src/test/test-ns.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2010 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <stdlib.h>
  21 #include <unistd.h>
  22
  23 #include "log.h"
  24 #include "namespace.h"
  25
  26 int main(int argc, char *argv[]) {
  27         const char * const writable[] = {
  28                 "/home",
  29                 "-/home/lennart/projects/foobar", /* this should be masked automatically */
  30                 NULL
  31         };
  32
  33         const char * const readonly[] = {
  34                 /* "/", */
  35                 /* "/usr", */
  36                 "/boot",
  37                 "/lib",
  38                 "/usr/lib",
  39                 "-/lib64",
  40                 "-/usr/lib64",
  41                 NULL
  42         };
  43
  44         const char *inaccessible[] = {
  45                 "/home/lennart/projects",
  46                 NULL
  47         };
  48
  49         static const NameSpaceInfo ns_info = {
  50                 .private_dev = true,
  51                 .protect_control_groups = true,
  52                 .protect_kernel_tunables = true,
  53                 .protect_kernel_modules = true,
  54         };
  55
  56         char *root_directory;
  57         char *projects_directory;
  58         int r;
  59         char tmp_dir[] = "/tmp/systemd-private-XXXXXX",
  60              var_tmp_dir[] = "/var/tmp/systemd-private-XXXXXX";
  61
  62         log_set_max_level(LOG_DEBUG);
  63
  64         assert_se(mkdtemp(tmp_dir));
  65         assert_se(mkdtemp(var_tmp_dir));
  66
  67         root_directory = getenv("TEST_NS_CHROOT");
  68         projects_directory = getenv("TEST_NS_PROJECTS");
  69
  70         if (projects_directory)
  71                 inaccessible[0] = projects_directory;
  72
  73         log_info("Inaccessible directory: '%s'", inaccessible[0]);
  74         if (root_directory)
  75                 log_info("Chroot: '%s'", root_directory);
  76         else
  77                 log_info("Not chrooted");
  78
  79         r = setup_namespace(root_directory,
  80                             NULL,
  81                             &ns_info,
  82                             (char **) writable,
  83                             (char **) readonly,
  84                             (char **) inaccessible,
  85                             &(BindMount) { .source = (char*) "/usr/bin", .destination = (char*) "/etc/systemd", .read_only = true }, 1,
  86                             tmp_dir,
  87                             var_tmp_dir,
  88                             PROTECT_HOME_NO,
  89                             PROTECT_SYSTEM_NO,
  90                             0,
  91                             0);
  92         if (r < 0) {
  93                 log_error_errno(r, "Failed to setup namespace: %m");
  94
  95                 log_info("Usage:\n"
  96                          "  sudo TEST_NS_PROJECTS=/home/lennart/projects ./test-ns\n"
  97                          "  sudo TEST_NS_CHROOT=/home/alban/debian-tree TEST_NS_PROJECTS=/home/alban/debian-tree/home/alban/Documents ./test-ns");
  98
  99                 return 1;
 100         }
 101
 102         execl("/bin/sh", "/bin/sh", NULL);
 103         log_error_errno(errno, "execl(): %m");
 104
 105         return 1;
 106 }