS_SYSTEM(m) ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
533 | test(m, "exec-privatedevices-yes-capability-sys-rawio.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
534 | } | |
535 | ||
adeff822 | 536 | test(m, "exec-privatedevices-no-capability-mknod.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_FAILURE, CLD_EXITED); |
adeff822 | 537 | test(m, "exec-privatedevices-no-capability-sys-rawio.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_FAILURE, CLD_EXITED); |
615a1f4b DH |
538 | } |
539 | ||
7e46b29b | 540 | static void test_exec_protecthome(Manager *m) { |
9ca58284 ZJS |
541 | if (!can_unshare) { |
542 | log_notice("Cannot reliably unshare, skipping %s", __func__); | |
543 | return; | |
544 | } | |
545 | ||
fe65d692 | 546 | test(m, "exec-protecthome-tmpfs-vs-protectsystem-strict.service", 0, CLD_EXITED); |
7e46b29b YW |
547 | } |
548 | ||
4982dbcc | 549 | static void test_exec_protectkernelmodules(Manager *m) { |
0608ba98 ZJS |
550 | int r; |
551 | ||
3ae33295 | 552 | if (detect_container() > 0) { |
f0e018e7 | 553 | log_notice("Testing in container, skipping %s", __func__); |
3ae33295 DH |
554 | return; |
555 | } | |
6086d2da | 556 | if (!is_inaccessible_available()) { |
f0e018e7 | 557 | log_notice("Testing without inaccessible, skipping %s", __func__); |
6086d2da DP |
558 | return; |
559 | } | |
3ae33295 | 560 | |
f7bc0c32 | 561 | r = find_executable("capsh", NULL); |
0608ba98 | 562 | if (r < 0) { |
5cd33ccc | 563 | log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); |
0608ba98 ZJS |
564 | return; |
565 | } | |
566 | ||
adeff822 | 567 | test(m, "exec-protectkernelmodules-no-capabilities.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_FAILURE, CLD_EXITED); |
d0c6136f NR |
568 | |
569 | if (MANAGER_IS_SYSTEM(m) || have_userns_privileges()) { | |
570 | test(m, "exec-protectkernelmodules-yes-capabilities.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
571 | test(m, "exec-protectkernelmodules-yes-mount-propagation.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); | |
572 | } | |
3ae33295 DH |
573 | } |
574 | ||
f78b36f0 | 575 | static void test_exec_readonlypaths(Manager *m) { |
34b86909 | 576 | |
d0c6136f NR |
577 | if (MANAGER_IS_SYSTEM(m) || have_userns_privileges()) |
578 | test(m, "exec-readonlypaths-simple.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); | |
f0e018e7 YW |
579 | |
580 | if (path_is_read_only_fs("/var") > 0) { | |
581 | log_notice("Directory /var is readonly, skipping remaining tests in %s", __func__); | |
34b86909 | 582 | return; |
f0e018e7 | 583 | } |
34b86909 | 584 | |
6ef721cb | 585 | test(m, "exec-readonlypaths.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); |
fe65d692 | 586 | test(m, "exec-readonlypaths-with-bindpaths.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); |
6ef721cb | 587 | test(m, "exec-readonlypaths-mount-propagation.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); |
cdfbd1fb DH |
588 | } |
589 | ||
590 | static void test_exec_readwritepaths(Manager *m) { | |
34b86909 | 591 | |
f0e018e7 YW |
592 | if (path_is_read_only_fs("/") > 0) { |
593 | log_notice("Root directory is readonly, skipping %s", __func__); | |
34b86909 | 594 | return; |
f0e018e7 | 595 | } |
34b86909 | 596 | |
6ef721cb | 597 | test(m, "exec-readwritepaths-mount-propagation.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); |
cdfbd1fb DH |
598 | } |
599 | ||
600 | static void test_exec_inaccessiblepaths(Manager *m) { | |
34b86909 | 601 | |
f0e018e7 YW |
602 | if (!is_inaccessible_available()) { |
603 | log_notice("Testing without inaccessible, skipping %s", __func__); | |
34b86909 | 604 | return; |
f0e018e7 | 605 | } |
34b86909 | 606 | |
d0c6136f NR |
607 | if (MANAGER_IS_SYSTEM(m) || have_userns_privileges()) |
608 | test(m, "exec-inaccessiblepaths-sys.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); | |
f78b36f0 | 609 | |
f0e018e7 YW |
610 | if (path_is_read_only_fs("/") > 0) { |
611 | log_notice("Root directory is readonly, skipping remaining tests in %s", __func__); | |
af4af186 EV |
612 | return; |
613 | } | |
614 | ||
6ef721cb | 615 | test(m, "exec-inaccessiblepaths-mount-propagation.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); |
c090d74d TR |
616 | } |
617 | ||
42867dfe YW |
618 | static int on_spawn_io(sd_event_source *s, int fd, uint32_t revents, void *userdata) { |
619 | char **result = userdata; | |
620 | char buf[4096]; | |
621 | ssize_t l; | |
622 | ||
26d79ab8 DDM |
623 | ASSERT_NOT_NULL(s); |
624 | ASSERT_GT(fd, 0); | |
42867dfe YW |
625 | |
626 | l = read(fd, buf, sizeof(buf) - 1); | |
627 | if (l < 0) { | |
628 | if (errno == EAGAIN) | |
629 | goto reenable; | |
630 | ||
631 | return 0; | |
632 | } | |
633 | if (l == 0) | |
634 | return 0; | |
635 | ||
636 | buf[l] = '\0'; | |
637 | if (result) | |
26d79ab8 | 638 | ASSERT_NOT_NULL(strextend(result, buf)); |
42867dfe YW |
639 | else |
640 | log_error("ldd: %s", buf); | |
641 | ||
642 | reenable: | |
643 | /* Re-enable the event source if we did not encounter EOF */ | |
26d79ab8 | 644 | ASSERT_OK(sd_event_source_set_enabled(s, SD_EVENT_ONESHOT)); |
42867dfe YW |
645 | return 0; |
646 | } | |
647 | ||
648 | static int on_spawn_timeout(sd_event_source *s, uint64_t usec, void *userdata) { | |
649 | pid_t *pid = userdata; | |
650 | ||
26d79ab8 | 651 | ASSERT_NOT_NULL(pid); |
42867dfe YW |
652 | |
653 | (void) kill(*pid, SIGKILL); | |
654 | ||
655 | return 1; | |
656 | } | |
657 | ||
658 | static int on_spawn_sigchld(sd_event_source *s, const siginfo_t *si, void *userdata) { | |
659 | int ret = -EIO; | |
660 | ||
26d79ab8 | 661 | ASSERT_NOT_NULL(si); |
42867dfe YW |
662 | |
663 | if (si->si_code == CLD_EXITED) | |
664 | ret = si->si_status; | |
665 | ||
666 | sd_event_exit(sd_event_source_get_event(s), ret); | |
667 | return 1; | |
668 | } | |
669 | ||
670 | static int find_libraries(const char *exec, char ***ret) { | |
671 | _cleanup_(sd_event_unrefp) sd_event *e = NULL; | |
672 | _cleanup_(sd_event_source_unrefp) sd_event_source *sigchld_source = NULL; | |
673 | _cleanup_(sd_event_source_unrefp) sd_event_source *stdout_source = NULL; | |
674 | _cleanup_(sd_event_source_unrefp) sd_event_source *stderr_source = NULL; | |
71136404 | 675 | _cleanup_close_pair_ int outpipe[2] = EBADF_PAIR, errpipe[2] = EBADF_PAIR; |
42867dfe YW |
676 | _cleanup_strv_free_ char **libraries = NULL; |
677 | _cleanup_free_ char *result = NULL; | |
678 | pid_t pid; | |
679 | int r; | |
680 | ||
26d79ab8 DDM |
681 | ASSERT_NOT_NULL(exec); |
682 | ASSERT_NOT_NULL(ret); | |
42867dfe | 683 | |
26d79ab8 | 684 | ASSERT_OK(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD)); |
42867dfe | 685 | |
26d79ab8 DDM |
686 | ASSERT_OK_ERRNO(pipe2(outpipe, O_NONBLOCK|O_CLOEXEC)); |
687 | ASSERT_OK_ERRNO(pipe2(errpipe, O_NONBLOCK|O_CLOEXEC)); | |
42867dfe | 688 | |
0c2aedb4 YW |
689 | r = safe_fork_full("(spawn-ldd)", |
690 | (int[]) { -EBADF, outpipe[1], errpipe[1] }, | |
691 | NULL, 0, | |
e9ccae31 | 692 | FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGTERM|FORK_REARRANGE_STDIO|FORK_LOG, &pid); |
26d79ab8 | 693 | ASSERT_OK(r); |
42867dfe | 694 | if (r == 0) { |
42867dfe YW |
695 | execlp("ldd", "ldd", exec, NULL); |
696 | _exit(EXIT_FAILURE); | |
697 | } | |
698 | ||
699 | outpipe[1] = safe_close(outpipe[1]); | |
700 | errpipe[1] = safe_close(errpipe[1]); | |
701 | ||
26d79ab8 | 702 | ASSERT_OK(sd_event_new(&e)); |
42867dfe | 703 | |
26d79ab8 DDM |
704 | ASSERT_OK(sd_event_add_time_relative(e, NULL, CLOCK_MONOTONIC, |
705 | 10 * USEC_PER_SEC, USEC_PER_SEC, on_spawn_timeout, &pid)); | |
706 | ASSERT_OK(sd_event_add_io(e, &stdout_source, outpipe[0], EPOLLIN, on_spawn_io, &result)); | |
707 | ASSERT_OK(sd_event_source_set_enabled(stdout_source, SD_EVENT_ONESHOT)); | |
708 | ASSERT_OK(sd_event_add_io(e, &stderr_source, errpipe[0], EPOLLIN, on_spawn_io, NULL)); | |
709 | ASSERT_OK(sd_event_source_set_enabled(stderr_source, SD_EVENT_ONESHOT)); | |
710 | ASSERT_OK(sd_event_add_child(e, &sigchld_source, pid, WEXITED, on_spawn_sigchld, NULL)); | |
42867dfe | 711 | /* SIGCHLD should be processed after IO is complete */ |
26d79ab8 | 712 | ASSERT_OK(sd_event_source_set_priority(sigchld_source, SD_EVENT_PRIORITY_NORMAL + 1)); |
42867dfe | 713 | |
26d79ab8 | 714 | ASSERT_OK(sd_event_loop(e)); |
42867dfe YW |
715 | |
716 | _cleanup_strv_free_ char **v = NULL; | |
26d79ab8 | 717 | ASSERT_OK(strv_split_newlines_full(&v, result, 0)); |
42867dfe | 718 | |
42867dfe YW |
719 | STRV_FOREACH(q, v) { |
720 | _cleanup_free_ char *word = NULL; | |
721 | const char *p = *q; | |
722 | ||
723 | r = extract_first_word(&p, &word, NULL, 0); | |
26d79ab8 | 724 | ASSERT_OK(r); |
42867dfe YW |
725 | if (r == 0) |
726 | continue; | |
727 | ||
728 | if (path_is_absolute(word)) { | |
26d79ab8 | 729 | ASSERT_OK(strv_consume(&libraries, TAKE_PTR(word))); |
42867dfe YW |
730 | continue; |
731 | } | |
732 | ||
733 | word = mfree(word); | |
734 | r = extract_first_word(&p, &word, NULL, 0); | |
26d79ab8 | 735 | ASSERT_OK(r); |
42867dfe YW |
736 | if (r == 0) |
737 | continue; | |
738 | ||
739 | if (!streq_ptr(word, "=>")) | |
740 | continue; | |
741 | ||
742 | word = mfree(word); | |
743 | r = extract_first_word(&p, &word, NULL, 0); | |
26d79ab8 | 744 | ASSERT_OK(r); |
42867dfe YW |
745 | if (r == 0) |
746 | continue; | |
747 | ||
748 | if (path_is_absolute(word)) { | |
26d79ab8 | 749 | ASSERT_OK(strv_consume(&libraries, TAKE_PTR(word))); |
42867dfe YW |
750 | continue; |
751 | } | |
752 | } | |
753 | ||
754 | *ret = TAKE_PTR(libraries); | |
755 | return 0; | |
756 | } | |
757 | ||
758 | static void test_exec_mount_apivfs(Manager *m) { | |
759 | _cleanup_free_ char *fullpath_touch = NULL, *fullpath_test = NULL, *data = NULL; | |
760 | _cleanup_strv_free_ char **libraries = NULL, **libraries_test = NULL; | |
761 | int r; | |
762 | ||
26d79ab8 | 763 | ASSERT_NOT_NULL(user_runtime_unit_dir); |
42867dfe | 764 | |
9f452259 YW |
765 | r = find_executable("ldd", NULL); |
766 | if (r < 0) { | |
767 | log_notice_errno(r, "Skipping %s, could not find 'ldd' command: %m", __func__); | |
768 | return; | |
769 | } | |
42867dfe YW |
770 | r = find_executable("touch", &fullpath_touch); |
771 | if (r < 0) { | |
772 | log_notice_errno(r, "Skipping %s, could not find 'touch' command: %m", __func__); | |
773 | return; | |
774 | } | |
775 | r = find_executable("test", &fullpath_test); | |
776 | if (r < 0) { | |
777 | log_notice_errno(r, "Skipping %s, could not find 'test' command: %m", __func__); | |
778 | return; | |
779 | } | |
780 | ||
d0c6136f NR |
781 | if (MANAGER_IS_USER(m) && !have_userns_privileges()) |
782 | return (void)log_notice("Skipping %s, do not have user namespace privileges", __func__); | |
783 | ||
26d79ab8 DDM |
784 | ASSERT_OK(find_libraries(fullpath_touch, &libraries)); |
785 | ASSERT_OK(find_libraries(fullpath_test, &libraries_test)); | |
786 | ASSERT_OK(strv_extend_strv(&libraries, libraries_test, true)); | |
42867dfe | 787 | |
26d79ab8 DDM |
788 | ASSERT_NOT_NULL(strextend(&data, "[Service]\n")); |
789 | ASSERT_NOT_NULL(strextend(&data, "ExecStart=", fullpath_touch, " /aaa\n")); | |
790 | ASSERT_NOT_NULL(strextend(&data, "ExecStart=", fullpath_test, " -f /aaa\n")); | |
791 | ASSERT_NOT_NULL(strextend(&data, "BindReadOnlyPaths=", fullpath_touch, "\n")); | |
792 | ASSERT_NOT_NULL(strextend(&data, "BindReadOnlyPaths=", fullpath_test, "\n")); | |
42867dfe | 793 | |
42867dfe | 794 | STRV_FOREACH(p, libraries) |
26d79ab8 | 795 | ASSERT_NOT_NULL(strextend(&data, "BindReadOnlyPaths=", *p, "\n")); |
42867dfe | 796 | |
26d79ab8 | 797 | ASSERT_OK(write_drop_in(user_runtime_unit_dir, "exec-mount-apivfs-no.service", 10, "bind-mount", data)); |
42867dfe | 798 | |
26d79ab8 | 799 | ASSERT_OK(mkdir_p("/tmp/test-exec-mount-apivfs-no/root", 0755)); |
42867dfe | 800 | |
6ef721cb | 801 | test(m, "exec-mount-apivfs-no.service", can_unshare || !MANAGER_IS_SYSTEM(m) ? 0 : EXIT_NAMESPACE, CLD_EXITED); |
42867dfe YW |
802 | |
803 | (void) rm_rf("/tmp/test-exec-mount-apivfs-no/root", REMOVE_ROOT|REMOVE_PHYSICAL); | |
804 | } | |
805 | ||
ddc155b2 TM |
806 | static void test_exec_noexecpaths(Manager *m) { |
807 | ||
d0c6136f NR |
808 | if (MANAGER_IS_SYSTEM(m) || have_userns_privileges()) |
809 | test(m, "exec-noexecpaths-simple.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); | |
810 | else | |
811 | return (void)log_notice("Skipping %s, do not have user namespace privileges", __func__); | |
ddc155b2 TM |
812 | } |
813 | ||
4cac89bd YW |
814 | static void test_exec_temporaryfilesystem(Manager *m) { |
815 | ||
fe65d692 ZJS |
816 | test(m, "exec-temporaryfilesystem-options.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); |
817 | test(m, "exec-temporaryfilesystem-ro.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
818 | test(m, "exec-temporaryfilesystem-rw.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
819 | test(m, "exec-temporaryfilesystem-usr.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
4cac89bd YW |
820 | } |
821 | ||
281e05b6 | 822 | static void test_exec_systemcallfilter(Manager *m) { |
349cc4a5 | 823 | #if HAVE_SECCOMP |
738c74d7 YW |
824 | int r; |
825 | ||
f0e018e7 YW |
826 | if (!is_seccomp_available()) { |
827 | log_notice("Seccomp not available, skipping %s", __func__); | |
83f12b27 | 828 | return; |
f0e018e7 YW |
829 | } |
830 | ||
fe65d692 ZJS |
831 | test(m, "exec-systemcallfilter-not-failing.service", 0, CLD_EXITED); |
832 | test(m, "exec-systemcallfilter-not-failing2.service", 0, CLD_EXITED); | |
e975a945 | 833 | test(m, "exec-systemcallfilter-not-failing3.service", 0, CLD_EXITED); |
fe65d692 ZJS |
834 | test(m, "exec-systemcallfilter-failing.service", SIGSYS, CLD_KILLED); |
835 | test(m, "exec-systemcallfilter-failing2.service", SIGSYS, CLD_KILLED); | |
e975a945 | 836 | test(m, "exec-systemcallfilter-failing3.service", SIGSYS, CLD_KILLED); |
738c74d7 | 837 | |
f7bc0c32 | 838 | r = find_executable("python3", NULL); |
738c74d7 YW |
839 | if (r < 0) { |
840 | log_notice_errno(r, "Skipping remaining tests in %s, could not find python3 binary: %m", __func__); | |
841 | return; | |
842 | } | |
843 | ||
fe65d692 ZJS |
844 | test(m, "exec-systemcallfilter-with-errno-name.service", errno_from_name("EILSEQ"), CLD_EXITED); |
845 | test(m, "exec-systemcallfilter-with-errno-number.service", 255, CLD_EXITED); | |
846 | test(m, "exec-systemcallfilter-with-errno-multi.service", errno_from_name("EILSEQ"), CLD_EXITED); | |
a62f651b | 847 | test(m, "exec-systemcallfilter-with-errno-in-allow-list.service", errno_from_name("EILSEQ"), CLD_EXITED); |
fe65d692 ZJS |
848 | test(m, "exec-systemcallfilter-override-error-action.service", SIGSYS, CLD_KILLED); |
849 | test(m, "exec-systemcallfilter-override-error-action2.service", errno_from_name("EILSEQ"), CLD_EXITED); | |
e720cebf ILG |
850 | |
851 | test(m, "exec-systemcallfilter-nonewprivileges.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_GROUP, CLD_EXITED); | |
852 | test(m, "exec-systemcallfilter-nonewprivileges-protectclock.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_GROUP, CLD_EXITED); | |
853 | ||
854 | r = find_executable("capsh", NULL); | |
855 | if (r < 0) { | |
856 | log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); | |
857 | return; | |
858 | } | |
859 | ||
860 | test(m, "exec-systemcallfilter-nonewprivileges-bounding1.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_GROUP, CLD_EXITED); | |
861 | test(m, "exec-systemcallfilter-nonewprivileges-bounding2.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_GROUP, CLD_EXITED); | |
281e05b6 RC |
862 | #endif |
863 | } | |
864 | ||
865 | static void test_exec_systemcallerrornumber(Manager *m) { | |
349cc4a5 | 866 | #if HAVE_SECCOMP |
738c74d7 YW |
867 | int r; |
868 | ||
f0e018e7 YW |
869 | if (!is_seccomp_available()) { |
870 | log_notice("Seccomp not available, skipping %s", __func__); | |
7a18854f | 871 | return; |
f0e018e7 YW |
872 | } |
873 | ||
f7bc0c32 | 874 | r = find_executable("python3", NULL); |
738c74d7 YW |
875 | if (r < 0) { |
876 | log_notice_errno(r, "Skipping %s, could not find python3 binary: %m", __func__); | |
877 | return; | |
878 | } | |
879 | ||
fe65d692 ZJS |
880 | test(m, "exec-systemcallerrornumber-name.service", errno_from_name("EACCES"), CLD_EXITED); |
881 | test(m, "exec-systemcallerrornumber-number.service", 255, CLD_EXITED); | |
281e05b6 RC |
882 | #endif |
883 | } | |
884 | ||
f0e018e7 | 885 | static void test_exec_restrictnamespaces(Manager *m) { |
349cc4a5 | 886 | #if HAVE_SECCOMP |
f0e018e7 YW |
887 | if (!is_seccomp_available()) { |
888 | log_notice("Seccomp not available, skipping %s", __func__); | |
97e60383 | 889 | return; |
f0e018e7 | 890 | } |
97e60383 | 891 | |
fe65d692 ZJS |
892 | test(m, "exec-restrictnamespaces-no.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); |
893 | test(m, "exec-restrictnamespaces-yes.service", 1, CLD_EXITED); | |
894 | test(m, "exec-restrictnamespaces-mnt.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
895 | test(m, "exec-restrictnamespaces-mnt-deny-list.service", 1, CLD_EXITED); | |
896 | test(m, "exec-restrictnamespaces-merge-and.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
897 | test(m, "exec-restrictnamespaces-merge-or.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
898 | test(m, "exec-restrictnamespaces-merge-all.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED); | |
97e60383 DH |
899 | #endif |
900 | } | |
901 | ||
f0e018e7 | 902 | static void test_exec_systemcallfilter_system(Manager *m) { |
4967da2d FS |
903 | /* Skip this particular test case when running under ASan, as |
904 | * LSan intermittently segfaults when accessing memory right | |
905 | * after the test finishes. Generally, ASan & LSan don't like | |
906 | * the seccomp stuff. | |
907 | */ | |
908 | #if HAVE_SECCOMP && !HAS_FEATURE_ADDRESS_SANITIZER | |
f0e018e7 YW |
909 | if (!is_seccomp_available()) { |
910 | log_notice("Seccomp not available, skipping %s", __func__); | |
83f12b27 | 911 | return; |
f0e018e7 | 912 | } |
57c2efa0 | 913 | |
4e032f65 | 914 | test(m, "exec-systemcallfilter-system-user.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_GROUP, CLD_EXITED); |
69b07407 | 915 | |
57c2efa0 | 916 | if (!check_nobody_user_and_group()) { |
5cd33ccc | 917 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
57c2efa0 YW |
918 | return; |
919 | } | |
920 | ||
69b07407 | 921 | if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { |
5cd33ccc | 922 | log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); |
69b07407 YW |
923 | return; |
924 | } | |
925 | ||
4e032f65 | 926 | test(m, "exec-systemcallfilter-system-user-" NOBODY_USER_NAME ".service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_GROUP, CLD_EXITED); |
19c0b0b9 RC |
927 | #endif |
928 | } | |
929 | ||
281e05b6 | 930 | static void test_exec_user(Manager *m) { |
4e032f65 | 931 | test(m, "exec-user.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_GROUP, CLD_EXITED); |
69b07407 | 932 | |
57c2efa0 | 933 | if (!check_nobody_user_and_group()) { |
5cd33ccc | 934 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
57c2efa0 YW |
935 | return; |
936 | } | |
937 | ||
69b07407 | 938 | if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { |
5cd33ccc | 939 | log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); |
69b07407 YW |
940 | return; |
941 | } | |
942 | ||
4e032f65 | 943 | test(m, "exec-user-" NOBODY_USER_NAME ".service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_GROUP, CLD_EXITED); |
281e05b6 RC |
944 | } |
945 | ||
946 | static void test_exec_group(Manager *m) { | |
4e032f65 | 947 | test(m, "exec-group.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_GROUP, CLD_EXITED); |
69b07407 | 948 | |
57c2efa0 | 949 | if (!check_nobody_user_and_group()) { |
5cd33ccc | 950 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
57c2efa0 YW |
951 | return; |
952 | } | |
953 | ||
69b07407 | 954 | if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) { |
5cd33ccc | 955 | log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__); |
69b07407 YW |
956 | return; |
957 | } | |
958 | ||
4e032f65 | 959 | test(m, "exec-group-" NOBODY_GROUP_NAME ".service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_GROUP, CLD_EXITED); |
281e05b6 RC |
960 | } |
961 | ||
f0e018e7 | 962 | static void test_exec_supplementarygroups(Manager *m) { |
4e032f65 YW |
963 | int status = MANAGER_IS_SYSTEM(m) ? 0 : EXIT_GROUP; |
964 | test(m, "exec-supplementarygroups.service", status, CLD_EXITED); | |
965 | test(m, "exec-supplementarygroups-single-group.service", status, CLD_EXITED); | |
966 | test(m, "exec-supplementarygroups-single-group-user.service", status, CLD_EXITED); | |
967 | test(m, "exec-supplementarygroups-multiple-groups-default-group-user.service", status, CLD_EXITED); | |
968 | test(m, "exec-supplementarygroups-multiple-groups-withgid.service", status, CLD_EXITED); | |
969 | test(m, "exec-supplementarygroups-multiple-groups-withuid.service", status, CLD_EXITED); | |
86b838ea DH |
970 | } |
971 | ||
cced2b98 ZJS |
972 | static char* private_directory_bad(Manager *m) { |
973 | /* This mirrors setup_exec_directory(). */ | |
974 | ||
975 | for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) { | |
976 | _cleanup_free_ char *p = NULL; | |
977 | struct stat st; | |
978 | ||
26d79ab8 | 979 | ASSERT_NOT_NULL(p = path_join(m->prefix[dt], "private")); |
cced2b98 ZJS |
980 | |
981 | if (stat(p, &st) >= 0 && | |
982 | (st.st_mode & (S_IRWXG|S_IRWXO))) | |
983 | return TAKE_PTR(p); | |
984 | } | |
985 | ||
986 | return NULL; | |
987 | } | |
988 | ||
f0e018e7 | 989 | static void test_exec_dynamicuser(Manager *m) { |
cced2b98 ZJS |
990 | _cleanup_free_ char *bad = private_directory_bad(m); |
991 | if (bad) { | |
992 | log_warning("%s: %s has bad permissions, skipping test.", __func__, bad); | |
993 | return; | |
994 | } | |
b7172f34 | 995 | |
d1b74295 FS |
996 | if (strstr_ptr(ci_environment(), "github-actions")) { |
997 | log_notice("%s: skipping test on GH Actions because of systemd/systemd#10337", __func__); | |
998 | return; | |
999 | } | |
1000 | ||
4e032f65 YW |
1001 | int status = can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_NAMESPACE : EXIT_GROUP; |
1002 | ||
1003 | test(m, "exec-dynamicuser-fixeduser.service", status, CLD_EXITED); | |
9f82d685 | 1004 | if (check_user_has_group_with_same_name("adm")) |
4e032f65 | 1005 | test(m, "exec-dynamicuser-fixeduser-adm.service", status, CLD_EXITED); |
9f82d685 | 1006 | if (check_user_has_group_with_same_name("games")) |
4e032f65 YW |
1007 | test(m, "exec-dynamicuser-fixeduser-games.service", status, CLD_EXITED); |
1008 | test(m, "exec-dynamicuser-fixeduser-one-supplementarygroup.service", status, CLD_EXITED); | |
1009 | test(m, "exec-dynamicuser-supplementarygroups.service", status, CLD_EXITED); | |
1010 | test(m, "exec-dynamicuser-statedir.service", status, CLD_EXITED); | |
028f3a7f | 1011 | |
f5939651 | 1012 | (void) rm_rf("/var/lib/quux", REMOVE_ROOT|REMOVE_PHYSICAL); |
1c587309 YW |
1013 | (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL); |
1014 | (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL); | |
f5939651 TM |
1015 | (void) rm_rf("/var/lib/waldo", REMOVE_ROOT|REMOVE_PHYSICAL); |
1016 | (void) rm_rf("/var/lib/private/quux", REMOVE_ROOT|REMOVE_PHYSICAL); | |
1c587309 YW |
1017 | (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL); |
1018 | (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL); | |
f5939651 | 1019 | (void) rm_rf("/var/lib/private/waldo", REMOVE_ROOT|REMOVE_PHYSICAL); |
1c587309 | 1020 | |
fe65d692 | 1021 | test(m, "exec-dynamicuser-statedir-migrate-step1.service", 0, CLD_EXITED); |
4e032f65 | 1022 | test(m, "exec-dynamicuser-statedir-migrate-step2.service", status, CLD_EXITED); |
fe65d692 | 1023 | test(m, "exec-dynamicuser-statedir-migrate-step1.service", 0, CLD_EXITED); |
1c587309 | 1024 | |
028f3a7f YW |
1025 | (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL); |
1026 | (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL); | |
1027 | (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL); | |
1028 | (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL); | |
e4c01fe6 | 1029 | |
4e032f65 YW |
1030 | test(m, "exec-dynamicuser-runtimedirectory1.service", status, CLD_EXITED); |
1031 | test(m, "exec-dynamicuser-runtimedirectory2.service", status, CLD_EXITED); | |
1032 | test(m, "exec-dynamicuser-runtimedirectory3.service", status, CLD_EXITED); | |
2b9ac11e DH |
1033 | } |
1034 | ||
281e05b6 | 1035 | static void test_exec_environment(Manager *m) { |
fe65d692 ZJS |
1036 | test(m, "exec-environment-no-substitute.service", 0, CLD_EXITED); |
1037 | test(m, "exec-environment.service", 0, CLD_EXITED); | |
1038 | test(m, "exec-environment-multiple.service", 0, CLD_EXITED); | |
1039 | test(m, "exec-environment-empty.service", 0, CLD_EXITED); | |
281e05b6 RC |
1040 | } |
1041 | ||
03bd70dd RC |
1042 | static void test_exec_environmentfile(Manager *m) { |
1043 | static const char e[] = | |
1044 | "VAR1='word1 word2'\n" | |
1045 | "VAR2=word3 \n" | |
1046 | "# comment1\n" | |
1047 | "\n" | |
1048 | "; comment2\n" | |
1049 | " ; # comment3\n" | |
1050 | "line without an equal\n" | |
9b796f35 | 1051 | "VAR3='$word 5 6'\n" |
b6887d7a JH |
1052 | "VAR4='new\nline'\n" |
1053 | "VAR5=password\\with\\backslashes"; | |
03bd70dd RC |
1054 | int r; |
1055 | ||
1056 | r = write_string_file("/tmp/test-exec_environmentfile.conf", e, WRITE_STRING_FILE_CREATE); | |
26d79ab8 | 1057 | ASSERT_OK(r); |
03bd70dd | 1058 | |
fe65d692 | 1059 | test(m, "exec-environmentfile.service", 0, CLD_EXITED); |
03bd70dd | 1060 | |
f0e018e7 | 1061 | (void) unlink("/tmp/test-exec_environmentfile.conf"); |
03bd70dd RC |
1062 | } |
1063 | ||
4c80d201 | 1064 | static void test_exec_passenvironment(Manager *m) { |
e1abca2e FB |
1065 | /* test-execute runs under MANAGER_USER which, by default, forwards all |
1066 | * variables present in the environment, but only those that are | |
1067 | * present _at the time it is created_! | |
1068 | * | |
1069 | * So these PassEnvironment checks are still expected to work, since we | |
1070 | * are ensuring the variables are not present at manager creation (they | |
1071 | * are unset explicitly in main) and are only set here. | |
1072 | * | |
1073 | * This is still a good approximation of how a test for MANAGER_SYSTEM | |
1074 | * would work. | |
1075 | */ | |
26d79ab8 DDM |
1076 | ASSERT_OK_ERRNO(setenv("VAR1", "word1 word2", 1)); |
1077 | ASSERT_OK_ERRNO(setenv("VAR2", "word3", 1)); | |
1078 | ASSERT_OK_ERRNO(setenv("VAR3", "$word 5 6", 1)); | |
1079 | ASSERT_OK_ERRNO(setenv("VAR4", "new\nline", 1)); | |
1080 | ASSERT_OK_ERRNO(setenv("VAR5", "passwordwithbackslashes", 1)); | |
fe65d692 ZJS |
1081 | test(m, "exec-passenvironment.service", 0, CLD_EXITED); |
1082 | test(m, "exec-passenvironment-repeated.service", 0, CLD_EXITED); | |
1083 | test(m, "exec-passenvironment-empty.service", 0, CLD_EXITED); | |
26d79ab8 DDM |
1084 | ASSERT_OK_ERRNO(unsetenv("VAR1")); |
1085 | ASSERT_OK_ERRNO(unsetenv("VAR2")); | |
1086 | ASSERT_OK_ERRNO(unsetenv("VAR3")); | |
1087 | ASSERT_OK_ERRNO(unsetenv("VAR4")); | |
1088 | ASSERT_OK_ERRNO(unsetenv("VAR5")); | |
fe65d692 | 1089 | test(m, "exec-passenvironment-absent.service", 0, CLD_EXITED); |
4c80d201 FB |
1090 | } |
1091 | ||
27c5347c | 1092 | static void test_exec_umask(Manager *m) { |
d0c6136f NR |
1093 | if (MANAGER_IS_SYSTEM(m) || have_userns_privileges()) { |
1094 | test(m, "exec-umask-default.service", can_unshare || MANAGER_IS_SYSTEM(m) ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
1095 | test(m, "exec-umask-0177.service", can_unshare || MANAGER_IS_SYSTEM(m) ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
1096 | } else | |
1097 | return (void)log_notice("Skipping %s, do not have user namespace privileges", __func__); | |
27c5347c RC |
1098 | } |
1099 | ||
cc3ddc85 | 1100 | static void test_exec_runtimedirectory(Manager *m) { |
4e032f65 | 1101 | (void) rm_rf("/run/test-exec_runtimedirectory2", REMOVE_ROOT|REMOVE_PHYSICAL); |
fe65d692 | 1102 | test(m, "exec-runtimedirectory.service", 0, CLD_EXITED); |
4e032f65 YW |
1103 | (void) rm_rf("/run/test-exec_runtimedirectory2", REMOVE_ROOT|REMOVE_PHYSICAL); |
1104 | ||
fe65d692 | 1105 | test(m, "exec-runtimedirectory-mode.service", 0, CLD_EXITED); |
4e032f65 | 1106 | test(m, "exec-runtimedirectory-owner.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_GROUP, CLD_EXITED); |
57c2efa0 YW |
1107 | |
1108 | if (!check_nobody_user_and_group()) { | |
5cd33ccc | 1109 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
69b07407 YW |
1110 | return; |
1111 | } | |
1112 | ||
1113 | if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) { | |
5cd33ccc | 1114 | log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__); |
57c2efa0 YW |
1115 | return; |
1116 | } | |
1117 | ||
4e032f65 | 1118 | test(m, "exec-runtimedirectory-owner-" NOBODY_GROUP_NAME ".service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_GROUP, CLD_EXITED); |
ff4ca461 RC |
1119 | } |
1120 | ||
1121 | static void test_exec_capabilityboundingset(Manager *m) { | |
1122 | int r; | |
1123 | ||
f7bc0c32 | 1124 | r = find_executable("capsh", NULL); |
ff4ca461 | 1125 | if (r < 0) { |
5cd33ccc | 1126 | log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); |
ff4ca461 RC |
1127 | return; |
1128 | } | |
1129 | ||
b7856f92 YW |
1130 | if (have_effective_cap(CAP_CHOWN) <= 0 || |
1131 | have_effective_cap(CAP_FOWNER) <= 0 || | |
1132 | have_effective_cap(CAP_KILL) <= 0) { | |
1133 | log_notice("Skipping %s, this process does not have enough capabilities", __func__); | |
1134 | return; | |
1135 | } | |
1136 | ||
fe65d692 ZJS |
1137 | test(m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED); |
1138 | test(m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED); | |
1139 | test(m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED); | |
1140 | test(m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED); | |
cc3ddc85 RC |
1141 | } |
1142 | ||
5008da1e | 1143 | static void test_exec_basic(Manager *m) { |
d0c6136f NR |
1144 | if (MANAGER_IS_SYSTEM(m) || have_userns_privileges()) |
1145 | test(m, "exec-basic.service", can_unshare || MANAGER_IS_SYSTEM(m) ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
1146 | else | |
1147 | return (void)log_notice("Skipping %s, do not have user namespace privileges", __func__); | |
5008da1e ZJS |
1148 | } |
1149 | ||
b6dc25ee | 1150 | static void test_exec_ambientcapabilities(Manager *m) { |
70d7aea5 IP |
1151 | int r; |
1152 | ||
1153 | /* Check if the kernel has support for ambient capabilities. Run | |
1154 | * the tests only if that's the case. Clearing all ambient | |
1155 | * capabilities is fine, since we are expecting them to be unset | |
1156 | * in the first place for the tests. */ | |
1157 | r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0); | |
f0e018e7 | 1158 | if (r < 0 && IN_SET(errno, EINVAL, EOPNOTSUPP, ENOSYS)) { |
5cd33ccc | 1159 | log_notice("Skipping %s, the kernel does not support ambient capabilities", __func__); |
f0e018e7 YW |
1160 | return; |
1161 | } | |
1162 | ||
e5ba1d32 | 1163 | if (have_effective_cap(CAP_CHOWN) <= 0 || |
b7856f92 YW |
1164 | have_effective_cap(CAP_NET_RAW) <= 0) { |
1165 | log_notice("Skipping %s, this process does not have enough capabilities", __func__); | |
1166 | return; | |
1167 | } | |
1168 | ||
fe65d692 ZJS |
1169 | test(m, "exec-ambientcapabilities.service", 0, CLD_EXITED); |
1170 | test(m, "exec-ambientcapabilities-merge.service", 0, CLD_EXITED); | |
69b07407 | 1171 | |
f4a35f2a LB |
1172 | if (have_effective_cap(CAP_SETUID) > 0) |
1173 | test(m, "exec-ambientcapabilities-dynuser.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED); | |
1174 | ||
57c2efa0 | 1175 | if (!check_nobody_user_and_group()) { |
5cd33ccc | 1176 | log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); |
69b07407 YW |
1177 | return; |
1178 | } | |
1179 | ||
1180 | if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { | |
5cd33ccc | 1181 | log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); |
57c2efa0 YW |
1182 | return; |
1183 | } | |
1184 | ||
fe65d692 ZJS |
1185 | test(m, "exec-ambientcapabilities-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); |
1186 | test(m, "exec-ambientcapabilities-merge-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); | |
70d7aea5 IP |
1187 | } |
1188 | ||
63447f11 | 1189 | static void test_exec_privatenetwork(Manager *m) { |
6ef721cb | 1190 | int r; |
63447f11 | 1191 | |
8a87a16b MK |
1192 | if (!have_net_dummy) |
1193 | return (void)log_notice("Skipping %s, dummy network interface not available", __func__); | |
1194 | ||
d0c6136f NR |
1195 | if (MANAGER_IS_USER(m) && !have_userns_privileges()) |
1196 | return (void)log_notice("Skipping %s, do not have user namespace privileges", __func__); | |
1197 | ||
f7bc0c32 | 1198 | r = find_executable("ip", NULL); |
63447f11 | 1199 | if (r < 0) { |
5cd33ccc | 1200 | log_notice_errno(r, "Skipping %s, could not find ip binary: %m", __func__); |
63447f11 RC |
1201 | return; |
1202 | } | |
1203 | ||
6ef721cb LB |
1204 | test(m, "exec-privatenetwork-yes-privatemounts-no.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_NETWORK : EXIT_FAILURE, CLD_EXITED); |
1205 | test(m, "exec-privatenetwork-yes-privatemounts-yes.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_NETWORK : EXIT_NAMESPACE, CLD_EXITED); | |
63447f11 RC |
1206 | } |
1207 | ||
600ed5c2 YW |
1208 | static void test_exec_networknamespacepath(Manager *m) { |
1209 | int r; | |
1210 | ||
8a87a16b MK |
1211 | if (!have_net_dummy) |
1212 | return (void)log_notice("Skipping %s, dummy network interface not available", __func__); | |
1213 | ||
76808638 NR |
1214 | if (!have_netns) |
1215 | return (void)log_notice("Skipping %s, network namespace not available", __func__); | |
1216 | ||
d0c6136f NR |
1217 | if (MANAGER_IS_USER(m) && !have_userns_privileges()) |
1218 | return (void)log_notice("Skipping %s, do not have user namespace privileges", __func__); | |
1219 | ||
600ed5c2 YW |
1220 | r = find_executable("ip", NULL); |
1221 | if (r < 0) { | |
1222 | log_notice_errno(r, "Skipping %s, could not find ip binary: %m", __func__); | |
1223 | return; | |
1224 | } | |
1225 | ||
1226 | test(m, "exec-networknamespacepath-privatemounts-no.service", MANAGER_IS_SYSTEM(m) ? EXIT_SUCCESS : EXIT_FAILURE, CLD_EXITED); | |
6ef721cb | 1227 | test(m, "exec-networknamespacepath-privatemounts-yes.service", can_unshare ? EXIT_SUCCESS : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED); |
600ed5c2 YW |
1228 | } |
1229 | ||
c388dfea | 1230 | static void test_exec_oomscoreadjust(Manager *m) { |
fe65d692 | 1231 | test(m, "exec-oomscoreadjust-positive.service", 0, CLD_EXITED); |
642d1a6d YW |
1232 | |
1233 | if (detect_container() > 0) { | |
1234 | log_notice("Testing in container, skipping remaining tests in %s", __func__); | |
1235 | return; | |
1236 | } | |
4e032f65 | 1237 | test(m, "exec-oomscoreadjust-negative.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_FAILURE, CLD_EXITED); |
c388dfea RC |
1238 | } |
1239 | ||
a6226758 | 1240 | static void test_exec_ioschedulingclass(Manager *m) { |
fe65d692 ZJS |
1241 | test(m, "exec-ioschedulingclass-none.service", 0, CLD_EXITED); |
1242 | test(m, "exec-ioschedulingclass-idle.service", 0, CLD_EXITED); | |
1243 | test(m, "exec-ioschedulingclass-best-effort.service", 0, CLD_EXITED); | |
642d1a6d YW |
1244 | |
1245 | if (detect_container() > 0) { | |
1246 | log_notice("Testing in container, skipping remaining tests in %s", __func__); | |
1247 | return; | |
1248 | } | |
4e032f65 | 1249 | test(m, "exec-ioschedulingclass-realtime.service", MANAGER_IS_SYSTEM(m) ? 0 : EXIT_IOPRIO, CLD_EXITED); |
a6226758 RC |
1250 | } |
1251 | ||
f0e018e7 | 1252 | static void test_exec_unsetenvironment(Manager *m) { |
fe65d692 | 1253 | test(m, "exec-unsetenvironment.service", 0, CLD_EXITED); |
42cc99d5 LP |
1254 | } |
1255 | ||
9672b583 | 1256 | static void test_exec_specifier(Manager *m) { |
adeff822 | 1257 | test(m, "exec-specifier.service", 0, CLD_EXITED); |
4e032f65 YW |
1258 | if (MANAGER_IS_SYSTEM(m)) |
1259 | test(m, "exec-specifier-system.service", 0, CLD_EXITED); | |
1260 | else | |
1261 | test(m, "exec-specifier-user.service", 0, CLD_EXITED); | |
adeff822 | 1262 | test(m, "exec-specifier@foo-bar.service", 0, CLD_EXITED); |
fe65d692 | 1263 | test(m, "exec-specifier-interpolation.service", 0, CLD_EXITED); |
9672b583 LP |
1264 | } |
1265 | ||
f0e018e7 | 1266 | static void test_exec_standardinput(Manager *m) { |
fe65d692 ZJS |
1267 | test(m, "exec-standardinput-data.service", 0, CLD_EXITED); |
1268 | test(m, "exec-standardinput-file.service", 0, CLD_EXITED); | |
b3a82648 FS |
1269 | |
1270 | ExecOutput saved = m->defaults.std_output; | |
1271 | m->defaults.std_output = EXEC_OUTPUT_NULL; | |
fe65d692 | 1272 | test(m, "exec-standardinput-file-cat.service", 0, CLD_EXITED); |
b3a82648 | 1273 | m->defaults.std_output = saved; |
666d7877 LP |
1274 | } |
1275 | ||
566b7d23 | 1276 | static void test_exec_standardoutput(Manager *m) { |
fe65d692 | 1277 | test(m, "exec-standardoutput-file.service", 0, CLD_EXITED); |
566b7d23 ZD |
1278 | } |
1279 | ||
1280 | static void test_exec_standardoutput_append(Manager *m) { | |
fe65d692 | 1281 | test(m, "exec-standardoutput-append.service", 0, CLD_EXITED); |
566b7d23 ZD |
1282 | } |
1283 | ||
8d7dab1f LW |
1284 | static void test_exec_standardoutput_truncate(Manager *m) { |
1285 | test(m, "exec-standardoutput-truncate.service", 0, CLD_EXITED); | |
1286 | } | |
1287 | ||
31cd5f63 | 1288 | static void test_exec_condition(Manager *m) { |
fe65d692 ZJS |
1289 | test_service(m, "exec-condition-failed.service", SERVICE_FAILURE_EXIT_CODE); |
1290 | test_service(m, "exec-condition-skip.service", SERVICE_SKIP_CONDITION); | |
31cd5f63 AZ |
1291 | } |
1292 | ||
875afa02 | 1293 | static void test_exec_umask_namespace(Manager *m) { |
bfd67106 YW |
1294 | /* exec-specifier-credentials-dir.service creates /run/credentials and enables implicit |
1295 | * InaccessiblePath= for the directory for all later services with mount namespace. */ | |
1296 | if (!is_inaccessible_available()) { | |
1297 | log_notice("Testing without inaccessible, skipping %s", __func__); | |
1298 | return; | |
1299 | } | |
4e032f65 | 1300 | test(m, "exec-umask-namespace.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_NAMESPACE : EXIT_GROUP, CLD_EXITED); |
875afa02 LP |
1301 | } |
1302 | ||
9efb9631 ZJS |
1303 | typedef struct test_entry { |
1304 | test_function_t f; | |
1305 | const char *name; | |
1306 | } test_entry; | |
1307 | ||
1308 | #define entry(x) {x, #x} | |
1309 | ||
4870133b | 1310 | static void run_tests(RuntimeScope scope, char **patterns) { |
4e032f65 YW |
1311 | _cleanup_(rm_rf_physical_and_freep) char *runtime_dir = NULL; |
1312 | _cleanup_free_ char *unit_paths = NULL; | |
c70cac54 | 1313 | _cleanup_(manager_freep) Manager *m = NULL; |
791a84ad | 1314 | usec_t start, finish; |
19c0b0b9 RC |
1315 | int r; |
1316 | ||
4e032f65 | 1317 | static const test_entry tests[] = { |
9efb9631 ZJS |
1318 | entry(test_exec_basic), |
1319 | entry(test_exec_ambientcapabilities), | |
1320 | entry(test_exec_bindpaths), | |
1321 | entry(test_exec_capabilityboundingset), | |
31cd5f63 | 1322 | entry(test_exec_condition), |
9efb9631 | 1323 | entry(test_exec_cpuaffinity), |
b7cca6cc | 1324 | entry(test_exec_credentials), |
4e032f65 | 1325 | entry(test_exec_dynamicuser), |
9efb9631 ZJS |
1326 | entry(test_exec_environment), |
1327 | entry(test_exec_environmentfile), | |
4e032f65 YW |
1328 | entry(test_exec_execsearchpath), |
1329 | entry(test_exec_execsearchpath_environment), | |
1330 | entry(test_exec_execsearchpath_environment_files), | |
1331 | entry(test_exec_execsearchpath_passenvironment), | |
1332 | entry(test_exec_execsearchpath_specifier), | |
9efb9631 ZJS |
1333 | entry(test_exec_group), |
1334 | entry(test_exec_ignoresigpipe), | |
1335 | entry(test_exec_inaccessiblepaths), | |
1336 | entry(test_exec_ioschedulingclass), | |
42867dfe | 1337 | entry(test_exec_mount_apivfs), |
600ed5c2 | 1338 | entry(test_exec_networknamespacepath), |
ddc155b2 | 1339 | entry(test_exec_noexecpaths), |
9efb9631 ZJS |
1340 | entry(test_exec_oomscoreadjust), |
1341 | entry(test_exec_passenvironment), | |
1342 | entry(test_exec_personality), | |
1343 | entry(test_exec_privatedevices), | |
1344 | entry(test_exec_privatenetwork), | |
1345 | entry(test_exec_privatetmp), | |
1346 | entry(test_exec_protecthome), | |
1347 | entry(test_exec_protectkernelmodules), | |
1348 | entry(test_exec_readonlypaths), | |
1349 | entry(test_exec_readwritepaths), | |
1350 | entry(test_exec_restrictnamespaces), | |
1351 | entry(test_exec_runtimedirectory), | |
4e032f65 | 1352 | entry(test_exec_specifier), |
9efb9631 ZJS |
1353 | entry(test_exec_standardinput), |
1354 | entry(test_exec_standardoutput), | |
1355 | entry(test_exec_standardoutput_append), | |
8d7dab1f | 1356 | entry(test_exec_standardoutput_truncate), |
9efb9631 ZJS |
1357 | entry(test_exec_supplementarygroups), |
1358 | entry(test_exec_systemcallerrornumber), | |
1359 | entry(test_exec_systemcallfilter), | |
4e032f65 | 1360 | entry(test_exec_systemcallfilter_system), |
9efb9631 ZJS |
1361 | entry(test_exec_temporaryfilesystem), |
1362 | entry(test_exec_umask), | |
4e032f65 | 1363 | entry(test_exec_umask_namespace), |
9efb9631 ZJS |
1364 | entry(test_exec_unsetenvironment), |
1365 | entry(test_exec_user), | |
1366 | entry(test_exec_workingdirectory), | |
9efb9631 | 1367 | {}, |
19c0b0b9 | 1368 | }; |
176ceb2c | 1369 | |
26d79ab8 DDM |
1370 | ASSERT_OK_ERRNO(unsetenv("USER")); |
1371 | ASSERT_OK_ERRNO(unsetenv("LOGNAME")); | |
1372 | ASSERT_OK_ERRNO(unsetenv("SHELL")); | |
1373 | ASSERT_OK_ERRNO(unsetenv("HOME")); | |
1374 | ASSERT_OK_ERRNO(unsetenv("TMPDIR")); | |
2482f88d | 1375 | |
4e032f65 YW |
1376 | /* Unset VARx, especially, VAR1, VAR2 and VAR3, which are used in the PassEnvironment test cases, |
1377 | * otherwise (and if they are present in the environment), `manager_default_environment` will copy | |
1378 | * them into the default environment which is passed to each created job, which will make the tests | |
1379 | * that expect those not to be present to fail. */ | |
26d79ab8 DDM |
1380 | ASSERT_OK_ERRNO(unsetenv("VAR1")); |
1381 | ASSERT_OK_ERRNO(unsetenv("VAR2")); | |
1382 | ASSERT_OK_ERRNO(unsetenv("VAR3")); | |
1383 | ASSERT_OK_ERRNO(unsetenv("VAR4")); | |
1384 | ASSERT_OK_ERRNO(unsetenv("VAR5")); | |
34b59770 | 1385 | |
26d79ab8 DDM |
1386 | ASSERT_NOT_NULL(runtime_dir = setup_fake_runtime_dir()); |
1387 | ASSERT_NOT_NULL(user_runtime_unit_dir = path_join(runtime_dir, "systemd/user")); | |
1388 | ASSERT_NOT_NULL(unit_paths = strjoin(PRIVATE_UNIT_DIR, ":", user_runtime_unit_dir)); | |
1389 | ASSERT_OK(set_unit_path(unit_paths)); | |
281e05b6 | 1390 | |
4e032f65 YW |
1391 | r = manager_new(scope, MANAGER_TEST_RUN_BASIC, &m); |
1392 | if (manager_errno_skip_test(r)) | |
1393 | return (void) log_tests_skipped_errno(r, "manager_new"); | |
26d79ab8 | 1394 | ASSERT_OK(r); |
4e032f65 | 1395 | |
b3a82648 | 1396 | m->defaults.std_output = EXEC_OUTPUT_INHERIT; /* don't rely on host journald */ |
26d79ab8 | 1397 | ASSERT_OK(manager_startup(m, NULL, NULL, NULL)); |
4e032f65 YW |
1398 | |
1399 | /* Uncomment below if you want to make debugging logs stored to journal. */ | |
1400 | //manager_override_log_target(m, LOG_TARGET_AUTO); | |
1401 | //manager_override_log_level(m, LOG_DEBUG); | |
1402 | ||
791a84ad LB |
1403 | /* Measure and print the time that it takes to run tests, excluding startup of the manager object, |
1404 | * to try and measure latency of spawning services */ | |
b6349ffd | 1405 | n_ran_tests = 0; |
791a84ad LB |
1406 | start = now(CLOCK_MONOTONIC); |
1407 | ||
4e032f65 YW |
1408 | for (const test_entry *test = tests; test->f; test++) |
1409 | if (strv_fnmatch_or_empty(patterns, test->name, FNM_NOESCAPE)) | |
1410 | test->f(m); | |
1411 | else | |
1412 | log_info("Skipping %s because it does not match any pattern.", test->name); | |
791a84ad LB |
1413 | |
1414 | finish = now(CLOCK_MONOTONIC); | |
1415 | ||
b6349ffd LB |
1416 | log_info("ran %u tests with %s manager + unshare=%s in: %s", |
1417 | n_ran_tests, | |
791a84ad LB |
1418 | scope == RUNTIME_SCOPE_SYSTEM ? "system" : "user", |
1419 | yes_no(can_unshare), | |
1420 | FORMAT_TIMESPAN(finish - start, USEC_PER_MSEC)); | |
4e032f65 YW |
1421 | } |
1422 | ||
1423 | static int prepare_ns(const char *process_name) { | |
1424 | int r; | |
1425 | ||
1426 | r = safe_fork(process_name, | |
1427 | FORK_RESET_SIGNALS | | |
1428 | FORK_CLOSE_ALL_FDS | | |
e9ccae31 | 1429 | FORK_DEATHSIG_SIGTERM | |
4e032f65 YW |
1430 | FORK_WAIT | |
1431 | FORK_REOPEN_LOG | | |
1432 | FORK_LOG | | |
1433 | FORK_NEW_MOUNTNS | | |
1434 | FORK_MOUNTNS_SLAVE, | |
1435 | NULL); | |
26d79ab8 | 1436 | ASSERT_OK(r); |
4e032f65 | 1437 | if (r == 0) { |
3ebd5986 FS |
1438 | _cleanup_free_ char *unit_dir = NULL, *build_dir = NULL, *build_dir_mount = NULL; |
1439 | int ret; | |
4e032f65 YW |
1440 | |
1441 | /* Make "/" read-only. */ | |
26d79ab8 | 1442 | ASSERT_OK(mount_nofollow_verbose(LOG_DEBUG, NULL, "/", NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL)); |
4e032f65 YW |
1443 | |
1444 | /* Creating a new user namespace in the above means all MS_SHARED mounts become MS_SLAVE. | |
1445 | * Let's put them back to MS_SHARED here, since that's what we want as defaults. (This will | |
1446 | * not reconnect propagation, but simply create new peer groups for all our mounts). */ | |
26d79ab8 | 1447 | ASSERT_OK(mount_follow_verbose(LOG_DEBUG, NULL, "/", NULL, MS_SHARED|MS_REC, NULL)); |
4e032f65 | 1448 | |
26d79ab8 DDM |
1449 | ASSERT_OK(mkdir_p(PRIVATE_UNIT_DIR, 0755)); |
1450 | ASSERT_OK(mount_nofollow_verbose(LOG_DEBUG, "tmpfs", PRIVATE_UNIT_DIR, "tmpfs", MS_NOSUID|MS_NODEV, NULL)); | |
3ebd5986 | 1451 | /* Mark our test "playground" as MS_SLAVE, so we can MS_MOVE mounts underneath it. */ |
26d79ab8 | 1452 | ASSERT_OK(mount_nofollow_verbose(LOG_DEBUG, NULL, PRIVATE_UNIT_DIR, NULL, MS_SLAVE, NULL)); |
e1abca2e | 1453 | |
4e032f65 | 1454 | /* Copy unit files to make them accessible even when unprivileged. */ |
26d79ab8 DDM |
1455 | ASSERT_OK(get_testdata_dir("test-execute/", &unit_dir)); |
1456 | ASSERT_OK(copy_directory_at(AT_FDCWD, unit_dir, AT_FDCWD, PRIVATE_UNIT_DIR, COPY_MERGE_EMPTY)); | |
b7172f34 | 1457 | |
c109cff9 | 1458 | /* Mount tmpfs on the following directories to make not StateDirectory= or friends disturb the host. */ |
3ebd5986 | 1459 | ret = get_build_exec_dir(&build_dir); |
26d79ab8 DDM |
1460 | if (ret != -ENOEXEC) |
1461 | ASSERT_OK(ret); | |
3ebd5986 FS |
1462 | |
1463 | if (build_dir) { | |
1464 | /* Account for a build directory being in one of the soon-to-be-tmpfs directories. If we | |
1465 | * overmount it with an empty tmpfs, manager_new() will pin the wrong systemd-executor binary, | |
1466 | * which can then lead to unexpected (and painful to debug) test fails. */ | |
26d79ab8 DDM |
1467 | ASSERT_OK_ERRNO(access(build_dir, F_OK)); |
1468 | ASSERT_NOT_NULL(build_dir_mount = path_join(PRIVATE_UNIT_DIR, "build_dir")); | |
1469 | ASSERT_OK(mkdir_p(build_dir_mount, 0755)); | |
1470 | ASSERT_OK(mount_nofollow_verbose(LOG_DEBUG, build_dir, build_dir_mount, NULL, MS_BIND, NULL)); | |
3ebd5986 FS |
1471 | } |
1472 | ||
c109cff9 | 1473 | FOREACH_STRING(p, "/dev/shm", "/root", "/tmp", "/var/tmp", "/var/lib") |
26d79ab8 | 1474 | ASSERT_OK(mount_nofollow_verbose(LOG_DEBUG, "tmpfs", p, "tmpfs", MS_NOSUID|MS_NODEV, NULL)); |
c109cff9 | 1475 | |
3ebd5986 FS |
1476 | if (build_dir_mount) { |
1477 | ret = RET_NERRNO(access(build_dir, F_OK)); | |
26d79ab8 DDM |
1478 | if (ret != -ENOENT) |
1479 | ASSERT_OK(ret); | |
3ebd5986 FS |
1480 | |
1481 | if (ret == -ENOENT) { | |
1482 | /* The build directory got overmounted by tmpfs, so let's use the "backup" bind mount to | |
1483 | * bring it back. */ | |
26d79ab8 DDM |
1484 | ASSERT_OK(mkdir_p(build_dir, 0755)); |
1485 | ASSERT_OK(mount_nofollow_verbose(LOG_DEBUG, build_dir_mount, build_dir, NULL, MS_MOVE, NULL)); | |
3ebd5986 FS |
1486 | } |
1487 | } | |
1488 | ||
4e032f65 YW |
1489 | /* Prepare credstore like tmpfiles.d/credstore.conf for LoadCredential= tests. */ |
1490 | FOREACH_STRING(p, "/run/credstore", "/run/credstore.encrypted") { | |
26d79ab8 DDM |
1491 | ASSERT_OK(mkdir_p(p, 0)); |
1492 | ASSERT_OK(mount_nofollow_verbose(LOG_DEBUG, "tmpfs", p, "tmpfs", MS_NOSUID|MS_NODEV, "mode=0000")); | |
4e032f65 | 1493 | } |
b7cca6cc | 1494 | |
26d79ab8 | 1495 | ASSERT_OK(write_string_file("/run/credstore/test-execute.load-credential", "foo", WRITE_STRING_FILE_CREATE)); |
4e032f65 YW |
1496 | } |
1497 | ||
1498 | return r; | |
1499 | } | |
1500 | ||
1501 | TEST(run_tests_root) { | |
1502 | _cleanup_strv_free_ char **filters = NULL; | |
1503 | ||
1504 | if (!have_namespaces()) | |
1505 | return (void) log_tests_skipped("unshare() is disabled"); | |
1506 | ||
1507 | /* safe_fork() clears saved_argv in the child process. Let's copy it. */ | |
26d79ab8 | 1508 | ASSERT_NOT_NULL(filters = strv_copy(strv_skip(saved_argv, 1))); |
4e032f65 YW |
1509 | |
1510 | if (prepare_ns("(test-execute-root)") == 0) { | |
1511 | can_unshare = true; | |
4870133b | 1512 | run_tests(RUNTIME_SCOPE_SYSTEM, filters); |
4e032f65 YW |
1513 | _exit(EXIT_SUCCESS); |
1514 | } | |
1515 | } | |
1516 | ||
1517 | TEST(run_tests_without_unshare) { | |
1518 | if (!have_namespaces()) { | |
1519 | /* unshare() is already filtered. */ | |
1520 | can_unshare = false; | |
4870133b | 1521 | run_tests(RUNTIME_SCOPE_SYSTEM, strv_skip(saved_argv, 1)); |
4e032f65 YW |
1522 | return; |
1523 | } | |
b7172f34 YW |
1524 | |
1525 | #if HAVE_SECCOMP | |
4e032f65 YW |
1526 | _cleanup_strv_free_ char **filters = NULL; |
1527 | int r; | |
1528 | ||
b7172f34 | 1529 | /* The following tests are for 1beab8b0d0ff2d7d1436b52d4a0c3d56dc908962. */ |
4e032f65 YW |
1530 | if (!is_seccomp_available()) |
1531 | return (void) log_tests_skipped("Seccomp not available, cannot run unshare() filtered tests"); | |
1532 | ||
1533 | /* safe_fork() clears saved_argv in the child process. Let's copy it. */ | |
26d79ab8 | 1534 | ASSERT_NOT_NULL(filters = strv_copy(strv_skip(saved_argv, 1))); |
b7172f34 | 1535 | |
4e032f65 YW |
1536 | if (prepare_ns("(test-execute-without-unshare)") == 0) { |
1537 | _cleanup_hashmap_free_ Hashmap *s = NULL; | |
b7172f34 | 1538 | |
4e032f65 | 1539 | r = seccomp_syscall_resolve_name("unshare"); |
26d79ab8 DDM |
1540 | ASSERT_NE(r, __NR_SCMP_ERROR); |
1541 | ASSERT_OK(hashmap_ensure_put(&s, NULL, UINT32_TO_PTR(r + 1), INT_TO_PTR(-1))); | |
1542 | ASSERT_OK(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EOPNOTSUPP), true)); | |
b7172f34 | 1543 | |
4e032f65 | 1544 | /* Check unshare() is actually filtered. */ |
26d79ab8 | 1545 | ASSERT_ERROR_ERRNO(unshare(CLONE_NEWNS), EOPNOTSUPP); |
281e05b6 | 1546 | |
4e032f65 | 1547 | can_unshare = false; |
4870133b | 1548 | run_tests(RUNTIME_SCOPE_SYSTEM, filters); |
4e032f65 YW |
1549 | _exit(EXIT_SUCCESS); |
1550 | } | |
b7172f34 | 1551 | #else |
4e032f65 YW |
1552 | log_tests_skipped("Built without seccomp support, cannot run unshare() filtered tests"); |
1553 | #endif | |
1554 | } | |
1555 | ||
1556 | TEST(run_tests_unprivileged) { | |
1557 | _cleanup_strv_free_ char **filters = NULL; | |
1558 | ||
1559 | if (!have_namespaces()) | |
1560 | return (void) log_tests_skipped("unshare() is disabled"); | |
1561 | ||
1562 | /* safe_fork() clears saved_argv in the child process. Let's copy it. */ | |
26d79ab8 | 1563 | ASSERT_NOT_NULL(filters = strv_copy(strv_skip(saved_argv, 1))); |
4e032f65 YW |
1564 | |
1565 | if (prepare_ns("(test-execute-unprivileged)") == 0) { | |
26d79ab8 | 1566 | ASSERT_OK(capability_bounding_set_drop(0, /* right_now = */ true)); |
4e032f65 YW |
1567 | |
1568 | can_unshare = false; | |
4870133b | 1569 | run_tests(RUNTIME_SCOPE_USER, filters); |
4e032f65 YW |
1570 | _exit(EXIT_SUCCESS); |
1571 | } | |
1572 | } | |
1573 | ||
1574 | static int intro(void) { | |
1575 | #if HAS_FEATURE_ADDRESS_SANITIZER | |
1576 | if (strstr_ptr(ci_environment(), "travis") || strstr_ptr(ci_environment(), "github-actions")) | |
1577 | return log_tests_skipped("Running on Travis CI/GH Actions under ASan, see https://github.com/systemd/systemd/issues/10696"); | |
b7172f34 | 1578 | #endif |
4e032f65 YW |
1579 | /* It is needed otherwise cgroup creation fails */ |
1580 | if (geteuid() != 0 || have_effective_cap(CAP_SYS_ADMIN) <= 0) | |
1581 | return log_tests_skipped("not privileged"); | |
1582 | ||
1583 | if (enter_cgroup_subroot(NULL) == -ENOMEDIUM) | |
1584 | return log_tests_skipped("cgroupfs not available"); | |
1585 | ||
1586 | if (path_is_read_only_fs("/sys") > 0) | |
1587 | return log_tests_skipped("/sys is mounted read-only"); | |
1588 | ||
1589 | /* Create dummy network interface for testing PrivateNetwork=yes */ | |
8a87a16b | 1590 | have_net_dummy = system("ip link add dummy-test-exec type dummy") == 0; |
4e032f65 | 1591 | |
8a87a16b MK |
1592 | if (have_net_dummy) { |
1593 | /* Create a network namespace and a dummy interface in it for NetworkNamespacePath= */ | |
76808638 NR |
1594 | have_netns = system("ip netns add test-execute-netns") == 0; |
1595 | have_netns = have_netns && system("ip netns exec test-execute-netns ip link add dummy-test-ns type dummy") == 0; | |
8a87a16b | 1596 | } |
600ed5c2 | 1597 | |
4e032f65 | 1598 | return EXIT_SUCCESS; |
281e05b6 | 1599 | } |
4e032f65 YW |
1600 | |
1601 | static int outro(void) { | |
8a87a16b MK |
1602 | if (have_net_dummy) { |
1603 | (void) system("ip link del dummy-test-exec"); | |
1604 | (void) system("ip netns del test-execute-netns"); | |
1605 | } | |
1606 | ||
4e032f65 YW |
1607 | (void) rmdir(PRIVATE_UNIT_DIR); |
1608 | ||
1609 | return EXIT_SUCCESS; | |
1610 | } | |
1611 | ||
1612 | DEFINE_TEST_MAIN_FULL(LOG_DEBUG, intro, outro); |