src/test/test-execute.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2014 Ronny Chevalier
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <grp.h>
  21 #include <pwd.h>
  22 #include <stdio.h>
  23 #include <sys/prctl.h>
  24 #include <sys/types.h>
  25
  26 #include "errno-list.h"
  27 #include "fileio.h"
  28 #include "fs-util.h"
  29 #include "macro.h"
  30 #include "manager.h"
  31 #include "mkdir.h"
  32 #include "path-util.h"
  33 #include "rm-rf.h"
  34 #if HAVE_SECCOMP
  35 #include "seccomp-util.h"
  36 #endif
  37 #include "stat-util.h"
  38 #include "test-helper.h"
  39 #include "tests.h"
  40 #include "unit.h"
  41 #include "util.h"
  42 #include "virt.h"
  43
  44 typedef void (*test_function_t)(Manager *m);
  45
  46 static void check(Manager *m, Unit *unit, int status_expected, int code_expected) {
  47         Service *service = NULL;
  48         usec_t ts;
  49         usec_t timeout = 2 * USEC_PER_MINUTE;
  50
  51         assert_se(m);
  52         assert_se(unit);
  53
  54         service = SERVICE(unit);
  55         printf("%s\n", unit->id);
  56         exec_context_dump(&service->exec_context, stdout, "\t");
  57         ts = now(CLOCK_MONOTONIC);
  58         while (!IN_SET(service->state, SERVICE_DEAD, SERVICE_FAILED)) {
  59                 int r;
  60                 usec_t n;
  61
  62                 r = sd_event_run(m->event, 100 * USEC_PER_MSEC);
  63                 assert_se(r >= 0);
  64
  65                 n = now(CLOCK_MONOTONIC);
  66                 if (ts + timeout < n) {
  67                         log_error("Test timeout when testing %s", unit->id);
  68                         exit(EXIT_FAILURE);
  69                 }
  70         }
  71         exec_status_dump(&service->main_exec_status, stdout, "\t");
  72         assert_se(service->main_exec_status.status == status_expected);
  73         assert_se(service->main_exec_status.code == code_expected);
  74 }
  75
  76 static bool is_inaccessible_available(void) {
  77         char *p;
  78
  79         FOREACH_STRING(p,
  80                 "/run/systemd/inaccessible/reg",
  81                 "/run/systemd/inaccessible/dir",
  82                 "/run/systemd/inaccessible/chr",
  83                 "/run/systemd/inaccessible/blk",
  84                 "/run/systemd/inaccessible/fifo",
  85                 "/run/systemd/inaccessible/sock"
  86         ) {
  87                 if (access(p, F_OK) < 0)
  88                         return false;
  89         }
  90
  91         return true;
  92 }
  93
  94 static void test(Manager *m, const char *unit_name, int status_expected, int code_expected) {
  95         Unit *unit;
  96
  97         assert_se(unit_name);
  98
  99         assert_se(manager_load_unit(m, unit_name, NULL, NULL, &unit) >= 0);
 100         assert_se(UNIT_VTABLE(unit)->start(unit) >= 0);
 101         check(m, unit, status_expected, code_expected);
 102 }
 103
 104 static void test_exec_bind_paths(Manager *m) {
 105         assert_se(mkdir_p("/tmp/test-exec_bind_paths", 0755) >= 0);
 106         assert_se(mkdir_p("/tmp/test-exec_bind_readonly_paths", 0755) >= 0);
 107
 108         test(m, "exec-bind-paths.service", 0, CLD_EXITED);
 109
 110         (void) rm_rf("/tmp/test-exec_bind_paths", REMOVE_ROOT|REMOVE_PHYSICAL);
 111         (void) rm_rf("/tmp/test-exec_bind_readonly_paths", REMOVE_ROOT|REMOVE_PHYSICAL);
 112 }
 113
 114 static void test_exec_workingdirectory(Manager *m) {
 115         assert_se(mkdir_p("/tmp/test-exec_workingdirectory", 0755) >= 0);
 116
 117         test(m, "exec-workingdirectory.service", 0, CLD_EXITED);
 118
 119         (void) rm_rf("/tmp/test-exec_workingdirectory", REMOVE_ROOT|REMOVE_PHYSICAL);
 120 }
 121
 122 static void test_exec_personality(Manager *m) {
 123 #if defined(__x86_64__)
 124         test(m, "exec-personality-x86-64.service", 0, CLD_EXITED);
 125
 126 #elif defined(__s390__)
 127         test(m, "exec-personality-s390.service", 0, CLD_EXITED);
 128
 129 #elif defined(__powerpc64__)
 130 #  if __BYTE_ORDER == __BIG_ENDIAN
 131         test(m, "exec-personality-ppc64.service", 0, CLD_EXITED);
 132 #  else
 133         test(m, "exec-personality-ppc64le.service", 0, CLD_EXITED);
 134 #  endif
 135
 136 #elif defined(__aarch64__)
 137         test(m, "exec-personality-aarch64.service", 0, CLD_EXITED);
 138
 139 #elif defined(__i386__)
 140         test(m, "exec-personality-x86.service", 0, CLD_EXITED);
 141 #endif
 142 }
 143
 144 static void test_exec_ignoresigpipe(Manager *m) {
 145         test(m, "exec-ignoresigpipe-yes.service", 0, CLD_EXITED);
 146         test(m, "exec-ignoresigpipe-no.service", SIGPIPE, CLD_KILLED);
 147 }
 148
 149 static void test_exec_privatetmp(Manager *m) {
 150         assert_se(touch("/tmp/test-exec_privatetmp") >= 0);
 151
 152         test(m, "exec-privatetmp-yes.service", 0, CLD_EXITED);
 153         test(m, "exec-privatetmp-no.service", 0, CLD_EXITED);
 154
 155         unlink("/tmp/test-exec_privatetmp");
 156 }
 157
 158 static void test_exec_privatedevices(Manager *m) {
 159         if (detect_container() > 0) {
 160                 log_notice("testing in container, skipping %s", __func__);
 161                 return;
 162         }
 163         if (!is_inaccessible_available()) {
 164                 log_notice("testing without inaccessible, skipping %s", __func__);
 165                 return;
 166         }
 167
 168         test(m, "exec-privatedevices-yes.service", 0, CLD_EXITED);
 169         test(m, "exec-privatedevices-no.service", 0, CLD_EXITED);
 170 }
 171
 172 static void test_exec_privatedevices_capabilities(Manager *m) {
 173         int r;
 174
 175         if (detect_container() > 0) {
 176                 log_notice("testing in container, skipping %s", __func__);
 177                 return;
 178         }
 179         if (!is_inaccessible_available()) {
 180                 log_notice("testing without inaccessible, skipping %s", __func__);
 181                 return;
 182         }
 183
 184         /* We use capsh to test if the capabilities are
 185          * properly set, so be sure that it exists */
 186         r = find_binary("capsh", NULL);
 187         if (r < 0) {
 188                 log_error_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
 189                 return;
 190         }
 191
 192         test(m, "exec-privatedevices-yes-capability-mknod.service", 0, CLD_EXITED);
 193         test(m, "exec-privatedevices-no-capability-mknod.service", 0, CLD_EXITED);
 194         test(m, "exec-privatedevices-yes-capability-sys-rawio.service", 0, CLD_EXITED);
 195         test(m, "exec-privatedevices-no-capability-sys-rawio.service", 0, CLD_EXITED);
 196 }
 197
 198 static void test_exec_protectkernelmodules(Manager *m) {
 199         int r;
 200
 201         if (detect_container() > 0) {
 202                 log_notice("testing in container, skipping %s", __func__);
 203                 return;
 204         }
 205         if (!is_inaccessible_available()) {
 206                 log_notice("testing without inaccessible, skipping %s", __func__);
 207                 return;
 208         }
 209
 210         r = find_binary("capsh", NULL);
 211         if (r < 0) {
 212                 log_error_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
 213                 return;
 214         }
 215
 216
 217         test(m, "exec-protectkernelmodules-no-capabilities.service", 0, CLD_EXITED);
 218         test(m, "exec-protectkernelmodules-yes-capabilities.service", 0, CLD_EXITED);
 219         test(m, "exec-protectkernelmodules-yes-mount-propagation.service", 0, CLD_EXITED);
 220 }
 221
 222 static void test_exec_readonlypaths(Manager *m) {
 223
 224         if (path_is_read_only_fs("/var") > 0)
 225                 return;
 226
 227         test(m, "exec-readonlypaths.service", 0, CLD_EXITED);
 228         test(m, "exec-readonlypaths-mount-propagation.service", 0, CLD_EXITED);
 229         test(m, "exec-readonlypaths-with-bindpaths.service", 0, CLD_EXITED);
 230 }
 231
 232 static void test_exec_readwritepaths(Manager *m) {
 233
 234         if (path_is_read_only_fs("/") > 0)
 235                 return;
 236
 237         test(m, "exec-readwritepaths-mount-propagation.service", 0, CLD_EXITED);
 238 }
 239
 240 static void test_exec_inaccessiblepaths(Manager *m) {
 241
 242         if (path_is_read_only_fs("/") > 0)
 243                 return;
 244
 245         test(m, "exec-inaccessiblepaths-mount-propagation.service", 0, CLD_EXITED);
 246 }
 247
 248 static void test_exec_inaccessiblepaths_proc(Manager *m) {
 249         if (!is_inaccessible_available()) {
 250                 log_notice("testing without inaccessible, skipping %s", __func__);
 251                 return;
 252         }
 253
 254         test(m, "exec-inaccessiblepaths-proc.service", 0, CLD_EXITED);
 255 }
 256
 257 static void test_exec_systemcallfilter(Manager *m) {
 258 #if HAVE_SECCOMP
 259         if (!is_seccomp_available())
 260                 return;
 261         test(m, "exec-systemcallfilter-not-failing.service", 0, CLD_EXITED);
 262         test(m, "exec-systemcallfilter-not-failing2.service", 0, CLD_EXITED);
 263         test(m, "exec-systemcallfilter-failing.service", SIGSYS, CLD_KILLED);
 264         test(m, "exec-systemcallfilter-failing2.service", SIGSYS, CLD_KILLED);
 265         test(m, "exec-systemcallfilter-with-errno-name.service", errno_from_name("EILSEQ"), CLD_EXITED);
 266         test(m, "exec-systemcallfilter-with-errno-number.service", 255, CLD_EXITED);
 267
 268 #endif
 269 }
 270
 271 static void test_exec_systemcallerrornumber(Manager *m) {
 272 #if HAVE_SECCOMP
 273         if (!is_seccomp_available())
 274                 return;
 275         test(m, "exec-systemcallerrornumber-name.service", errno_from_name("EACCES"), CLD_EXITED);
 276         test(m, "exec-systemcallerrornumber-number.service", 255, CLD_EXITED);
 277 #endif
 278 }
 279
 280 static void test_exec_restrict_namespaces(Manager *m) {
 281 #if HAVE_SECCOMP
 282         if (!is_seccomp_available())
 283                 return;
 284
 285         test(m, "exec-restrict-namespaces-no.service", 0, CLD_EXITED);
 286         test(m, "exec-restrict-namespaces-yes.service", 1, CLD_EXITED);
 287         test(m, "exec-restrict-namespaces-mnt.service", 0, CLD_EXITED);
 288         test(m, "exec-restrict-namespaces-mnt-blacklist.service", 1, CLD_EXITED);
 289 #endif
 290 }
 291
 292 static void test_exec_systemcall_system_mode_with_user(Manager *m) {
 293 #if HAVE_SECCOMP
 294         if (!is_seccomp_available())
 295                 return;
 296         if (getpwnam("nobody"))
 297                 test(m, "exec-systemcallfilter-system-user.service", 0, CLD_EXITED);
 298         else if (getpwnam("nfsnobody"))
 299                 test(m, "exec-systemcallfilter-system-user-nfsnobody.service", 0, CLD_EXITED);
 300         else
 301                 log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody user: %m", __func__);
 302 #endif
 303 }
 304
 305 static void test_exec_user(Manager *m) {
 306         if (getpwnam("nobody"))
 307                 test(m, "exec-user.service", 0, CLD_EXITED);
 308         else if (getpwnam("nfsnobody"))
 309                 test(m, "exec-user-nfsnobody.service", 0, CLD_EXITED);
 310         else
 311                 log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody user: %m", __func__);
 312 }
 313
 314 static void test_exec_group(Manager *m) {
 315         if (getgrnam("nobody"))
 316                 test(m, "exec-group.service", 0, CLD_EXITED);
 317         else if (getgrnam("nfsnobody"))
 318                 test(m, "exec-group-nfsnobody.service", 0, CLD_EXITED);
 319         else
 320                 log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody group: %m", __func__);
 321 }
 322
 323 static void test_exec_supplementary_groups(Manager *m) {
 324         test(m, "exec-supplementarygroups.service", 0, CLD_EXITED);
 325         test(m, "exec-supplementarygroups-single-group.service", 0, CLD_EXITED);
 326         test(m, "exec-supplementarygroups-single-group-user.service", 0, CLD_EXITED);
 327         test(m, "exec-supplementarygroups-multiple-groups-default-group-user.service", 0, CLD_EXITED);
 328         test(m, "exec-supplementarygroups-multiple-groups-withgid.service", 0, CLD_EXITED);
 329         test(m, "exec-supplementarygroups-multiple-groups-withuid.service", 0, CLD_EXITED);
 330 }
 331
 332 static void test_exec_dynamic_user(Manager *m) {
 333         test(m, "exec-dynamicuser-fixeduser.service", 0, CLD_EXITED);
 334         test(m, "exec-dynamicuser-fixeduser-one-supplementarygroup.service", 0, CLD_EXITED);
 335         test(m, "exec-dynamicuser-supplementarygroups.service", 0, CLD_EXITED);
 336         test(m, "exec-dynamicuser-state-dir.service", 0, CLD_EXITED);
 337 }
 338
 339 static void test_exec_environment(Manager *m) {
 340         test(m, "exec-environment.service", 0, CLD_EXITED);
 341         test(m, "exec-environment-multiple.service", 0, CLD_EXITED);
 342         test(m, "exec-environment-empty.service", 0, CLD_EXITED);
 343 }
 344
 345 static void test_exec_environmentfile(Manager *m) {
 346         static const char e[] =
 347                 "VAR1='word1 word2'\n"
 348                 "VAR2=word3 \n"
 349                 "# comment1\n"
 350                 "\n"
 351                 "; comment2\n"
 352                 " ; # comment3\n"
 353                 "line without an equal\n"
 354                 "VAR3='$word 5 6'\n";
 355         int r;
 356
 357         r = write_string_file("/tmp/test-exec_environmentfile.conf", e, WRITE_STRING_FILE_CREATE);
 358         assert_se(r == 0);
 359
 360         test(m, "exec-environmentfile.service", 0, CLD_EXITED);
 361
 362         unlink("/tmp/test-exec_environmentfile.conf");
 363 }
 364
 365 static void test_exec_passenvironment(Manager *m) {
 366         /* test-execute runs under MANAGER_USER which, by default, forwards all
 367          * variables present in the environment, but only those that are
 368          * present _at the time it is created_!
 369          *
 370          * So these PassEnvironment checks are still expected to work, since we
 371          * are ensuring the variables are not present at manager creation (they
 372          * are unset explicitly in main) and are only set here.
 373          *
 374          * This is still a good approximation of how a test for MANAGER_SYSTEM
 375          * would work.
 376          */
 377         assert_se(setenv("VAR1", "word1 word2", 1) == 0);
 378         assert_se(setenv("VAR2", "word3", 1) == 0);
 379         assert_se(setenv("VAR3", "$word 5 6", 1) == 0);
 380         test(m, "exec-passenvironment.service", 0, CLD_EXITED);
 381         test(m, "exec-passenvironment-repeated.service", 0, CLD_EXITED);
 382         test(m, "exec-passenvironment-empty.service", 0, CLD_EXITED);
 383         assert_se(unsetenv("VAR1") == 0);
 384         assert_se(unsetenv("VAR2") == 0);
 385         assert_se(unsetenv("VAR3") == 0);
 386         test(m, "exec-passenvironment-absent.service", 0, CLD_EXITED);
 387 }
 388
 389 static void test_exec_umask(Manager *m) {
 390         test(m, "exec-umask-default.service", 0, CLD_EXITED);
 391         test(m, "exec-umask-0177.service", 0, CLD_EXITED);
 392 }
 393
 394 static void test_exec_runtimedirectory(Manager *m) {
 395         test(m, "exec-runtimedirectory.service", 0, CLD_EXITED);
 396         test(m, "exec-runtimedirectory-mode.service", 0, CLD_EXITED);
 397         if (getgrnam("nobody"))
 398                 test(m, "exec-runtimedirectory-owner.service", 0, CLD_EXITED);
 399         else if (getgrnam("nfsnobody"))
 400                 test(m, "exec-runtimedirectory-owner-nfsnobody.service", 0, CLD_EXITED);
 401         else
 402                 log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody group: %m", __func__);
 403 }
 404
 405 static void test_exec_capabilityboundingset(Manager *m) {
 406         int r;
 407
 408         r = find_binary("capsh", NULL);
 409         if (r < 0) {
 410                 log_error_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
 411                 return;
 412         }
 413
 414         test(m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED);
 415         test(m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED);
 416         test(m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED);
 417         test(m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED);
 418 }
 419
 420 static void test_exec_capabilityambientset(Manager *m) {
 421         int r;
 422
 423         /* Check if the kernel has support for ambient capabilities. Run
 424          * the tests only if that's the case. Clearing all ambient
 425          * capabilities is fine, since we are expecting them to be unset
 426          * in the first place for the tests. */
 427         r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
 428         if (r >= 0 || errno != EINVAL) {
 429                 if (getpwnam("nobody")) {
 430                         test(m, "exec-capabilityambientset.service", 0, CLD_EXITED);
 431                         test(m, "exec-capabilityambientset-merge.service", 0, CLD_EXITED);
 432                 } else if (getpwnam("nfsnobody")) {
 433                         test(m, "exec-capabilityambientset-nfsnobody.service", 0, CLD_EXITED);
 434                         test(m, "exec-capabilityambientset-merge-nfsnobody.service", 0, CLD_EXITED);
 435                 } else
 436                         log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody user: %m", __func__);
 437         } else
 438                 log_error_errno(errno, "Skipping %s, the kernel does not support ambient capabilities: %m", __func__);
 439 }
 440
 441 static void test_exec_privatenetwork(Manager *m) {
 442         int r;
 443
 444         r = find_binary("ip", NULL);
 445         if (r < 0) {
 446                 log_error_errno(r, "Skipping %s, could not find ip binary: %m", __func__);
 447                 return;
 448         }
 449
 450         test(m, "exec-privatenetwork-yes.service", 0, CLD_EXITED);
 451 }
 452
 453 static void test_exec_oomscoreadjust(Manager *m) {
 454         test(m, "exec-oomscoreadjust-positive.service", 0, CLD_EXITED);
 455         test(m, "exec-oomscoreadjust-negative.service", 0, CLD_EXITED);
 456 }
 457
 458 static void test_exec_ioschedulingclass(Manager *m) {
 459         test(m, "exec-ioschedulingclass-none.service", 0, CLD_EXITED);
 460         test(m, "exec-ioschedulingclass-idle.service", 0, CLD_EXITED);
 461         test(m, "exec-ioschedulingclass-realtime.service", 0, CLD_EXITED);
 462         test(m, "exec-ioschedulingclass-best-effort.service", 0, CLD_EXITED);
 463 }
 464
 465 static void test_exec_spec_interpolation(Manager *m) {
 466         test(m, "exec-spec-interpolation.service", 0, CLD_EXITED);
 467 }
 468
 469 static void test_exec_read_only_path_suceed(Manager *m) {
 470         test(m, "exec-read-only-path-succeed.service", 0, CLD_EXITED);
 471 }
 472
 473 static void test_exec_unset_environment(Manager *m) {
 474         test(m, "exec-unset-environment.service", 0, CLD_EXITED);
 475 }
 476
 477 static void test_exec_specifier(Manager *m) {
 478         test(m, "exec-specifier.service", 0, CLD_EXITED);
 479 }
 480
 481 static int run_tests(UnitFileScope scope, const test_function_t *tests) {
 482         const test_function_t *test = NULL;
 483         Manager *m = NULL;
 484         int r;
 485
 486         assert_se(tests);
 487
 488         r = manager_new(scope, MANAGER_TEST_RUN_MINIMAL, &m);
 489         if (MANAGER_SKIP_TEST(r)) {
 490                 log_notice_errno(r, "Skipping test: manager_new: %m");
 491                 return EXIT_TEST_SKIP;
 492         }
 493         assert_se(r >= 0);
 494         assert_se(manager_startup(m, NULL, NULL) >= 0);
 495
 496         for (test = tests; test && *test; test++)
 497                 (*test)(m);
 498
 499         manager_free(m);
 500
 501         return 0;
 502 }
 503
 504 int main(int argc, char *argv[]) {
 505         static const test_function_t user_tests[] = {
 506                 test_exec_bind_paths,
 507                 test_exec_workingdirectory,
 508                 test_exec_personality,
 509                 test_exec_ignoresigpipe,
 510                 test_exec_privatetmp,
 511                 test_exec_privatedevices,
 512                 test_exec_privatedevices_capabilities,
 513                 test_exec_protectkernelmodules,
 514                 test_exec_readonlypaths,
 515                 test_exec_readwritepaths,
 516                 test_exec_inaccessiblepaths,
 517                 test_exec_inaccessiblepaths_proc,
 518                 test_exec_privatenetwork,
 519                 test_exec_systemcallfilter,
 520                 test_exec_systemcallerrornumber,
 521                 test_exec_restrict_namespaces,
 522                 test_exec_user,
 523                 test_exec_group,
 524                 test_exec_supplementary_groups,
 525                 test_exec_environment,
 526                 test_exec_environmentfile,
 527                 test_exec_passenvironment,
 528                 test_exec_umask,
 529                 test_exec_runtimedirectory,
 530                 test_exec_capabilityboundingset,
 531                 test_exec_capabilityambientset,
 532                 test_exec_oomscoreadjust,
 533                 test_exec_ioschedulingclass,
 534                 test_exec_spec_interpolation,
 535                 test_exec_read_only_path_suceed,
 536                 test_exec_unset_environment,
 537                 NULL,
 538         };
 539         static const test_function_t system_tests[] = {
 540                 test_exec_systemcall_system_mode_with_user,
 541                 test_exec_dynamic_user,
 542                 test_exec_specifier,
 543                 NULL,
 544         };
 545         int r;
 546
 547         log_set_max_level(LOG_DEBUG);
 548         log_parse_environment();
 549         log_open();
 550
 551         /* It is needed otherwise cgroup creation fails */
 552         if (getuid() != 0) {
 553                 puts("Skipping test: not root");
 554                 return EXIT_TEST_SKIP;
 555         }
 556
 557         r = enter_cgroup_subroot();
 558         if (r == -ENOMEDIUM) {
 559                 puts("Skipping test: cgroupfs not available");
 560                 return EXIT_TEST_SKIP;
 561         }
 562
 563         assert_se(setenv("XDG_RUNTIME_DIR", "/tmp/", 1) == 0);
 564         assert_se(set_unit_path(get_testdata_dir("/test-execute")) >= 0);
 565
 566         /* Unset VAR1, VAR2 and VAR3 which are used in the PassEnvironment test
 567          * cases, otherwise (and if they are present in the environment),
 568          * `manager_default_environment` will copy them into the default
 569          * environment which is passed to each created job, which will make the
 570          * tests that expect those not to be present to fail.
 571          */
 572         assert_se(unsetenv("VAR1") == 0);
 573         assert_se(unsetenv("VAR2") == 0);
 574         assert_se(unsetenv("VAR3") == 0);
 575
 576         r = run_tests(UNIT_FILE_USER, user_tests);
 577         if (r != 0)
 578                 return r;
 579
 580         return run_tests(UNIT_FILE_SYSTEM, system_tests);
 581 }