systemd-stable/test/test-execute/exec-readonlypaths-simple.service

# SPDX-License-Identifier: LGPL-2.1-or-later
[Unit]
Description=Test for ReadOnlyPaths=

[Service]
Type=oneshot
# This should work, as we explicitly disable the effect of ReadOnlyPaths=
ExecStart=+/bin/sh -c 'touch /tmp/thisisasimpletest'
# This should also work, as we do not disable the effect of ReadOnlyPaths= but invert the exit code
ExecStart=/bin/sh -x -c '! touch /tmp/thisisasimpletest'
ExecStart=+/bin/sh -c 'rm /tmp/thisisasimpletest'
ReadOnlyPaths=/tmp
tests: add spdx license header to test unit/link/network/conf files Those are all consumed by our parser, so they all support comments. I was considering whether they should have a license header at all, but in the end I decided to add it because those files are often created by copying parts of real unit files. And if the real ones have a license, then those might as well. It's easier to add it than to make an exception. 2021-10-17 19:07:22 +03:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
test-execute: cleanup This makes rename the test units by a consistent naming scheme, add several logs, and sort internal functions. No functional change. 2017-12-05 18:36:55 +03:00			`[Unit]`
			`Description=Test for ReadOnlyPaths=`

core: skip ReadOnlyPaths= and other permission-related mounts on PermissionsStartOnly= (#5309) ReadOnlyPaths=, ProtectHome=, InaccessiblePaths= and ProtectSystem= are about restricting access and little more, hence they should be disabled if PermissionsStartOnly= is used or ExecStart= lines are prefixed with a "+". Do that. (Note that we will still create namespaces and stuff, since that's about a lot more than just permissions. We'll simply disable the effect of the four options mentioned above, but nothing else mount related.) This also adds a test for this, to ensure this works as intended. No documentation updates, as the documentation are already vague enough to support the new behaviour ("If true, the permission-related execution options…"). We could clarify this further, but I think we might want to extend the switches' behaviour a bit more in future, hence leave it at this for now. Fixes: #5308 2017-02-12 08:44:46 +03:00			`[Service]`
			`Type=oneshot`
			`# This should work, as we explicitly disable the effect of ReadOnlyPaths=`
test-execute: always use /bin/sh 2017-10-12 07:26:39 +03:00			`ExecStart=+/bin/sh -c 'touch /tmp/thisisasimpletest'`
core: skip ReadOnlyPaths= and other permission-related mounts on PermissionsStartOnly= (#5309) ReadOnlyPaths=, ProtectHome=, InaccessiblePaths= and ProtectSystem= are about restricting access and little more, hence they should be disabled if PermissionsStartOnly= is used or ExecStart= lines are prefixed with a "+". Do that. (Note that we will still create namespaces and stuff, since that's about a lot more than just permissions. We'll simply disable the effect of the four options mentioned above, but nothing else mount related.) This also adds a test for this, to ensure this works as intended. No documentation updates, as the documentation are already vague enough to support the new behaviour ("If true, the permission-related execution options…"). We could clarify this further, but I think we might want to extend the switches' behaviour a bit more in future, hence leave it at this for now. Fixes: #5308 2017-02-12 08:44:46 +03:00			`# This should also work, as we do not disable the effect of ReadOnlyPaths= but invert the exit code`
test-execute: always use /bin/sh 2017-10-12 07:26:39 +03:00			`ExecStart=/bin/sh -x -c '! touch /tmp/thisisasimpletest'`
			`ExecStart=+/bin/sh -c 'rm /tmp/thisisasimpletest'`
core: skip ReadOnlyPaths= and other permission-related mounts on PermissionsStartOnly= (#5309) ReadOnlyPaths=, ProtectHome=, InaccessiblePaths= and ProtectSystem= are about restricting access and little more, hence they should be disabled if PermissionsStartOnly= is used or ExecStart= lines are prefixed with a "+". Do that. (Note that we will still create namespaces and stuff, since that's about a lot more than just permissions. We'll simply disable the effect of the four options mentioned above, but nothing else mount related.) This also adds a test for this, to ensure this works as intended. No documentation updates, as the documentation are already vague enough to support the new behaviour ("If true, the permission-related execution options…"). We could clarify this further, but I think we might want to extend the switches' behaviour a bit more in future, hence leave it at this for now. Fixes: #5308 2017-02-12 08:44:46 +03:00			`ReadOnlyPaths=/tmp`