From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Thu, 16 Oct 2025 14:07:54 +0000 (+0100)
Subject: test: add coverage for image policy and bare filesystems with verity
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bc019f7c06a312ff131183476d62a06b8294e93c;p=thirdparty%2Fsystemd.git

test: add coverage for image policy and bare filesystems with verity
---

diff --git a/test/units/TEST-50-DISSECT.mountfsd.sh b/test/units/TEST-50-DISSECT.mountfsd.sh
index f4409f55bc3..cca502dfcb3 100755
--- a/test/units/TEST-50-DISSECT.mountfsd.sh
+++ b/test/units/TEST-50-DISSECT.mountfsd.sh
@@ -77,6 +77,20 @@ if [ "$VERITY_SIG_SUPPORTED" -eq 1 ]; then
         --property RootImage="$MINIMAL_IMAGE.raw" \
         --property ExtensionImages=/tmp/app0.raw \
         sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\""
+
+    # Without a signature this should not work, as mountfsd should reject it, even if we explicitly ask to
+    # trust it
+    mv /tmp/app0.roothash.p7s /tmp/app0.roothash.p7s.bak
+    (! systemd-run -M testuser@ --user --pipe --wait \
+        --property RootImage="$MINIMAL_IMAGE.raw" \
+        --property ExtensionImages=/tmp/app0.raw \
+        sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\"")
+    (! systemd-run -M testuser@ --user --pipe --wait \
+        --property RootImage="$MINIMAL_IMAGE.raw" \
+        --property ExtensionImages=/tmp/app0.raw \
+        --property ExtensionImagePolicy=root=verity+signed+absent:usr=verity+signed+absent \
+        sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\"")
+    mv /tmp/app0.roothash.p7s.bak /tmp/app0.roothash.p7s
 fi
 
 # Install key in keychain