systemd-stable/test/test-execute/exec-noexecpaths-simple.service

# SPDX-License-Identifier: LGPL-2.1-or-later
[Unit]
Description=Test for NoExecPaths=

[Service]
Type=oneshot
# This should work, as we explicitly disable the effect of NoExecPaths=
ExecStart=+/bin/sh -c '/bin/cat /dev/null'
# This should also work, as we do not disable the effect of NoExecPaths= but invert the exit code
ExecStart=/bin/sh -x -c '! /bin/cat /dev/null'
NoExecPaths=/bin/cat
tests: add spdx license header to test unit/link/network/conf files Those are all consumed by our parser, so they all support comments. I was considering whether they should have a license header at all, but in the end I decided to add it because those files are often created by copying parts of real unit files. And if the real ones have a license, then those might as well. It's easier to add it than to make an exception. 2021-10-17 18:07:22 +02:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
New directives NoExecPaths= ExecPaths= Implement directives `NoExecPaths=` and `ExecPaths=` to control `MS_NOEXEC` mount flag for the file system tree. This can be used to implement file system W^X policies, and for example with allow-listing mode (NoExecPaths=/) a compromised service would not be able to execute a shell, if that was not explicitly allowed. Example: [Service] NoExecPaths=/ ExecPaths=/usr/bin/daemon /usr/lib64 /usr/lib Closes: #17942. 2021-01-16 13:49:32 +02:00			`[Unit]`
			`Description=Test for NoExecPaths=`

			`[Service]`
			`Type=oneshot`
			`# This should work, as we explicitly disable the effect of NoExecPaths=`
			`ExecStart=+/bin/sh -c '/bin/cat /dev/null'`
			`# This should also work, as we do not disable the effect of NoExecPaths= but invert the exit code`
			`ExecStart=/bin/sh -x -c '! /bin/cat /dev/null'`
			`NoExecPaths=/bin/cat`