shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-01-24 02:03:54 +03:00
Code

Merge pull request #1717 from ronnychevalier/rc/test_capabilityboundingset2

Browse Source 
test: add tests to ensure that the capabilities are properly set
This commit is contained in:
Daniel Mack 2015-10-29 19:46:01 +01:00
commit 0fcf9b2390
5 changed files with 53 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
src/test/test-execute.c
View File

@ -17,15 +17,16 @@
along with systemd; If not, see <http://www.gnu.org/licenses/>.
***/
#include <stdio.h>
#include <sys/types.h>
#include <grp.h>
#include <pwd.h>
#include <stdio.h>
#include <sys/types.h>
#include "fs-util.h"
#include "macro.h"
#include "manager.h"
#include "mkdir.h"
#include "path-util.h"
#include "rm-rf.h"
#include "unit.h"
#include "util.h"
@ -129,11 +130,15 @@ static void test_exec_systemcallerrornumber(Manager *m) {
static void test_exec_user(Manager *m) {
if (getpwnam("nobody"))
test(m, "exec-user.service", 0, CLD_EXITED);
else
log_error_errno(errno, "Skipping test_exec_user, could not find nobody user: %m");
}
static void test_exec_group(Manager *m) {
if (getgrnam("nobody"))
test(m, "exec-group.service", 0, CLD_EXITED);
else
log_error_errno(errno, "Skipping test_exec_group, could not find nobody group: %m");
}
static void test_exec_environment(Manager *m) {
@ -152,6 +157,25 @@ static void test_exec_runtimedirectory(Manager *m) {
test(m, "exec-runtimedirectory-mode.service", 0, CLD_EXITED);
if (getgrnam("nobody"))
test(m, "exec-runtimedirectory-owner.service", 0, CLD_EXITED);
else
log_error_errno(errno, "Skipping test_exec_runtimedirectory-owner, could not find nobody group: %m");
}
static void test_exec_capabilityboundingset(Manager *m) {
int r;
/* We use capsh to test if the capabilities are
* properly set, so be sure that it exists */
r = find_binary("capsh", NULL);
if (r < 0) {
log_error_errno(r, "Skipping test_exec_capabilityboundingset, could not find capsh binary: %m");
return;
}
test(m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED);
test(m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED);
test(m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED);
test(m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED);
}
int main(int argc, char *argv[]) {
@ -168,6 +192,7 @@ int main(int argc, char *argv[]) {
test_exec_environment,
test_exec_umask,
test_exec_runtimedirectory,
test_exec_capabilityboundingset,
NULL,
};
test_function_t *test = NULL;

6
test/exec-capabilityboundingset-invert.service Normal file
View File

@ -0,0 +1,6 @@
[Unit]
Description=Test for CapabilityBoundingSet
[Service]
ExecStart=/bin/sh -c 'c=$(capsh --print | grep "Bounding set " | grep "cap_chown"); echo $c; exit $(test -z $c)'
CapabilityBoundingSet=~CAP_CHOWN

7
test/exec-capabilityboundingset-merge.service Normal file
View File

@ -0,0 +1,7 @@
[Unit]
Description=Test for CapabilityBoundingSet
[Service]
ExecStart=/bin/sh -c 'c=$(capsh --print | grep "Bounding set " | cut -f 2 -d "="); echo $c; exit $(test $c = "cap_chown,cap_fowner,cap_kill")'
CapabilityBoundingSet=CAP_FOWNER
CapabilityBoundingSet=CAP_KILL CAP_CHOWN

7
test/exec-capabilityboundingset-reset.service Normal file
View File

@ -0,0 +1,7 @@
[Unit]
Description=Test for CapabilityBoundingSet
[Service]
ExecStart=/bin/sh -c 'c=$(capsh --print | grep "Bounding set " | cut -f 2 -d "="); echo $c; exit $(test -z $c)'
CapabilityBoundingSet=CAP_FOWNER CAP_KILL
CapabilityBoundingSet=

6
test/exec-capabilityboundingset-simple.service Normal file
View File

@ -0,0 +1,6 @@
[Unit]
Description=Test for CapabilityBoundingSet
[Service]
ExecStart=/bin/sh -c 'c=$(capsh --print | grep "Bounding set " | cut -f 2 -d "="); echo $c; exit $(test $c = "cap_fowner,cap_kill")'
CapabilityBoundingSet=CAP_FOWNER CAP_KILL