From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Sun, 4 Mar 2018 15:00:35 +0000 (+0900)
Subject: test-execute: check capabilities before running tests
X-Git-Tag: v238~2^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b7856f9218e23fde0932072786b640fdef37582f;p=thirdparty%2Fsystemd.git

test-execute: check capabilities before running tests

Fixes #8193.
---

diff --git a/src/test/test-execute.c b/src/test/test-execute.c
index ce88e2ea070..788249e885d 100644
--- a/src/test/test-execute.c
+++ b/src/test/test-execute.c
@@ -24,6 +24,7 @@
 #include <sys/prctl.h>
 #include <sys/types.h>
 
+#include "capability-util.h"
 #include "cpu-set-util.h"
 #include "errno-list.h"
 #include "fileio.h"
@@ -532,6 +533,13 @@ static void test_exec_capabilityboundingset(Manager *m) {
                 return;
         }
 
+        if (have_effective_cap(CAP_CHOWN) <= 0 ||
+            have_effective_cap(CAP_FOWNER) <= 0 ||
+            have_effective_cap(CAP_KILL) <= 0) {
+                log_notice("Skipping %s, this process does not have enough capabilities", __func__);
+                return;
+        }
+
         test(m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED);
         test(m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED);
         test(m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED);
@@ -551,6 +559,12 @@ static void test_exec_ambientcapabilities(Manager *m) {
                 return;
         }
 
+        if (have_effective_cap(CAP_NET_ADMIN) <= 0 ||
+            have_effective_cap(CAP_NET_RAW) <= 0) {
+                log_notice("Skipping %s, this process does not have enough capabilities", __func__);
+                return;
+        }
+
         test(m, "exec-ambientcapabilities.service", 0, CLD_EXITED);
         test(m, "exec-ambientcapabilities-merge.service", 0, CLD_EXITED);