2 # SPDX-License-Identifier: LGPL-2.1-or-later
3 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
4 # ex: ts=8 sw=4 sts=4 et filetype=sh
5 # shellcheck disable=SC2233,SC2235
9 # shellcheck source=test/units/util.sh
10 .
"$(dirname "$0")"/util.sh
12 systemd-dissect
--json=short
"$MINIMAL_IMAGE.raw" | \
13 grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"partition_label":null,"fstype":"squashfs","architecture":null,"verity":"external"'
14 systemd-dissect
"$MINIMAL_IMAGE.raw" |
grep -q -F "MARKER=1"
15 systemd-dissect
"$MINIMAL_IMAGE.raw" |
grep -q -F -f <(sed 's/"//g' "$OS_RELEASE")
17 systemd-dissect
--list "$MINIMAL_IMAGE.raw" |
grep -q '^etc/os-release$'
18 systemd-dissect
--mtree "$MINIMAL_IMAGE.raw" --mtree-hash yes | \
19 grep -qe "^./usr/bin/cat type=file mode=0755 uid=0 gid=0 size=[0-9]* sha256sum=[a-z0-9]*$"
20 systemd-dissect
--mtree "$MINIMAL_IMAGE.raw" --mtree-hash no | \
21 grep -qe "^./usr/bin/cat type=file mode=0755 uid=0 gid=0 size=[0-9]*$"
23 read -r SHA256SUM1 _
< <(systemd-dissect
--copy-from "$MINIMAL_IMAGE.raw" etc
/os-release | sha256sum
)
24 test "$SHA256SUM1" != ""
25 read -r SHA256SUM2 _
< <(systemd-dissect
--read-only --with "$MINIMAL_IMAGE.raw" sha256sum etc
/os-release
)
26 test "$SHA256SUM2" != ""
27 test "$SHA256SUM1" = "$SHA256SUM2"
29 if systemctl
--version |
grep -qF -- "+LIBARCHIVE" ; then
30 # Make sure tarballs are reproducible
31 read -r SHA256SUM1 _
< <(systemd-dissect
--make-archive "$MINIMAL_IMAGE.raw" | sha256sum
)
32 test "$SHA256SUM1" != ""
33 read -r SHA256SUM2 _
< <(systemd-dissect
--make-archive "$MINIMAL_IMAGE.raw" | sha256sum
)
34 test "$SHA256SUM2" != ""
35 test "$SHA256SUM1" = "$SHA256SUM2"
36 # Also check that a file we expect to be there is there
37 systemd-dissect
--make-archive "$MINIMAL_IMAGE.raw" |
tar t |
grep etc
/os-release
40 mv "$MINIMAL_IMAGE.verity" "$MINIMAL_IMAGE.fooverity"
41 mv "$MINIMAL_IMAGE.roothash" "$MINIMAL_IMAGE.foohash"
42 systemd-dissect
"$MINIMAL_IMAGE.raw" \
44 --root-hash="$MINIMAL_IMAGE_ROOTHASH" \
45 --verity-data="$MINIMAL_IMAGE.fooverity" | \
46 grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"partition_label":null,"fstype":"squashfs","architecture":null,"verity":"external"'
47 systemd-dissect
"$MINIMAL_IMAGE.raw" \
48 --root-hash="$MINIMAL_IMAGE_ROOTHASH" \
49 --verity-data="$MINIMAL_IMAGE.fooverity" | \
51 systemd-dissect
"$MINIMAL_IMAGE.raw" \
52 --root-hash="$MINIMAL_IMAGE_ROOTHASH" \
53 --verity-data="$MINIMAL_IMAGE.fooverity" | \
54 grep -q -F -f <(sed 's/"//g' "$OS_RELEASE")
55 mv "$MINIMAL_IMAGE.fooverity" "$MINIMAL_IMAGE.verity"
56 mv "$MINIMAL_IMAGE.foohash" "$MINIMAL_IMAGE.roothash"
58 mkdir
-p "$IMAGE_DIR/mount" "$IMAGE_DIR/mount2"
59 systemd-dissect
--mount "$MINIMAL_IMAGE.raw" "$IMAGE_DIR/mount"
60 grep -q -F -f "$OS_RELEASE" "$IMAGE_DIR/mount/usr/lib/os-release"
61 grep -q -F -f "$OS_RELEASE" "$IMAGE_DIR/mount/etc/os-release"
62 grep -q -F "MARKER=1" "$IMAGE_DIR/mount/usr/lib/os-release"
63 # Verity volume should be shared (opened only once)
64 systemd-dissect
--mount "$MINIMAL_IMAGE.raw" "$IMAGE_DIR/mount2"
65 verity_count
=$
(find /dev
/mapper
/ -name "*verity*" |
wc -l)
66 # In theory we should check that count is exactly one. In practice, libdevmapper
67 # randomly and unpredictably fails with an unhelpful EINVAL when a device is open
68 # (and even mounted and in use), so best-effort is the most we can do for now
69 if [[ "$verity_count" -lt 1 ]]; then
70 echo "Verity device $MINIMAL_IMAGE.raw not found in /dev/mapper/"
73 systemd-dissect
--umount "$IMAGE_DIR/mount"
74 systemd-dissect
--umount "$IMAGE_DIR/mount2"
76 systemd-run
-P -p RootImage
="$MINIMAL_IMAGE.raw" cat /usr
/lib
/os-release |
grep -q -F "MARKER=1"
77 mv "$MINIMAL_IMAGE.verity" "$MINIMAL_IMAGE.fooverity"
78 mv "$MINIMAL_IMAGE.roothash" "$MINIMAL_IMAGE.foohash"
80 -p RootImage
="$MINIMAL_IMAGE.raw" \
81 -p RootHash
="$MINIMAL_IMAGE.foohash" \
82 -p RootVerity
="$MINIMAL_IMAGE.fooverity" \
83 cat /usr
/lib
/os-release |
grep -q -F "MARKER=1"
84 # Let's use the long option name just here as a test
86 --property RootImage
="$MINIMAL_IMAGE.raw" \
87 --property RootHash
="$MINIMAL_IMAGE_ROOTHASH" \
88 --property RootVerity
="$MINIMAL_IMAGE.fooverity" \
89 cat /usr
/lib
/os-release |
grep -q -F "MARKER=1"
90 mv "$MINIMAL_IMAGE.fooverity" "$MINIMAL_IMAGE.verity"
91 mv "$MINIMAL_IMAGE.foohash" "$MINIMAL_IMAGE.roothash"
93 # Derive partition UUIDs from root hash, in UUID syntax
94 ROOT_UUID
="$(systemd-id128 -u show "$
(head -c 32 "$MINIMAL_IMAGE.roothash")" -u | tail -n 1 | cut -b 6-)"
95 VERITY_UUID
="$(systemd-id128 -u show "$
(tail -c 32 "$MINIMAL_IMAGE.roothash")" -u | tail -n 1 | cut -b 6-)"
97 systemd-dissect
--json=short \
98 --root-hash "$MINIMAL_IMAGE_ROOTHASH" \
99 "$MINIMAL_IMAGE.gpt" | \
100 grep -q '{"rw":"ro","designator":"root","partition_uuid":"'"$ROOT_UUID"'","partition_label":"Root Partition","fstype":"squashfs","architecture":"'"$ARCHITECTURE"'","verity":"signed",'
101 systemd-dissect
--json=short \
102 --root-hash "$MINIMAL_IMAGE_ROOTHASH" \
103 "$MINIMAL_IMAGE.gpt" | \
104 grep -q '{"rw":"ro","designator":"root-verity","partition_uuid":"'"$VERITY_UUID"'","partition_label":"Verity Partition","fstype":"DM_verity_hash","architecture":"'"$ARCHITECTURE"'","verity":null,'
105 if [[ -n "${OPENSSL_CONFIG:-}" ]]; then
106 systemd-dissect
--json=short \
107 --root-hash "$MINIMAL_IMAGE_ROOTHASH" \
108 "$MINIMAL_IMAGE.gpt" | \
109 grep -qE '{"rw":"ro","designator":"root-verity-sig","partition_uuid":"'".*"'","partition_label":"Signature Partition","fstype":"verity_hash_signature","architecture":"'"$ARCHITECTURE"'","verity":null,'
111 systemd-dissect
--root-hash "$MINIMAL_IMAGE_ROOTHASH" "$MINIMAL_IMAGE.gpt" |
grep -q -F "MARKER=1"
112 systemd-dissect
--root-hash "$MINIMAL_IMAGE_ROOTHASH" "$MINIMAL_IMAGE.gpt" |
grep -q -F -f <(sed 's/"//g' "$OS_RELEASE")
114 # Test image policies
115 systemd-dissect
--validate "$MINIMAL_IMAGE.gpt"
116 systemd-dissect
--validate "$MINIMAL_IMAGE.gpt" --image-policy='*'
117 (! systemd-dissect
--validate "$MINIMAL_IMAGE.gpt" --image-policy='~')
118 (! systemd-dissect
--validate "$MINIMAL_IMAGE.gpt" --image-policy='-')
119 (! systemd-dissect
--validate "$MINIMAL_IMAGE.gpt" --image-policy=root
=absent
)
120 (! systemd-dissect
--validate "$MINIMAL_IMAGE.gpt" --image-policy=swap
=unprotected
+encrypted
+verity
)
121 systemd-dissect
--validate "$MINIMAL_IMAGE.gpt" --image-policy=root
=unprotected
122 systemd-dissect
--validate "$MINIMAL_IMAGE.gpt" --image-policy=root
=verity
123 systemd-dissect
--validate "$MINIMAL_IMAGE.gpt" --image-policy=root
=verity
:root-verity-sig
=unused
+absent
124 systemd-dissect
--validate "$MINIMAL_IMAGE.gpt" --image-policy=root
=verity
:swap
=absent
125 systemd-dissect
--validate "$MINIMAL_IMAGE.gpt" --image-policy=root
=verity
:swap
=absent
+unprotected
126 (! systemd-dissect
--validate "$MINIMAL_IMAGE.gpt" --image-policy=root
=verity
:root-verity
=unused
+absent
)
127 systemd-dissect
--validate "$MINIMAL_IMAGE.gpt" --image-policy=root
=signed
128 (! systemd-dissect
--validate "$MINIMAL_IMAGE.gpt" --image-policy=root
=signed
:root-verity-sig
=unused
+absent
)
129 (! systemd-dissect
--validate "$MINIMAL_IMAGE.gpt" --image-policy=root
=signed
:root-verity
=unused
+absent
)
131 # Test RootImagePolicy= unit file setting
132 systemd-run
--wait -P \
133 -p RootImage
="$MINIMAL_IMAGE.gpt" \
134 -p RootHash
="$MINIMAL_IMAGE_ROOTHASH" \
136 cat /usr
/lib
/os-release |
grep -q -F "MARKER=1"
137 systemd-run
--wait -P \
138 -p RootImage
="$MINIMAL_IMAGE.gpt" \
139 -p RootHash
="$MINIMAL_IMAGE_ROOTHASH" \
140 -p RootImagePolicy
='*' \
142 cat /usr
/lib
/os-release |
grep -q -F "MARKER=1"
143 (! systemd-run
--wait -P \
144 -p RootImage
="$MINIMAL_IMAGE.gpt" \
145 -p RootHash
="$MINIMAL_IMAGE_ROOTHASH" \
146 -p RootImagePolicy
='~' \
148 cat /usr
/lib
/os-release |
grep -q -F "MARKER=1")
149 (! systemd-run
--wait -P \
150 -p RootImage
="$MINIMAL_IMAGE.gpt" \
151 -p RootHash
="$MINIMAL_IMAGE_ROOTHASH" \
152 -p RootImagePolicy
='-' \
154 cat /usr
/lib
/os-release |
grep -q -F "MARKER=1")
155 (! systemd-run
--wait -P \
156 -p RootImage
="$MINIMAL_IMAGE.gpt" \
157 -p RootHash
="$MINIMAL_IMAGE_ROOTHASH" \
158 -p RootImagePolicy
='root=absent' \
160 cat /usr
/lib
/os-release |
grep -q -F "MARKER=1")
161 systemd-run
--wait -P \
162 -p RootImage
="$MINIMAL_IMAGE.gpt" \
163 -p RootHash
="$MINIMAL_IMAGE_ROOTHASH" \
164 -p RootImagePolicy
='root=verity' \
166 cat /usr
/lib
/os-release |
grep -q -F "MARKER=1"
167 systemd-run
--wait -P \
168 -p RootImage
="$MINIMAL_IMAGE.gpt" \
169 -p RootHash
="$MINIMAL_IMAGE_ROOTHASH" \
170 -p RootImagePolicy
='root=signed' \
172 cat /usr
/lib
/os-release |
grep -q -F "MARKER=1"
173 (! systemd-run
--wait -P \
174 -p RootImage
="$MINIMAL_IMAGE.gpt" \
175 -p RootHash
="$MINIMAL_IMAGE_ROOTHASH" \
176 -p RootImagePolicy
='root=encrypted' \
178 cat /usr
/lib
/os-release |
grep -q -F "MARKER=1")
180 systemd-dissect
--root-hash "$MINIMAL_IMAGE_ROOTHASH" --mount "$MINIMAL_IMAGE.gpt" "$IMAGE_DIR/mount"
181 grep -q -F -f "$OS_RELEASE" "$IMAGE_DIR/mount/usr/lib/os-release"
182 grep -q -F -f "$OS_RELEASE" "$IMAGE_DIR/mount/etc/os-release"
183 grep -q -F "MARKER=1" "$IMAGE_DIR/mount/usr/lib/os-release"
184 systemd-dissect
--umount "$IMAGE_DIR/mount"
186 systemd-dissect
--root-hash "$MINIMAL_IMAGE_ROOTHASH" --mount "$MINIMAL_IMAGE.gpt" --in-memory "$IMAGE_DIR/mount"
187 grep -q -F -f "$OS_RELEASE" "$IMAGE_DIR/mount/usr/lib/os-release"
188 grep -q -F -f "$OS_RELEASE" "$IMAGE_DIR/mount/etc/os-release"
189 grep -q -F "MARKER=1" "$IMAGE_DIR/mount/usr/lib/os-release"
190 systemd-dissect
--umount "$IMAGE_DIR/mount"
192 # add explicit -p MountAPIVFS=yes once to test the parser
194 -p RootImage
="$MINIMAL_IMAGE.gpt" \
195 -p RootHash
="$MINIMAL_IMAGE_ROOTHASH" \
197 cat /usr
/lib
/os-release |
grep -q -F "MARKER=1"
199 -p RootImage
="$MINIMAL_IMAGE.raw" \
200 -p RootImageOptions
="root:nosuid,dev home:ro,dev ro,noatime" \
201 mount |
grep -F "squashfs" |
grep -q -F "nosuid"
203 -p RootImage
="$MINIMAL_IMAGE.gpt" \
204 -p RootImageOptions
="root:ro,noatime root:ro,dev" \
205 mount |
grep -F "squashfs" |
grep -q -F "noatime"
207 mkdir
-p "$IMAGE_DIR/result"
208 cat >/run
/systemd
/system
/testservice-50a.service
<<EOF
211 ExecStart=bash -c "mount >/run/result/a"
212 BindPaths=$IMAGE_DIR/result:/run/result
213 TemporaryFileSystem=/run
214 RootImage=$MINIMAL_IMAGE.raw
215 RootImageOptions=root:ro,noatime home:ro,dev relatime,dev
216 RootImageOptions=nosuid,dev
218 systemctl start testservice-50a.service
219 grep -F "squashfs" "$IMAGE_DIR/result/a" |
grep -q -F "noatime"
220 grep -F "squashfs" "$IMAGE_DIR/result/a" |
grep -q -F -v "nosuid"
222 cat >/run
/systemd
/system
/testservice-50b.service
<<EOF
225 ExecStart=bash -c "mount >/run/result/b"
226 BindPaths=$IMAGE_DIR/result:/run/result
227 TemporaryFileSystem=/run
228 RootImage=$MINIMAL_IMAGE.gpt
229 RootImageOptions=root:ro,noatime,nosuid home:ro,dev nosuid,dev
230 RootImageOptions=home:ro,dev nosuid,dev,%%foo
231 # this is the default, but let's specify once to test the parser
234 systemctl start testservice-50b.service
235 grep -F "squashfs" "$IMAGE_DIR/result/b" |
grep -q -F "noatime"
237 # Check that specifier escape is applied %%foo → %foo
238 busctl get-property org.freedesktop.systemd1 \
239 /org
/freedesktop
/systemd
1/unit
/testservice_2d50b_2eservice \
240 org.freedesktop.systemd1.Service RootImageOptions |
grep -F "nosuid,dev,%foo"
242 # Now do some checks with MountImages, both by itself, with options and in combination with RootImage, and as single FS or GPT image
244 -p MountImages
="$MINIMAL_IMAGE.gpt:/run/img1 $MINIMAL_IMAGE.raw:/run/img2" \
245 cat /run
/img
1/usr
/lib
/os-release |
grep -q -F "MARKER=1"
247 -p MountImages
="$MINIMAL_IMAGE.gpt:/run/img1 $MINIMAL_IMAGE.raw:/run/img2" \
248 cat /run
/img
2/usr
/lib
/os-release |
grep -q -F "MARKER=1"
250 -p MountImages
="$MINIMAL_IMAGE.gpt:/run/img1 $MINIMAL_IMAGE.raw:/run/img2:nosuid,dev" \
251 mount |
grep -F "squashfs" |
grep -q -F "nosuid"
253 -p MountImages
="$MINIMAL_IMAGE.gpt:/run/img1:root:nosuid $MINIMAL_IMAGE.raw:/run/img2:home:suid" \
254 mount |
grep -F "squashfs" |
grep -q -F "nosuid"
256 -p MountImages
="$MINIMAL_IMAGE.raw:/run/img2\:3" \
257 cat /run
/img2
:3/usr
/lib
/os-release |
grep -q -F "MARKER=1"
259 -p MountImages
="$MINIMAL_IMAGE.raw:/run/img2\:3:nosuid" \
260 mount |
grep -F "squashfs" |
grep -q -F "nosuid"
262 -p TemporaryFileSystem
=/run \
263 -p RootImage
="$MINIMAL_IMAGE.raw" \
264 -p MountImages
="$MINIMAL_IMAGE.gpt:/run/img1 $MINIMAL_IMAGE.raw:/run/img2" \
265 cat /usr
/lib
/os-release |
grep -q -F "MARKER=1"
267 -p TemporaryFileSystem
=/run \
268 -p RootImage
="$MINIMAL_IMAGE.raw" \
269 -p MountImages
="$MINIMAL_IMAGE.gpt:/run/img1 $MINIMAL_IMAGE.raw:/run/img2" \
270 cat /run
/img
1/usr
/lib
/os-release |
grep -q -F "MARKER=1"
272 -p TemporaryFileSystem
=/run \
273 -p RootImage
="$MINIMAL_IMAGE.gpt" \
274 -p RootHash
="$MINIMAL_IMAGE_ROOTHASH" \
275 -p MountImages
="$MINIMAL_IMAGE.gpt:/run/img1 $MINIMAL_IMAGE.raw:/run/img2" \
276 cat /run
/img
2/usr
/lib
/os-release |
grep -q -F "MARKER=1"
277 cat >/run
/systemd
/system
/testservice-50c.service
<<EOF
280 TemporaryFileSystem=/run
281 RootImage=$MINIMAL_IMAGE.raw
282 MountImages=$MINIMAL_IMAGE.gpt:/run/img1:root:noatime:home:relatime
283 MountImages=$MINIMAL_IMAGE.raw:/run/img2\:3:nosuid
284 ExecStart=bash -c "cat /run/img1/usr/lib/os-release >/run/result/c"
285 ExecStart=bash -c "cat /run/img2:3/usr/lib/os-release >>/run/result/c"
286 ExecStart=bash -c "mount >>/run/result/c"
287 BindPaths=$IMAGE_DIR/result:/run/result
290 systemctl start testservice-50c.service
291 grep -q -F "MARKER=1" "$IMAGE_DIR/result/c"
292 grep -F "squashfs" "$IMAGE_DIR/result/c" |
grep -q -F "noatime"
293 grep -F "squashfs" "$IMAGE_DIR/result/c" |
grep -q -F -v "nosuid"
295 # Adding a new mounts at runtime works if the unit is in the active state,
296 # so use Type=notify to make sure there's no race condition in the test
297 cat >/run
/systemd
/system
/testservice-50d.service
<<EOF
305 systemd-notify --ready; \\
306 while [ ! -f /tmp/img/usr/lib/os-release ] || ! grep -q -F MARKER /tmp/img/usr/lib/os-release; do \\
310 mount | grep -F "on /tmp/img type squashfs" | grep -q -F "nosuid"; \\
313 systemctl start testservice-50d.service
315 # Mount twice to exercise mount-beneath (on kernel 6.5+, on older kernels it will just overmount)
316 mkdir
-p /tmp
/wrong
/foo
317 mksquashfs
/tmp
/wrong
/foo
/tmp
/wrong.raw
318 systemctl mount-image
--mkdir testservice-50d.service
/tmp
/wrong.raw
/tmp
/img
319 test "$(systemctl show -P SubState testservice-50d.service)" = "running"
320 systemctl mount-image
--mkdir testservice-50d.service
"$MINIMAL_IMAGE.raw" /tmp
/img root
:nosuid
321 # shellcheck disable=SC2016
322 timeout
30s bash
-xec 'while [[ $(systemctl show -P SubState testservice-50d.service) == running ]]; do sleep .2; done'
323 systemctl is-active testservice-50d.service
325 # ExtensionImages will set up an overlay
327 --property ExtensionImages
=/usr
/share
/app0.raw \
328 --property RootImage
="$MINIMAL_IMAGE.raw" \
329 cat /opt
/script0.sh |
grep -q -F "extension-release.app0"
331 --property ExtensionImages
=/usr
/share
/app0.raw \
332 --property RootImage
="$MINIMAL_IMAGE.raw" \
333 cat /usr
/lib
/systemd
/system
/some_file |
grep -q -F "MARKER=1"
335 --property ExtensionImages
="/usr/share/app0.raw /usr/share/app1.raw" \
336 --property RootImage
="$MINIMAL_IMAGE.raw" \
337 cat /opt
/script0.sh |
grep -q -F "extension-release.app0"
339 --property ExtensionImages
="/usr/share/app0.raw /usr/share/app1.raw" \
340 --property RootImage
="$MINIMAL_IMAGE.raw" \
341 cat /usr
/lib
/systemd
/system
/some_file |
grep -q -F "MARKER=1"
343 --property ExtensionImages
="/usr/share/app0.raw /usr/share/app1.raw" \
344 --property RootImage
="$MINIMAL_IMAGE.raw" \
345 cat /opt
/script1.sh |
grep -q -F "extension-release.app2"
347 --property ExtensionImages
="/usr/share/app0.raw /usr/share/app1.raw" \
348 --property RootImage
="$MINIMAL_IMAGE.raw" \
349 cat /usr
/lib
/systemd
/system
/other_file |
grep -q -F "MARKER=1"
351 --property ExtensionImages
=/usr
/share
/app-nodistro.raw \
352 --property RootImage
="$MINIMAL_IMAGE.raw" \
353 cat /usr
/lib
/systemd
/system
/some_file |
grep -q -F "MARKER=1"
355 --property ExtensionImages
=/etc
/service-scoped-test.raw \
356 --property RootImage
="$MINIMAL_IMAGE.raw" \
357 cat /etc
/systemd
/system
/some_file |
grep -q -F "MARKER_CONFEXT_123"
358 # Check that using a symlink to NAME-VERSION.raw works as long as the symlink has the correct name NAME.raw
359 mkdir
-p /usr
/share
/symlink-test
/
360 cp /usr
/share
/app-nodistro.raw
/usr
/share
/symlink-test
/app-nodistro-v1.raw
361 ln -fs /usr
/share
/symlink-test
/app-nodistro-v1.raw
/usr
/share
/symlink-test
/app-nodistro.raw
363 --property ExtensionImages
=/usr
/share
/symlink-test
/app-nodistro.raw \
364 --property RootImage
="$MINIMAL_IMAGE.raw" \
365 cat /usr
/lib
/systemd
/system
/some_file |
grep -q -F "MARKER=1"
367 # Symlink check again but for confext
368 mkdir
-p /etc
/symlink-test
/
369 cp /etc
/service-scoped-test.raw
/etc
/symlink-test
/service-scoped-test-v1.raw
370 ln -fs /etc
/symlink-test
/service-scoped-test-v1.raw
/etc
/symlink-test
/service-scoped-test.raw
372 --property ExtensionImages
=/etc
/symlink-test
/service-scoped-test.raw \
373 --property RootImage
="$MINIMAL_IMAGE.raw" \
374 cat /etc
/systemd
/system
/some_file |
grep -q -F "MARKER_CONFEXT_123"
375 # And again mixing sysext and confext
377 --property ExtensionImages
=/usr
/share
/symlink-test
/app-nodistro.raw \
378 --property ExtensionImages
=/etc
/symlink-test
/service-scoped-test.raw \
379 --property RootImage
="$MINIMAL_IMAGE.raw" \
380 cat /etc
/systemd
/system
/some_file |
grep -q -F "MARKER_CONFEXT_123"
382 --property ExtensionImages
=/usr
/share
/symlink-test
/app-nodistro.raw \
383 --property ExtensionImages
=/etc
/symlink-test
/service-scoped-test.raw \
384 --property RootImage
="$MINIMAL_IMAGE.raw" \
385 cat /usr
/lib
/systemd
/system
/some_file |
grep -q -F "MARKER=1"
387 cat >/run
/systemd
/system
/testservice-50e.service
<<EOF
390 TemporaryFileSystem=/run /var/lib
392 RootImage=$MINIMAL_IMAGE.raw
393 ExtensionImages=/usr/share/app0.raw /usr/share/app1.raw:nosuid
394 # Relevant only for sanitizer runs
395 UnsetEnvironment=LD_PRELOAD
396 ExecStart=bash -c '/opt/script0.sh | grep ID'
397 ExecStart=bash -c '/opt/script1.sh | grep ID'
401 systemctl start testservice-50e.service
402 systemctl is-active testservice-50e.service
404 # Check vpick support in ExtensionImages=
409 ln -s /usr
/share
/app0.raw
"$VDIR/${VBASE}_0.raw"
410 ln -s /usr
/share
/app1.raw
"$VDIR/${VBASE}_1.raw"
412 systemd-run
-P -p ExtensionImages
="$VDIR" bash
-c '/opt/script1.sh | grep ID'
416 # ExtensionDirectories will set up an overlay
417 mkdir
-p "$IMAGE_DIR/app0" "$IMAGE_DIR/app1" "$IMAGE_DIR/app-nodistro" "$IMAGE_DIR/service-scoped-test"
419 --property ExtensionDirectories
="$IMAGE_DIR/nonexistent" \
420 --property RootImage
="$MINIMAL_IMAGE.raw" \
423 --property ExtensionDirectories
="$IMAGE_DIR/app0" \
424 --property RootImage
="$MINIMAL_IMAGE.raw" \
426 systemd-dissect
--mount /usr
/share
/app0.raw
"$IMAGE_DIR/app0"
427 systemd-dissect
--mount /usr
/share
/app1.raw
"$IMAGE_DIR/app1"
428 systemd-dissect
--mount /usr
/share
/app-nodistro.raw
"$IMAGE_DIR/app-nodistro"
429 systemd-dissect
--mount /etc
/service-scoped-test.raw
"$IMAGE_DIR/service-scoped-test"
431 --property ExtensionDirectories
="$IMAGE_DIR/app0" \
432 --property RootImage
="$MINIMAL_IMAGE.raw" \
433 cat /opt
/script0.sh |
grep -q -F "extension-release.app0"
435 --property ExtensionDirectories
="$IMAGE_DIR/app0" \
436 --property RootImage
="$MINIMAL_IMAGE.raw" \
437 cat /usr
/lib
/systemd
/system
/some_file |
grep -q -F "MARKER=1"
439 --property ExtensionDirectories
="$IMAGE_DIR/app0 $IMAGE_DIR/app1" \
440 --property RootImage
="$MINIMAL_IMAGE.raw" \
441 cat /opt
/script0.sh |
grep -q -F "extension-release.app0"
443 --property ExtensionDirectories
="$IMAGE_DIR/app0 $IMAGE_DIR/app1" \
444 --property RootImage
="$MINIMAL_IMAGE.raw" \
445 cat /usr
/lib
/systemd
/system
/some_file |
grep -q -F "MARKER=1"
447 --property ExtensionDirectories
="$IMAGE_DIR/app0 $IMAGE_DIR/app1" \
448 --property RootImage
="$MINIMAL_IMAGE.raw" \
449 cat /opt
/script1.sh |
grep -q -F "extension-release.app2"
451 --property ExtensionDirectories
="$IMAGE_DIR/app0 $IMAGE_DIR/app1" \
452 --property RootImage
="$MINIMAL_IMAGE.raw" \
453 cat /usr
/lib
/systemd
/system
/other_file |
grep -q -F "MARKER=1"
455 --property ExtensionDirectories
="$IMAGE_DIR/app-nodistro" \
456 --property RootImage
="$MINIMAL_IMAGE.raw" \
457 cat /usr
/lib
/systemd
/system
/some_file |
grep -q -F "MARKER=1"
459 --property ExtensionDirectories
="$IMAGE_DIR/service-scoped-test" \
460 --property RootImage
="$MINIMAL_IMAGE.raw" \
461 cat /etc
/systemd
/system
/some_file |
grep -q -F "MARKER_CONFEXT_123"
462 cat >/run
/systemd
/system
/testservice-50f.service
<<EOF
465 TemporaryFileSystem=/run /var/lib
467 RootImage=$MINIMAL_IMAGE.raw
468 ExtensionDirectories=$IMAGE_DIR/app0 $IMAGE_DIR/app1
469 # Relevant only for sanitizer runs
470 UnsetEnvironment=LD_PRELOAD
471 ExecStart=bash -c '/opt/script0.sh | grep ID'
472 ExecStart=bash -c '/opt/script1.sh | grep ID'
476 systemctl start testservice-50f.service
477 systemctl is-active testservice-50f.service
479 # Check vpick support in ExtensionDirectories=
484 ln -s "$IMAGE_DIR/app0" "$VDIR/${VBASE}_0"
485 ln -s "$IMAGE_DIR/app1" "$VDIR/${VBASE}_1"
487 systemd-run
-P --property ExtensionDirectories
="$VDIR" cat /opt
/script1.sh |
grep -q -F "extension-release.app2"
491 systemd-dissect
--umount "$IMAGE_DIR/app0"
492 systemd-dissect
--umount "$IMAGE_DIR/app1"
494 # Test that an extension consisting of an empty directory under /etc/extensions/ takes precedence
495 mkdir
-p /var
/lib
/extensions
/
496 ln -s /usr
/share
/app-nodistro.raw
/var
/lib
/extensions
/app-nodistro.raw
498 grep -q -F "MARKER=1" /usr
/lib
/systemd
/system
/some_file
499 systemd-sysext unmerge
500 mkdir
-p /etc
/extensions
/app-nodistro
502 test ! -e /usr
/lib
/systemd
/system
/some_file
503 systemd-sysext unmerge
504 rmdir /etc
/extensions
/app-nodistro
506 # Similar, but go via varlink
507 varlinkctl call
/run
/systemd
/io.systemd.sysext io.systemd.sysext.List
'{}'
508 (! grep -q -F "MARKER=1" /usr
/lib
/systemd
/system
/some_file
)
509 varlinkctl call
/run
/systemd
/io.systemd.sysext io.systemd.sysext.Merge
'{}'
510 grep -q -F "MARKER=1" /usr
/lib
/systemd
/system
/some_file
511 varlinkctl call
/run
/systemd
/io.systemd.sysext io.systemd.sysext.Refresh
'{}'
512 grep -q -F "MARKER=1" /usr
/lib
/systemd
/system
/some_file
513 varlinkctl call
/run
/systemd
/io.systemd.sysext io.systemd.sysext.Unmerge
'{}'
514 (! grep -q -F "MARKER=1" /usr
/lib
/systemd
/system
/some_file
)
516 # Check that extensions cannot contain os-release
517 mkdir
-p /run
/extensions
/app-reject
/usr
/lib
/{extension-release.d
/,systemd
/system
}
518 echo "ID=_any" >/run
/extensions
/app-reject
/usr
/lib
/extension-release.d
/extension-release.app-reject
519 echo "ID=_any" >/run
/extensions
/app-reject
/usr
/lib
/os-release
520 touch /run
/extensions
/app-reject
/usr
/lib
/systemd
/system
/other_file
521 (! systemd-sysext merge
)
522 test ! -e /usr
/lib
/systemd
/system
/some_file
523 test ! -e /usr
/lib
/systemd
/system
/other_file
524 systemd-sysext unmerge
525 rm -rf /run
/extensions
/app-reject
526 rm /var
/lib
/extensions
/app-nodistro.raw
528 # Some super basic test that RootImage= works with .v/ dirs
533 ln -s "$MINIMAL_IMAGE.raw" "$VDIR/${VBASE}_33.raw"
534 ln -s "$MINIMAL_IMAGE.raw" "$VDIR/${VBASE}_34.raw"
535 ln -s "$MINIMAL_IMAGE.raw" "$VDIR/${VBASE}_35.raw"
537 systemd-run
-P -p RootImage
="$VDIR" cat /usr
/lib
/os-release |
grep -q -F "MARKER=1"
539 rm "$VDIR/${VBASE}_33.raw" "$VDIR/${VBASE}_34.raw" "$VDIR/${VBASE}_35.raw"
542 mkdir
-p /run
/machines
/run
/portables
/run
/extensions
543 touch /run
/machines
/a.raw
/run
/portables
/b.raw
/run
/extensions
/c.raw
545 systemd-dissect
--discover --json=short
>/tmp
/discover.json
546 grep -q -F '{"name":"a","type":"raw","class":"machine","ro":false,"path":"/run/machines/a.raw"' /tmp
/discover.json
547 grep -q -F '{"name":"b","type":"raw","class":"portable","ro":false,"path":"/run/portables/b.raw"' /tmp
/discover.json
548 grep -q -F '{"name":"c","type":"raw","class":"sysext","ro":false,"path":"/run/extensions/c.raw"' /tmp
/discover.json
549 rm /tmp
/discover.json
/run
/machines
/a.raw
/run
/portables
/b.raw
/run
/extensions
/c.raw
551 LOOP
="$(systemd-dissect --attach --loop-ref=waldo "$MINIMAL_IMAGE.raw
")"
553 # Wait until the symlinks we want to test are established
554 udevadm trigger
-w "$LOOP"
556 # Check if the /dev/loop/* symlinks really reference the right device
557 test /dev
/disk
/by-loop-ref
/waldo
-ef "$LOOP"
559 if [ "$(stat -c '%Hd:%Ld' "$MINIMAL_IMAGE.raw
")" != '?d:?d' ] ; then
560 # Old stat didn't know the %Hd and %Ld specifiers and turned them into ?d
561 # instead. Let's simply skip the test on such old systems.
562 test "$(stat -c '/dev/disk/by-loop-inode/%Hd:%Ld-%i' "$MINIMAL_IMAGE.raw
")" -ef "$LOOP"
565 # Detach by loopback device
566 systemd-dissect
--detach "$LOOP"
568 # Test long reference name.
569 # Note, sizeof_field(struct loop_info64, lo_file_name) == 64,
570 # and --loop-ref accepts upto 63 characters, and udev creates symlink
571 # based on the name when it has upto _62_ characters.
572 name
="$(for _ in {1..62}; do echo -n 'x'; done)"
573 LOOP
="$(systemd-dissect --attach --loop-ref="$name" "$MINIMAL_IMAGE.raw
")"
574 udevadm trigger
-w "$LOOP"
576 # Check if the /dev/disk/by-loop-ref/$name symlink really references the right device
577 test "/dev/disk/by-loop-ref/$name" -ef "$LOOP"
579 # Detach by the /dev/disk/by-loop-ref symlink
580 systemd-dissect
--detach "/dev/disk/by-loop-ref/$name"
582 name
="$(for _ in {1..63}; do echo -n 'x'; done)"
583 LOOP
="$(systemd-dissect --attach --loop-ref="$name" "$MINIMAL_IMAGE.raw
")"
584 udevadm trigger
-w "$LOOP"
586 # Check if the /dev/disk/by-loop-ref/$name symlink does not exist
587 test ! -e "/dev/disk/by-loop-ref/$name"
589 # Detach by backing inode
590 systemd-dissect
--detach "$MINIMAL_IMAGE.raw"
591 (! systemd-dissect
--detach "$MINIMAL_IMAGE.raw")
593 # check for confext functionality
594 mkdir
-p /run
/confexts
/test
/etc
/extension-release.d
595 echo "ID=_any" >/run
/confexts
/test
/etc
/extension-release.d
/extension-release.
test
596 echo "ARCHITECTURE=_any" >>/run
/confexts
/test
/etc
/extension-release.d
/extension-release.
test
597 echo "MARKER_CONFEXT_123" >/run
/confexts
/test
/etc
/testfile
598 cat <<EOF >/run/confexts/test/etc/testscript
600 echo "This should not happen"
602 chmod +x
/run
/confexts
/test
/etc
/testscript
603 systemd-confext merge
604 grep -q -F "MARKER_CONFEXT_123" /etc
/testfile
606 systemd-confext status
607 systemd-confext unmerge
608 rm -rf /run
/confexts
/
610 unsquashfs
-no-xattrs -d /tmp
/img
"$MINIMAL_IMAGE.raw"
611 systemd-run
--unit=test-root-ephemeral \
612 -p RootDirectory
=/tmp
/img \
613 -p RootEphemeral
=yes \
615 bash
-c "touch /abc && sleep infinity"
616 test -n "$(ls -A /var/lib/systemd/ephemeral-trees)"
617 systemctl stop test-root-ephemeral
618 # shellcheck disable=SC2016
619 timeout
10 bash
-c 'until test -z "$(ls -A /var/lib/systemd/ephemeral-trees)"; do sleep .5; done'
620 test ! -f /tmp
/img
/abc
622 systemd-dissect
--mtree /tmp
/img
623 systemd-dissect
--list /tmp
/img
625 read -r SHA256SUM1 _
< <(systemd-dissect
--copy-from /tmp
/img etc
/os-release | sha256sum
)
626 test "$SHA256SUM1" != ""
629 systemd-dissect
--copy-to /tmp
/img abc
/abc
632 # Test for dissect tool support with systemd-sysext
633 mkdir
-p /run
/extensions
/ testkit
/usr
/lib
/extension-release.d
/
634 echo "ID=_any" >testkit
/usr
/lib
/extension-release.d
/extension-release.testkit
635 echo "ARCHITECTURE=_any" >>testkit
/usr
/lib
/extension-release.d
/extension-release.testkit
636 echo "MARKER_SYSEXT_123" >testkit
/usr
/lib
/testfile
637 mksquashfs testkit
/ testkit.raw
638 cp testkit.raw
/run
/extensions
/
639 unsquashfs
-l /run
/extensions
/testkit.raw
640 systemd-dissect
--no-pager /run
/extensions
/testkit.raw |
grep -q '✓ sysext for portable service'
641 systemd-dissect
--no-pager /run
/extensions
/testkit.raw |
grep -q '✓ sysext for system'
643 systemd-sysext status
644 grep -q -F "MARKER_SYSEXT_123" /usr
/lib
/testfile
645 systemd-sysext unmerge
646 rm -rf /run
/extensions
/ testkit
/
648 # Test for dissect tool support with systemd-confext
649 mkdir
-p /run
/confexts
/ testjob
/etc
/extension-release.d
/
650 echo "ID=_any" >testjob
/etc
/extension-release.d
/extension-release.testjob
651 echo "ARCHITECTURE=_any" >>testjob
/etc
/extension-release.d
/extension-release.testjob
652 echo "MARKER_CONFEXT_123" >testjob
/etc
/testfile
653 mksquashfs testjob
/ testjob.raw
654 cp testjob.raw
/run
/confexts
/
655 unsquashfs
-l /run
/confexts
/testjob.raw
656 systemd-dissect
--no-pager /run
/confexts
/testjob.raw |
grep -q '✓ confext for system'
657 systemd-dissect
--no-pager /run
/confexts
/testjob.raw |
grep -q '✓ confext for portable service'
658 systemd-confext merge
659 systemd-confext status
660 grep -q -F "MARKER_CONFEXT_123" /etc
/testfile
661 systemd-confext unmerge
662 rm -rf /run
/confexts
/ testjob
/
664 systemd-run
-P -p RootImage
="$MINIMAL_IMAGE.raw" cat /run
/host
/os-release |
cmp "$OS_RELEASE"
666 # Test that systemd-sysext reloads the daemon.
667 mkdir
-p /var
/lib
/extensions
/
668 ln -s /usr
/share
/app-reload.raw
/var
/lib
/extensions
/app-reload.raw
669 systemd-sysext merge
--no-reload
670 # the service should not be running
671 (! systemctl
--quiet is-active foo.service
)
672 systemd-sysext unmerge
--no-reload
674 # shellcheck disable=SC2016
675 timeout
30s bash
-xec 'until [[ $(journalctl -b -u foo.service _TRANSPORT=stdout -o cat) == foo ]]; do sleep .5; done'
676 systemd-sysext unmerge
--no-reload
677 # Grep on the Warning to find the warning helper mentioning the daemon reload.
678 systemctl status foo.service
2>&1 |
grep -q -F "Warning"
680 systemd-sysext unmerge
681 systemctl status foo.service
2>&1 |
grep -v -q -F "Warning"
682 rm /var
/lib
/extensions
/app-reload.raw
684 # Sneak in a couple of expected-to-fail invocations to cover
685 # https://github.com/systemd/systemd/issues/29610
686 (! systemd-run
-P -p MountImages
="/this/should/definitely/not/exist.img:/run/img2\:3:nosuid" false
)
687 (! systemd-run
-P -p ExtensionImages
="/this/should/definitely/not/exist.img" false
)
688 (! systemd-run
-P -p RootImage
="/this/should/definitely/not/exist.img" false
)
689 (! systemd-run
-P -p ExtensionDirectories
="/foo/bar /foo/baz" false
)