src/test/test-condition.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <stdio.h>
   4 #include <sys/types.h>
   5 #include <sys/utsname.h>
   6 #include <unistd.h>
   7
   8 #include "sd-id128.h"
   9
  10 #include "alloc-util.h"
  11 #include "apparmor-util.h"
  12 #include "architecture.h"
  13 #include "audit-util.h"
  14 #include "cgroup-util.h"
  15 #include "condition.h"
  16 #include "cpu-set-util.h"
  17 #include "efivars.h"
  18 #include "hostname-util.h"
  19 #include "id128-util.h"
  20 #include "ima-util.h"
  21 #include "limits-util.h"
  22 #include "log.h"
  23 #include "macro.h"
  24 #include "nulstr-util.h"
  25 #include "process-util.h"
  26 #include "selinux-util.h"
  27 #include "set.h"
  28 #include "smack-util.h"
  29 #include "string-util.h"
  30 #include "strv.h"
  31 #include "tests.h"
  32 #include "tomoyo-util.h"
  33 #include "user-util.h"
  34 #include "virt.h"
  35
  36 static void test_condition_test_path(void) {
  37         Condition *condition;
  38
  39         condition = condition_new(CONDITION_PATH_EXISTS, "/bin/sh", false, false);
  40         assert_se(condition);
  41         assert_se(condition_test(condition));
  42         condition_free(condition);
  43
  44         condition = condition_new(CONDITION_PATH_EXISTS, "/bin/s?", false, false);
  45         assert_se(condition);
  46         assert_se(!condition_test(condition));
  47         condition_free(condition);
  48
  49         condition = condition_new(CONDITION_PATH_EXISTS_GLOB, "/bin/s?", false, false);
  50         assert_se(condition);
  51         assert_se(condition_test(condition));
  52         condition_free(condition);
  53
  54         condition = condition_new(CONDITION_PATH_EXISTS_GLOB, "/bin/s?", false, true);
  55         assert_se(condition);
  56         assert_se(!condition_test(condition));
  57         condition_free(condition);
  58
  59         condition = condition_new(CONDITION_PATH_EXISTS, "/thiscertainlywontexist", false, false);
  60         assert_se(condition);
  61         assert_se(!condition_test(condition));
  62         condition_free(condition);
  63
  64         condition = condition_new(CONDITION_PATH_EXISTS, "/thiscertainlywontexist", false, true);
  65         assert_se(condition);
  66         assert_se(condition_test(condition));
  67         condition_free(condition);
  68
  69         condition = condition_new(CONDITION_PATH_IS_DIRECTORY, "/bin", false, false);
  70         assert_se(condition);
  71         assert_se(condition_test(condition));
  72         condition_free(condition);
  73
  74         condition = condition_new(CONDITION_DIRECTORY_NOT_EMPTY, "/bin", false, false);
  75         assert_se(condition);
  76         assert_se(condition_test(condition));
  77         condition_free(condition);
  78
  79         condition = condition_new(CONDITION_FILE_NOT_EMPTY, "/bin/sh", false, false);
  80         assert_se(condition);
  81         assert_se(condition_test(condition));
  82         condition_free(condition);
  83
  84         condition = condition_new(CONDITION_FILE_IS_EXECUTABLE, "/bin/sh", false, false);
  85         assert_se(condition);
  86         assert_se(condition_test(condition));
  87         condition_free(condition);
  88
  89         condition = condition_new(CONDITION_FILE_IS_EXECUTABLE, "/etc/passwd", false, false);
  90         assert_se(condition);
  91         assert_se(!condition_test(condition));
  92         condition_free(condition);
  93
  94         condition = condition_new(CONDITION_PATH_IS_MOUNT_POINT, "/proc", false, false);
  95         assert_se(condition);
  96         assert_se(condition_test(condition));
  97         condition_free(condition);
  98
  99         condition = condition_new(CONDITION_PATH_IS_MOUNT_POINT, "/", false, false);
 100         assert_se(condition);
 101         assert_se(condition_test(condition));
 102         condition_free(condition);
 103
 104         condition = condition_new(CONDITION_PATH_IS_MOUNT_POINT, "/bin", false, false);
 105         assert_se(condition);
 106         assert_se(!condition_test(condition));
 107         condition_free(condition);
 108
 109         condition = condition_new(CONDITION_PATH_IS_READ_WRITE, "/tmp", false, false);
 110         assert_se(condition);
 111         assert_se(condition_test(condition));
 112         condition_free(condition);
 113
 114         condition = condition_new(CONDITION_PATH_IS_SYMBOLIC_LINK, "/dev/stdout", false, false);
 115         assert_se(condition);
 116         assert_se(condition_test(condition));
 117         condition_free(condition);
 118 }
 119
 120 static void test_condition_test_control_group_controller(void) {
 121         Condition *condition;
 122         CGroupMask system_mask;
 123         CGroupController controller;
 124         _cleanup_free_ char *controller_name = NULL;
 125         int r;
 126
 127         r = cg_unified_flush();
 128         if (r < 0) {
 129                 log_notice_errno(r, "Skipping ConditionControlGroupController tests: %m");
 130                 return;
 131         }
 132
 133         /* Invalid controllers are ignored */
 134         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, "thisisnotarealcontroller", false, false);
 135         assert_se(condition);
 136         assert_se(condition_test(condition));
 137         condition_free(condition);
 138
 139         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, "thisisnotarealcontroller", false, true);
 140         assert_se(condition);
 141         assert_se(!condition_test(condition));
 142         condition_free(condition);
 143
 144         assert_se(cg_mask_supported(&system_mask) >= 0);
 145
 146         /* Individual valid controllers one by one */
 147         for (controller = 0; controller < _CGROUP_CONTROLLER_MAX; controller++) {
 148                 const char *local_controller_name = cgroup_controller_to_string(controller);
 149                 log_info("chosen controller is '%s'", local_controller_name);
 150                 if (system_mask & CGROUP_CONTROLLER_TO_MASK(controller)) {
 151                         log_info("this controller is available");
 152                         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, false);
 153                         assert_se(condition);
 154                         assert_se(condition_test(condition));
 155                         condition_free(condition);
 156
 157                         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, true);
 158                         assert_se(condition);
 159                         assert_se(!condition_test(condition));
 160                         condition_free(condition);
 161                 } else {
 162                         log_info("this controller is unavailable");
 163                         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, false);
 164                         assert_se(condition);
 165                         assert_se(!condition_test(condition));
 166                         condition_free(condition);
 167
 168                         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, true);
 169                         assert_se(condition);
 170                         assert_se(condition_test(condition));
 171                         condition_free(condition);
 172                 }
 173         }
 174
 175         /* Multiple valid controllers at the same time */
 176         assert_se(cg_mask_to_string(system_mask, &controller_name) >= 0);
 177
 178         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, strempty(controller_name), false, false);
 179         assert_se(condition);
 180         assert_se(condition_test(condition));
 181         condition_free(condition);
 182
 183         condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, strempty(controller_name), false, true);
 184         assert_se(condition);
 185         assert_se(!condition_test(condition));
 186         condition_free(condition);
 187 }
 188
 189 static void test_condition_test_ac_power(void) {
 190         Condition *condition;
 191
 192         condition = condition_new(CONDITION_AC_POWER, "true", false, false);
 193         assert_se(condition);
 194         assert_se(condition_test(condition) == on_ac_power());
 195         condition_free(condition);
 196
 197         condition = condition_new(CONDITION_AC_POWER, "false", false, false);
 198         assert_se(condition);
 199         assert_se(condition_test(condition) != on_ac_power());
 200         condition_free(condition);
 201
 202         condition = condition_new(CONDITION_AC_POWER, "false", false, true);
 203         assert_se(condition);
 204         assert_se(condition_test(condition) == on_ac_power());
 205         condition_free(condition);
 206 }
 207
 208 static void test_condition_test_host(void) {
 209         _cleanup_free_ char *hostname = NULL;
 210         char sid[SD_ID128_STRING_MAX];
 211         Condition *condition;
 212         sd_id128_t id;
 213         int r;
 214
 215         r = sd_id128_get_machine(&id);
 216         assert_se(r >= 0);
 217         assert_se(sd_id128_to_string(id, sid));
 218
 219         condition = condition_new(CONDITION_HOST, sid, false, false);
 220         assert_se(condition);
 221         assert_se(condition_test(condition));
 222         condition_free(condition);
 223
 224         condition = condition_new(CONDITION_HOST, "garbage value jjjjjjjjjjjjjj", false, false);
 225         assert_se(condition);
 226         assert_se(!condition_test(condition));
 227         condition_free(condition);
 228
 229         condition = condition_new(CONDITION_HOST, sid, false, true);
 230         assert_se(condition);
 231         assert_se(!condition_test(condition));
 232         condition_free(condition);
 233
 234         hostname = gethostname_malloc();
 235         assert_se(hostname);
 236
 237         /* if hostname looks like an id128 then skip testing it */
 238         if (id128_is_valid(hostname))
 239                 log_notice("hostname is an id128, skipping test");
 240         else {
 241                 condition = condition_new(CONDITION_HOST, hostname, false, false);
 242                 assert_se(condition);
 243                 assert_se(condition_test(condition));
 244                 condition_free(condition);
 245         }
 246 }
 247
 248 static void test_condition_test_architecture(void) {
 249         Condition *condition;
 250         const char *sa;
 251         int a;
 252
 253         a = uname_architecture();
 254         assert_se(a >= 0);
 255
 256         sa = architecture_to_string(a);
 257         assert_se(sa);
 258
 259         condition = condition_new(CONDITION_ARCHITECTURE, sa, false, false);
 260         assert_se(condition);
 261         assert_se(condition_test(condition) > 0);
 262         condition_free(condition);
 263
 264         condition = condition_new(CONDITION_ARCHITECTURE, "garbage value", false, false);
 265         assert_se(condition);
 266         assert_se(condition_test(condition) == 0);
 267         condition_free(condition);
 268
 269         condition = condition_new(CONDITION_ARCHITECTURE, sa, false, true);
 270         assert_se(condition);
 271         assert_se(condition_test(condition) == 0);
 272         condition_free(condition);
 273 }
 274
 275 static void test_condition_test_kernel_command_line(void) {
 276         Condition *condition;
 277
 278         condition = condition_new(CONDITION_KERNEL_COMMAND_LINE, "thisreallyshouldntbeonthekernelcommandline", false, false);
 279         assert_se(condition);
 280         assert_se(!condition_test(condition));
 281         condition_free(condition);
 282
 283         condition = condition_new(CONDITION_KERNEL_COMMAND_LINE, "andthis=neither", false, false);
 284         assert_se(condition);
 285         assert_se(!condition_test(condition));
 286         condition_free(condition);
 287 }
 288
 289 static void test_condition_test_kernel_version(void) {
 290         Condition *condition;
 291         struct utsname u;
 292         const char *v;
 293
 294         condition = condition_new(CONDITION_KERNEL_VERSION, "*thisreallyshouldntbeinthekernelversion*", false, false);
 295         assert_se(condition);
 296         assert_se(!condition_test(condition));
 297         condition_free(condition);
 298
 299         condition = condition_new(CONDITION_KERNEL_VERSION, "*", false, false);
 300         assert_se(condition);
 301         assert_se(condition_test(condition));
 302         condition_free(condition);
 303
 304         condition = condition_new(CONDITION_KERNEL_VERSION, "", false, false);
 305         assert_se(condition);
 306         assert_se(!condition_test(condition));
 307         condition_free(condition);
 308
 309         assert_se(uname(&u) >= 0);
 310
 311         condition = condition_new(CONDITION_KERNEL_VERSION, u.release, false, false);
 312         assert_se(condition);
 313         assert_se(condition_test(condition));
 314         condition_free(condition);
 315
 316         strshorten(u.release, 4);
 317         strcpy(strchr(u.release, 0), "*");
 318
 319         condition = condition_new(CONDITION_KERNEL_VERSION, u.release, false, false);
 320         assert_se(condition);
 321         assert_se(condition_test(condition));
 322         condition_free(condition);
 323
 324         /* 0.1.2 would be a very very very old kernel */
 325         condition = condition_new(CONDITION_KERNEL_VERSION, "> 0.1.2", false, false);
 326         assert_se(condition);
 327         assert_se(condition_test(condition));
 328         condition_free(condition);
 329
 330         condition = condition_new(CONDITION_KERNEL_VERSION, ">= 0.1.2", false, false);
 331         assert_se(condition);
 332         assert_se(condition_test(condition));
 333         condition_free(condition);
 334
 335         condition = condition_new(CONDITION_KERNEL_VERSION, "< 0.1.2", false, false);
 336         assert_se(condition);
 337         assert_se(!condition_test(condition));
 338         condition_free(condition);
 339
 340         condition = condition_new(CONDITION_KERNEL_VERSION, "<= 0.1.2", false, false);
 341         assert_se(condition);
 342         assert_se(!condition_test(condition));
 343         condition_free(condition);
 344
 345         condition = condition_new(CONDITION_KERNEL_VERSION, "= 0.1.2", false, false);
 346         assert_se(condition);
 347         assert_se(!condition_test(condition));
 348         condition_free(condition);
 349
 350         /* 4711.8.15 is a very very very future kernel */
 351         condition = condition_new(CONDITION_KERNEL_VERSION, "< 4711.8.15", false, false);
 352         assert_se(condition);
 353         assert_se(condition_test(condition));
 354         condition_free(condition);
 355
 356         condition = condition_new(CONDITION_KERNEL_VERSION, "<= 4711.8.15", false, false);
 357         assert_se(condition);
 358         assert_se(condition_test(condition));
 359         condition_free(condition);
 360
 361         condition = condition_new(CONDITION_KERNEL_VERSION, "= 4711.8.15", false, false);
 362         assert_se(condition);
 363         assert_se(!condition_test(condition));
 364         condition_free(condition);
 365
 366         condition = condition_new(CONDITION_KERNEL_VERSION, "> 4711.8.15", false, false);
 367         assert_se(condition);
 368         assert_se(!condition_test(condition));
 369         condition_free(condition);
 370
 371         condition = condition_new(CONDITION_KERNEL_VERSION, ">= 4711.8.15", false, false);
 372         assert_se(condition);
 373         assert_se(!condition_test(condition));
 374         condition_free(condition);
 375
 376         assert_se(uname(&u) >= 0);
 377
 378         v = strjoina(">=", u.release);
 379         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 380         assert_se(condition);
 381         assert_se(condition_test(condition));
 382         condition_free(condition);
 383
 384         v = strjoina("=  ", u.release);
 385         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 386         assert_se(condition);
 387         assert_se(condition_test(condition));
 388         condition_free(condition);
 389
 390         v = strjoina("<=", u.release);
 391         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 392         assert_se(condition);
 393         assert_se(condition_test(condition));
 394         condition_free(condition);
 395
 396         v = strjoina("> ", u.release);
 397         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 398         assert_se(condition);
 399         assert_se(!condition_test(condition));
 400         condition_free(condition);
 401
 402         v = strjoina("<   ", u.release);
 403         condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
 404         assert_se(condition);
 405         assert_se(!condition_test(condition));
 406         condition_free(condition);
 407 }
 408
 409 static void test_condition_test_null(void) {
 410         Condition *condition;
 411
 412         condition = condition_new(CONDITION_NULL, NULL, false, false);
 413         assert_se(condition);
 414         assert_se(condition_test(condition));
 415         condition_free(condition);
 416
 417         condition = condition_new(CONDITION_NULL, NULL, false, true);
 418         assert_se(condition);
 419         assert_se(!condition_test(condition));
 420         condition_free(condition);
 421 }
 422
 423 static void test_condition_test_security(void) {
 424         Condition *condition;
 425
 426         condition = condition_new(CONDITION_SECURITY, "garbage oifdsjfoidsjoj", false, false);
 427         assert_se(condition);
 428         assert_se(!condition_test(condition));
 429         condition_free(condition);
 430
 431         condition = condition_new(CONDITION_SECURITY, "selinux", false, true);
 432         assert_se(condition);
 433         assert_se(condition_test(condition) != mac_selinux_use());
 434         condition_free(condition);
 435
 436         condition = condition_new(CONDITION_SECURITY, "apparmor", false, false);
 437         assert_se(condition);
 438         assert_se(condition_test(condition) == mac_apparmor_use());
 439         condition_free(condition);
 440
 441         condition = condition_new(CONDITION_SECURITY, "tomoyo", false, false);
 442         assert_se(condition);
 443         assert_se(condition_test(condition) == mac_tomoyo_use());
 444         condition_free(condition);
 445
 446         condition = condition_new(CONDITION_SECURITY, "ima", false, false);
 447         assert_se(condition);
 448         assert_se(condition_test(condition) == use_ima());
 449         condition_free(condition);
 450
 451         condition = condition_new(CONDITION_SECURITY, "smack", false, false);
 452         assert_se(condition);
 453         assert_se(condition_test(condition) == mac_smack_use());
 454         condition_free(condition);
 455
 456         condition = condition_new(CONDITION_SECURITY, "audit", false, false);
 457         assert_se(condition);
 458         assert_se(condition_test(condition) == use_audit());
 459         condition_free(condition);
 460
 461         condition = condition_new(CONDITION_SECURITY, "uefi-secureboot", false, false);
 462         assert_se(condition);
 463         assert_se(condition_test(condition) == is_efi_secure_boot());
 464         condition_free(condition);
 465 }
 466
 467 static void print_securities(void) {
 468         log_info("------ enabled security technologies ------");
 469         log_info("SELinux: %s", yes_no(mac_selinux_use()));
 470         log_info("AppArmor: %s", yes_no(mac_apparmor_use()));
 471         log_info("Tomoyo: %s", yes_no(mac_tomoyo_use()));
 472         log_info("IMA: %s", yes_no(use_ima()));
 473         log_info("SMACK: %s", yes_no(mac_smack_use()));
 474         log_info("Audit: %s", yes_no(use_audit()));
 475         log_info("UEFI secure boot: %s", yes_no(is_efi_secure_boot()));
 476         log_info("-------------------------------------------");
 477 }
 478
 479 static void test_condition_test_virtualization(void) {
 480         Condition *condition;
 481         const char *virt;
 482         int r;
 483
 484         condition = condition_new(CONDITION_VIRTUALIZATION, "garbage oifdsjfoidsjoj", false, false);
 485         assert_se(condition);
 486         r = condition_test(condition);
 487         log_info("ConditionVirtualization=garbage → %i", r);
 488         assert_se(r == 0);
 489         condition_free(condition);
 490
 491         condition = condition_new(CONDITION_VIRTUALIZATION, "container", false, false);
 492         assert_se(condition);
 493         r = condition_test(condition);
 494         log_info("ConditionVirtualization=container → %i", r);
 495         assert_se(r == !!detect_container());
 496         condition_free(condition);
 497
 498         condition = condition_new(CONDITION_VIRTUALIZATION, "vm", false, false);
 499         assert_se(condition);
 500         r = condition_test(condition);
 501         log_info("ConditionVirtualization=vm → %i", r);
 502         assert_se(r == (detect_vm() && !detect_container()));
 503         condition_free(condition);
 504
 505         condition = condition_new(CONDITION_VIRTUALIZATION, "private-users", false, false);
 506         assert_se(condition);
 507         r = condition_test(condition);
 508         log_info("ConditionVirtualization=private-users → %i", r);
 509         assert_se(r == !!running_in_userns());
 510         condition_free(condition);
 511
 512         NULSTR_FOREACH(virt,
 513                        "kvm\0"
 514                        "qemu\0"
 515                        "bochs\0"
 516                        "xen\0"
 517                        "uml\0"
 518                        "vmware\0"
 519                        "oracle\0"
 520                        "microsoft\0"
 521                        "zvm\0"
 522                        "parallels\0"
 523                        "bhyve\0"
 524                        "vm_other\0") {
 525
 526                 condition = condition_new(CONDITION_VIRTUALIZATION, virt, false, false);
 527                 assert_se(condition);
 528                 r = condition_test(condition);
 529                 log_info("ConditionVirtualization=%s → %i", virt, r);
 530                 assert_se(r >= 0);
 531                 condition_free(condition);
 532         }
 533 }
 534
 535 static void test_condition_test_user(void) {
 536         Condition *condition;
 537         char* uid;
 538         char* username;
 539         int r;
 540
 541         condition = condition_new(CONDITION_USER, "garbage oifdsjfoidsjoj", false, false);
 542         assert_se(condition);
 543         r = condition_test(condition);
 544         log_info("ConditionUser=garbage → %i", r);
 545         assert_se(r == 0);
 546         condition_free(condition);
 547
 548         assert_se(asprintf(&uid, "%"PRIu32, UINT32_C(0xFFFF)) > 0);
 549         condition = condition_new(CONDITION_USER, uid, false, false);
 550         assert_se(condition);
 551         r = condition_test(condition);
 552         log_info("ConditionUser=%s → %i", uid, r);
 553         assert_se(r == 0);
 554         condition_free(condition);
 555         free(uid);
 556
 557         assert_se(asprintf(&uid, "%u", (unsigned)getuid()) > 0);
 558         condition = condition_new(CONDITION_USER, uid, false, false);
 559         assert_se(condition);
 560         r = condition_test(condition);
 561         log_info("ConditionUser=%s → %i", uid, r);
 562         assert_se(r > 0);
 563         condition_free(condition);
 564         free(uid);
 565
 566         assert_se(asprintf(&uid, "%u", (unsigned)getuid()+1) > 0);
 567         condition = condition_new(CONDITION_USER, uid, false, false);
 568         assert_se(condition);
 569         r = condition_test(condition);
 570         log_info("ConditionUser=%s → %i", uid, r);
 571         assert_se(r == 0);
 572         condition_free(condition);
 573         free(uid);
 574
 575         username = getusername_malloc();
 576         assert_se(username);
 577         condition = condition_new(CONDITION_USER, username, false, false);
 578         assert_se(condition);
 579         r = condition_test(condition);
 580         log_info("ConditionUser=%s → %i", username, r);
 581         assert_se(r > 0);
 582         condition_free(condition);
 583         free(username);
 584
 585         username = (char*)(geteuid() == 0 ? NOBODY_USER_NAME : "root");
 586         condition = condition_new(CONDITION_USER, username, false, false);
 587         assert_se(condition);
 588         r = condition_test(condition);
 589         log_info("ConditionUser=%s → %i", username, r);
 590         assert_se(r == 0);
 591         condition_free(condition);
 592
 593         condition = condition_new(CONDITION_USER, "@system", false, false);
 594         assert_se(condition);
 595         r = condition_test(condition);
 596         log_info("ConditionUser=@system → %i", r);
 597         if (uid_is_system(getuid()) || uid_is_system(geteuid()))
 598                 assert_se(r > 0);
 599         else
 600                 assert_se(r == 0);
 601         condition_free(condition);
 602 }
 603
 604 static void test_condition_test_group(void) {
 605         Condition *condition;
 606         char* gid;
 607         char* groupname;
 608         gid_t *gids, max_gid;
 609         int ngroups_max, ngroups, r, i;
 610
 611         assert_se(0 < asprintf(&gid, "%u", UINT32_C(0xFFFF)));
 612         condition = condition_new(CONDITION_GROUP, gid, false, false);
 613         assert_se(condition);
 614         r = condition_test(condition);
 615         log_info("ConditionGroup=%s → %i", gid, r);
 616         assert_se(r == 0);
 617         condition_free(condition);
 618         free(gid);
 619
 620         assert_se(0 < asprintf(&gid, "%u", getgid()));
 621         condition = condition_new(CONDITION_GROUP, gid, false, false);
 622         assert_se(condition);
 623         r = condition_test(condition);
 624         log_info("ConditionGroup=%s → %i", gid, r);
 625         assert_se(r > 0);
 626         condition_free(condition);
 627         free(gid);
 628
 629         ngroups_max = sysconf(_SC_NGROUPS_MAX);
 630         assert(ngroups_max > 0);
 631
 632         gids = newa(gid_t, ngroups_max);
 633
 634         ngroups = getgroups(ngroups_max, gids);
 635         assert(ngroups >= 0);
 636
 637         max_gid = getgid();
 638         for (i = 0; i < ngroups; i++) {
 639                 assert_se(0 < asprintf(&gid, "%u", gids[i]));
 640                 condition = condition_new(CONDITION_GROUP, gid, false, false);
 641                 assert_se(condition);
 642                 r = condition_test(condition);
 643                 log_info("ConditionGroup=%s → %i", gid, r);
 644                 assert_se(r > 0);
 645                 condition_free(condition);
 646                 free(gid);
 647                 max_gid = gids[i] > max_gid ? gids[i] : max_gid;
 648
 649                 groupname = gid_to_name(gids[i]);
 650                 assert_se(groupname);
 651                 condition = condition_new(CONDITION_GROUP, groupname, false, false);
 652                 assert_se(condition);
 653                 r = condition_test(condition);
 654                 log_info("ConditionGroup=%s → %i", groupname, r);
 655                 assert_se(r > 0);
 656                 condition_free(condition);
 657                 free(groupname);
 658                 max_gid = gids[i] > max_gid ? gids[i] : max_gid;
 659         }
 660
 661         assert_se(0 < asprintf(&gid, "%u", max_gid+1));
 662         condition = condition_new(CONDITION_GROUP, gid, false, false);
 663         assert_se(condition);
 664         r = condition_test(condition);
 665         log_info("ConditionGroup=%s → %i", gid, r);
 666         assert_se(r == 0);
 667         condition_free(condition);
 668         free(gid);
 669
 670         groupname = (char*)(geteuid() == 0 ? NOBODY_GROUP_NAME : "root");
 671         condition = condition_new(CONDITION_GROUP, groupname, false, false);
 672         assert_se(condition);
 673         r = condition_test(condition);
 674         log_info("ConditionGroup=%s → %i", groupname, r);
 675         assert_se(r == 0);
 676         condition_free(condition);
 677 }
 678
 679 static void test_condition_test_cpus_one(const char *s, bool result) {
 680         Condition *condition;
 681         int r;
 682
 683         log_debug("%s=%s", condition_type_to_string(CONDITION_CPUS), s);
 684
 685         condition = condition_new(CONDITION_CPUS, s, false, false);
 686         assert_se(condition);
 687
 688         r = condition_test(condition);
 689         assert_se(r >= 0);
 690         assert_se(r == result);
 691         condition_free(condition);
 692 }
 693
 694 static void test_condition_test_cpus(void) {
 695         _cleanup_free_ char *t = NULL;
 696         int cpus;
 697
 698         cpus = cpus_in_affinity_mask();
 699         assert_se(cpus >= 0);
 700
 701         test_condition_test_cpus_one("> 0", true);
 702         test_condition_test_cpus_one(">= 0", true);
 703         test_condition_test_cpus_one("!= 0", true);
 704         test_condition_test_cpus_one("<= 0", false);
 705         test_condition_test_cpus_one("< 0", false);
 706         test_condition_test_cpus_one("= 0", false);
 707
 708         test_condition_test_cpus_one("> 100000", false);
 709         test_condition_test_cpus_one("= 100000", false);
 710         test_condition_test_cpus_one(">= 100000", false);
 711         test_condition_test_cpus_one("< 100000", true);
 712         test_condition_test_cpus_one("!= 100000", true);
 713         test_condition_test_cpus_one("<= 100000", true);
 714
 715         assert_se(asprintf(&t, "= %i", cpus) >= 0);
 716         test_condition_test_cpus_one(t, true);
 717         t = mfree(t);
 718
 719         assert_se(asprintf(&t, "<= %i", cpus) >= 0);
 720         test_condition_test_cpus_one(t, true);
 721         t = mfree(t);
 722
 723         assert_se(asprintf(&t, ">= %i", cpus) >= 0);
 724         test_condition_test_cpus_one(t, true);
 725         t = mfree(t);
 726
 727         assert_se(asprintf(&t, "!= %i", cpus) >= 0);
 728         test_condition_test_cpus_one(t, false);
 729         t = mfree(t);
 730
 731         assert_se(asprintf(&t, "< %i", cpus) >= 0);
 732         test_condition_test_cpus_one(t, false);
 733         t = mfree(t);
 734
 735         assert_se(asprintf(&t, "> %i", cpus) >= 0);
 736         test_condition_test_cpus_one(t, false);
 737         t = mfree(t);
 738 }
 739
 740 static void test_condition_test_memory_one(const char *s, bool result) {
 741         Condition *condition;
 742         int r;
 743
 744         log_debug("%s=%s", condition_type_to_string(CONDITION_MEMORY), s);
 745
 746         condition = condition_new(CONDITION_MEMORY, s, false, false);
 747         assert_se(condition);
 748
 749         r = condition_test(condition);
 750         assert_se(r >= 0);
 751         assert_se(r == result);
 752         condition_free(condition);
 753 }
 754
 755 static void test_condition_test_memory(void) {
 756         _cleanup_free_ char *t = NULL;
 757         uint64_t memory;
 758
 759         memory = physical_memory();
 760
 761         test_condition_test_memory_one("> 0", true);
 762         test_condition_test_memory_one(">= 0", true);
 763         test_condition_test_memory_one("!= 0", true);
 764         test_condition_test_memory_one("<= 0", false);
 765         test_condition_test_memory_one("< 0", false);
 766         test_condition_test_memory_one("= 0", false);
 767
 768         test_condition_test_memory_one("> 18446744073709547520", false);
 769         test_condition_test_memory_one("= 18446744073709547520", false);
 770         test_condition_test_memory_one(">= 18446744073709547520", false);
 771         test_condition_test_memory_one("< 18446744073709547520", true);
 772         test_condition_test_memory_one("!= 18446744073709547520", true);
 773         test_condition_test_memory_one("<= 18446744073709547520", true);
 774
 775         assert_se(asprintf(&t, "= %" PRIu64, memory) >= 0);
 776         test_condition_test_memory_one(t, true);
 777         t = mfree(t);
 778
 779         assert_se(asprintf(&t, "<= %" PRIu64, memory) >= 0);
 780         test_condition_test_memory_one(t, true);
 781         t = mfree(t);
 782
 783         assert_se(asprintf(&t, ">= %" PRIu64, memory) >= 0);
 784         test_condition_test_memory_one(t, true);
 785         t = mfree(t);
 786
 787         assert_se(asprintf(&t, "!= %" PRIu64, memory) >= 0);
 788         test_condition_test_memory_one(t, false);
 789         t = mfree(t);
 790
 791         assert_se(asprintf(&t, "< %" PRIu64, memory) >= 0);
 792         test_condition_test_memory_one(t, false);
 793         t = mfree(t);
 794
 795         assert_se(asprintf(&t, "> %" PRIu64, memory) >= 0);
 796         test_condition_test_memory_one(t, false);
 797         t = mfree(t);
 798 }
 799
 800 int main(int argc, char *argv[]) {
 801         test_setup_logging(LOG_DEBUG);
 802
 803         test_condition_test_path();
 804         test_condition_test_ac_power();
 805         test_condition_test_host();
 806         test_condition_test_architecture();
 807         test_condition_test_kernel_command_line();
 808         test_condition_test_kernel_version();
 809         test_condition_test_null();
 810         test_condition_test_security();
 811         print_securities();
 812         test_condition_test_virtualization();
 813         test_condition_test_user();
 814         test_condition_test_group();
 815         test_condition_test_control_group_controller();
 816         test_condition_test_cpus();
 817         test_condition_test_memory();
 818
 819         return 0;
 820 }