mirror of
https://github.com/systemd/systemd-stable.git
synced 2025-01-21 18:03:41 +03:00
test: drop uses of "&& { echo 'unexpected success'; exit 1; }"
Brief is sweet. (cherry picked from commit 128db0aa0098b58b415065c2955f9abc7fc967e1) (cherry picked from commit f3abd451dde25086e06c56ba0b8388f64c1d306e) (cherry picked from commit 3626aabecb8a8682caa466de711e8f6509f954ec)
This commit is contained in:
parent
f12531d653
commit
3776e1f2ee
@ -30,11 +30,11 @@ grep 'hello\.service' /root/list-jobs.txt && exit 1
|
||||
systemctl stop sleep.service hello-after-sleep.target
|
||||
|
||||
# Some basic testing that --show-transaction does something useful
|
||||
systemctl is-active systemd-importd && { echo 'unexpected success'; exit 1; }
|
||||
(! systemctl is-active systemd-importd)
|
||||
systemctl -T start systemd-importd
|
||||
systemctl is-active systemd-importd
|
||||
systemctl --show-transaction stop systemd-importd
|
||||
systemctl is-active systemd-importd && { echo 'unexpected success'; exit 1; }
|
||||
(! systemctl is-active systemd-importd)
|
||||
|
||||
# Test for a crash when enqueuing a JOB_NOP when other job already exists
|
||||
systemctl start --no-block hello-after-sleep.target
|
||||
@ -82,7 +82,7 @@ ELAPSED=$((END_SEC-START_SEC))
|
||||
|
||||
# wait5fail fails, so systemctl should fail
|
||||
START_SEC=$(date -u '+%s')
|
||||
systemctl start --wait wait2.service wait5fail.service && { echo 'unexpected success'; exit 1; }
|
||||
(! systemctl start --wait wait2.service wait5fail.service)
|
||||
END_SEC=$(date -u '+%s')
|
||||
ELAPSED=$((END_SEC-START_SEC))
|
||||
[[ "$ELAPSED" -ge 5 ]] && [[ "$ELAPSED" -le 7 ]] || exit 1
|
||||
|
@ -74,10 +74,10 @@ journalctl -b -o export --output-fields=MESSAGE,FOO --output-fields=PRIORITY,MES
|
||||
grep -q '^__CURSOR=' /output
|
||||
grep -q '^MESSAGE=foo$' /output
|
||||
grep -q '^PRIORITY=6$' /output
|
||||
grep '^FOO=' /output && { echo 'unexpected success'; exit 1; }
|
||||
grep '^SYSLOG_FACILITY=' /output && { echo 'unexpected success'; exit 1; }
|
||||
(! grep '^FOO=' /output)
|
||||
(! grep '^SYSLOG_FACILITY=' /output)
|
||||
|
||||
# `-b all` negates earlier use of -b (-b and -m are otherwise exclusive)
|
||||
# '-b all' negates earlier use of -b (-b and -m are otherwise exclusive)
|
||||
journalctl -b -1 -b all -m >/dev/null
|
||||
|
||||
# -b always behaves like -b0
|
||||
|
@ -4,7 +4,7 @@ set -eux
|
||||
set -o pipefail
|
||||
|
||||
systemd-run --wait -p FailureAction=poweroff true
|
||||
systemd-run --wait -p SuccessAction=poweroff false && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run --wait -p SuccessAction=poweroff false)
|
||||
|
||||
if ! test -f /firstphase ; then
|
||||
echo OK >/firstphase
|
||||
|
@ -129,7 +129,7 @@ chmod 755 /dev/shm/test20-mainpid3.sh
|
||||
|
||||
# This has to fail, as we shouldn't accept the dangerous PID file, and then
|
||||
# inotify-wait on it to be corrected which we never do.
|
||||
systemd-run --unit=test20-mainpidsh3.service \
|
||||
(! systemd-run --unit=test20-mainpidsh3.service \
|
||||
-p StandardOutput=tty \
|
||||
-p StandardError=tty \
|
||||
-p Type=forking \
|
||||
@ -137,8 +137,7 @@ systemd-run --unit=test20-mainpidsh3.service \
|
||||
-p PIDFile=/run/mainpidsh3/pid \
|
||||
-p DynamicUser=1 \
|
||||
-p TimeoutStartSec=2s \
|
||||
/dev/shm/test20-mainpid3.sh \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
/dev/shm/test20-mainpid3.sh)
|
||||
|
||||
# Test that this failed due to timeout, and not some other error
|
||||
test "$(systemctl show -P Result test20-mainpidsh3.service)" = timeout
|
||||
|
@ -38,7 +38,7 @@ test "$(stat -c %U:%G:%a /tmp/f/1)" = "daemon:daemon:666"
|
||||
mkfifo /tmp/f/fifo
|
||||
chmod 644 /tmp/f/fifo
|
||||
|
||||
systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-tmpfiles --create -) <<EOF
|
||||
f /tmp/f/fifo 0666 daemon daemon - This string should not be written
|
||||
EOF
|
||||
|
||||
@ -49,7 +49,7 @@ test "$(stat -c %U:%G:%a /tmp/f/fifo)" = "root:root:644"
|
||||
ln -s missing /tmp/f/dangling
|
||||
ln -s /tmp/file-owned-by-root /tmp/f/symlink
|
||||
|
||||
systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-tmpfiles --create -) <<EOF
|
||||
f /tmp/f/dangling 0644 daemon daemon - -
|
||||
f /tmp/f/symlink 0644 daemon daemon - -
|
||||
EOF
|
||||
@ -71,12 +71,12 @@ f /tmp/f/ro-fs/foo 0644 - - - - This string should not be written
|
||||
EOF
|
||||
test -f /tmp/f/ro-fs/foo; test ! -s /tmp/f/ro-fs/foo
|
||||
|
||||
systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-tmpfiles --create -) <<EOF
|
||||
f /tmp/f/ro-fs/foo 0666 - - - -
|
||||
EOF
|
||||
test "$(stat -c %U:%G:%a /tmp/f/fifo)" = "root:root:644"
|
||||
|
||||
systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-tmpfiles --create -) <<EOF
|
||||
f /tmp/f/ro-fs/bar 0644 - - - -
|
||||
EOF
|
||||
test ! -e /tmp/f/ro-fs/bar
|
||||
@ -86,7 +86,7 @@ mkdir /tmp/f/daemon
|
||||
ln -s /root /tmp/f/daemon/unsafe-symlink
|
||||
chown -R --no-dereference daemon:daemon /tmp/f/daemon
|
||||
|
||||
systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-tmpfiles --create -) <<EOF
|
||||
f /tmp/f/daemon/unsafe-symlink/exploit 0644 daemon daemon - -
|
||||
EOF
|
||||
test ! -e /tmp/f/daemon/unsafe-symlink/exploit
|
||||
@ -116,7 +116,7 @@ test "$(stat -c %U:%G:%a /tmp/F/truncated-with-content)" = "daemon:daemon:666"
|
||||
### unspecified in the other cases.
|
||||
mkfifo /tmp/F/fifo
|
||||
|
||||
systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-tmpfiles --create -) <<EOF
|
||||
F /tmp/F/fifo 0644 - - - -
|
||||
EOF
|
||||
|
||||
@ -126,7 +126,7 @@ test -p /tmp/F/fifo
|
||||
ln -s missing /tmp/F/dangling
|
||||
ln -s /tmp/file-owned-by-root /tmp/F/symlink
|
||||
|
||||
systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-tmpfiles --create -) <<EOF
|
||||
f /tmp/F/dangling 0644 daemon daemon - -
|
||||
f /tmp/F/symlink 0644 daemon daemon - -
|
||||
EOF
|
||||
@ -149,11 +149,11 @@ EOF
|
||||
test -f /tmp/F/ro-fs/foo; test ! -s /tmp/F/ro-fs/foo
|
||||
|
||||
echo "truncating is not allowed anymore" >/tmp/F/rw-fs/foo
|
||||
systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-tmpfiles --create -) <<EOF
|
||||
F /tmp/F/ro-fs/foo 0644 - - - -
|
||||
EOF
|
||||
|
||||
systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-tmpfiles --create -) <<EOF
|
||||
F /tmp/F/ro-fs/foo 0644 - - - - This string should not be written
|
||||
EOF
|
||||
test -f /tmp/F/ro-fs/foo
|
||||
@ -161,13 +161,13 @@ grep -q 'truncating is not allowed' /tmp/F/ro-fs/foo
|
||||
|
||||
# Trying to change the perms should fail.
|
||||
: >/tmp/F/rw-fs/foo
|
||||
systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-tmpfiles --create -) <<EOF
|
||||
F /tmp/F/ro-fs/foo 0666 - - - -
|
||||
EOF
|
||||
test "$(stat -c %U:%G:%a /tmp/F/ro-fs/foo)" = "root:root:644"
|
||||
|
||||
### Try to create a new file.
|
||||
systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-tmpfiles --create -) <<EOF
|
||||
F /tmp/F/ro-fs/bar 0644 - - - -
|
||||
EOF
|
||||
test ! -e /tmp/F/ro-fs/bar
|
||||
@ -177,7 +177,7 @@ mkdir /tmp/F/daemon
|
||||
ln -s /root /tmp/F/daemon/unsafe-symlink
|
||||
chown -R --no-dereference daemon:daemon /tmp/F/daemon
|
||||
|
||||
systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-tmpfiles --create -) <<EOF
|
||||
F /tmp/F/daemon/unsafe-symlink/exploit 0644 daemon daemon - -
|
||||
EOF
|
||||
test ! -e /tmp/F/daemon/unsafe-symlink/exploit
|
||||
@ -195,7 +195,7 @@ EOF
|
||||
test ! -e /tmp/w/unexistent
|
||||
|
||||
### no argument given -> fails.
|
||||
systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-tmpfiles --create -) <<EOF
|
||||
w /tmp/w/unexistent 0644 - - - -
|
||||
EOF
|
||||
|
||||
@ -240,7 +240,7 @@ mkdir /tmp/w/daemon
|
||||
ln -s /root /tmp/w/daemon/unsafe-symlink
|
||||
chown -R --no-dereference daemon:daemon /tmp/w/daemon
|
||||
|
||||
systemd-tmpfiles --create - <<EOF && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-tmpfiles --create -) <<EOF
|
||||
f /tmp/w/daemon/unsafe-symlink/exploit 0644 daemon daemon - -
|
||||
EOF
|
||||
test ! -e /tmp/w/daemon/unsafe-symlink/exploit
|
||||
|
@ -22,11 +22,9 @@ test -d /tmp/root/test2
|
||||
# Verify the command fails to write to a root-owned subdirectory under an
|
||||
# unprivileged user's directory when it's not part of the prefix, as expected
|
||||
# by the unsafe_transition function.
|
||||
echo 'd /tmp/user/root/test' | systemd-tmpfiles --create - \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
echo 'd /tmp/user/root/test' | (! systemd-tmpfiles --create -)
|
||||
test ! -e /tmp/user/root/test
|
||||
echo 'd /user/root/test' | systemd-tmpfiles --root=/tmp --create - \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
echo 'd /user/root/test' | (! systemd-tmpfiles --root=/tmp --create -)
|
||||
test ! -e /tmp/user/root/test
|
||||
|
||||
# Verify the above works when all user-owned directories are in the prefix.
|
||||
|
@ -17,8 +17,8 @@ systemd-run --unit=three -p Type=simple /tmp/brokenbinary
|
||||
|
||||
# And now, do the same with Type=exec, where the latter two should fail
|
||||
systemd-run --unit=four -p Type=exec /bin/sleep infinity
|
||||
systemd-run --unit=five -p Type=exec -p User=idontexist /bin/sleep infinity && { echo 'unexpected success'; exit 1; }
|
||||
systemd-run --unit=six -p Type=exec /tmp/brokenbinary && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run --unit=five -p Type=exec -p User=idontexist /bin/sleep infinity)
|
||||
(! systemd-run --unit=six -p Type=exec /tmp/brokenbinary)
|
||||
|
||||
systemd-run --unit=seven -p KillSignal=SIGTERM -p RestartKillSignal=SIGINT -p Type=exec /bin/sleep infinity
|
||||
# Both TERM and SIGINT happen to have the same number on all architectures
|
||||
@ -32,32 +32,32 @@ systemctl stop seven.service
|
||||
|
||||
# Should work normally
|
||||
busctl call \
|
||||
org.freedesktop.systemd1 /org/freedesktop/systemd1 \
|
||||
org.freedesktop.systemd1.Manager StartTransientUnit \
|
||||
"ssa(sv)a(sa(sv))" test-20933-ok.service replace 1 \
|
||||
ExecStart "a(sasb)" 1 \
|
||||
/usr/bin/sleep 2 /usr/bin/sleep 1 true \
|
||||
0
|
||||
org.freedesktop.systemd1 /org/freedesktop/systemd1 \
|
||||
org.freedesktop.systemd1.Manager StartTransientUnit \
|
||||
"ssa(sv)a(sa(sv))" test-20933-ok.service replace 1 \
|
||||
ExecStart "a(sasb)" 1 \
|
||||
/usr/bin/sleep 2 /usr/bin/sleep 1 true \
|
||||
0
|
||||
|
||||
# DBus call should fail but not crash systemd
|
||||
busctl call \
|
||||
org.freedesktop.systemd1 /org/freedesktop/systemd1 \
|
||||
org.freedesktop.systemd1.Manager StartTransientUnit \
|
||||
"ssa(sv)a(sa(sv))" test-20933-bad.service replace 1 \
|
||||
ExecStart "a(sasb)" 1 \
|
||||
/usr/bin/sleep 0 true \
|
||||
0 && { echo 'unexpected success'; exit 1; }
|
||||
(! busctl call \
|
||||
org.freedesktop.systemd1 /org/freedesktop/systemd1 \
|
||||
org.freedesktop.systemd1.Manager StartTransientUnit \
|
||||
"ssa(sv)a(sa(sv))" test-20933-bad.service replace 1 \
|
||||
ExecStart "a(sasb)" 1 \
|
||||
/usr/bin/sleep 0 true \
|
||||
0)
|
||||
|
||||
# Same but with the empty argv in the middle
|
||||
busctl call \
|
||||
org.freedesktop.systemd1 /org/freedesktop/systemd1 \
|
||||
org.freedesktop.systemd1.Manager StartTransientUnit \
|
||||
"ssa(sv)a(sa(sv))" test-20933-bad-middle.service replace 1 \
|
||||
ExecStart "a(sasb)" 3 \
|
||||
/usr/bin/sleep 2 /usr/bin/sleep 1 true \
|
||||
/usr/bin/sleep 0 true \
|
||||
/usr/bin/sleep 2 /usr/bin/sleep 1 true \
|
||||
0 && { echo 'unexpected success'; exit 1; }
|
||||
(! busctl call \
|
||||
org.freedesktop.systemd1 /org/freedesktop/systemd1 \
|
||||
org.freedesktop.systemd1.Manager StartTransientUnit \
|
||||
"ssa(sv)a(sa(sv))" test-20933-bad-middle.service replace 1 \
|
||||
ExecStart "a(sasb)" 3 \
|
||||
/usr/bin/sleep 2 /usr/bin/sleep 1 true \
|
||||
/usr/bin/sleep 0 true \
|
||||
/usr/bin/sleep 2 /usr/bin/sleep 1 true \
|
||||
0)
|
||||
|
||||
systemd-analyze log-level info
|
||||
|
||||
|
@ -36,7 +36,7 @@ cmp /var/tmp/testimage.raw /var/lib/machines/testimage3.raw
|
||||
# Test removal
|
||||
machinectl remove testimage
|
||||
test ! -f /var/lib/machines/testimage.raw
|
||||
machinectl image-status testimage && { echo 'unexpected success'; exit 1; }
|
||||
(! machinectl image-status testimage)
|
||||
|
||||
# Test export of clone
|
||||
machinectl export-raw testimage3 /var/tmp/testimage3.raw
|
||||
@ -48,7 +48,7 @@ machinectl rename testimage3 testimage4
|
||||
test -f /var/lib/machines/testimage4.raw
|
||||
machinectl image-status testimage4
|
||||
test ! -f /var/lib/machines/testimage3.raw
|
||||
machinectl image-status testimage3 && { echo 'unexpected success'; exit 1; }
|
||||
(! machinectl image-status testimage3)
|
||||
cmp /var/tmp/testimage.raw /var/lib/machines/testimage4.raw
|
||||
|
||||
# Test export of rename
|
||||
@ -59,7 +59,7 @@ rm /var/tmp/testimage4.raw
|
||||
# Test removal
|
||||
machinectl remove testimage4
|
||||
test ! -f /var/lib/machines/testimage4.raw
|
||||
machinectl image-status testimage4 && { echo 'unexpected success'; exit 1; }
|
||||
(! machinectl image-status testimage4)
|
||||
|
||||
# → And now, let's test directory trees ← #
|
||||
|
||||
@ -92,7 +92,7 @@ diff -r /var/tmp/scratch/ /var/lib/machines/scratch2
|
||||
# Test removal
|
||||
machinectl remove scratch
|
||||
test ! -f /var/lib/machines/scratch
|
||||
machinectl image-status scratchi && { echo 'unexpected success'; exit 1; }
|
||||
(! machinectl image-status scratch)
|
||||
|
||||
# Test clone
|
||||
machinectl clone scratch2 scratch3
|
||||
@ -105,20 +105,20 @@ diff -r /var/tmp/scratch/ /var/lib/machines/scratch3
|
||||
# Test removal
|
||||
machinectl remove scratch2
|
||||
test ! -f /var/lib/machines/scratch2
|
||||
machinectl image-status scratch2 && { echo 'unexpected success'; exit 1; }
|
||||
(! machinectl image-status scratch2)
|
||||
|
||||
# Test rename
|
||||
machinectl rename scratch3 scratch4
|
||||
test -d /var/lib/machines/scratch4
|
||||
machinectl image-status scratch4
|
||||
test ! -f /var/lib/machines/scratch3
|
||||
machinectl image-status scratch3 && { echo 'unexpected success'; exit 1; }
|
||||
(! machinectl image-status scratch3)
|
||||
diff -r /var/tmp/scratch/ /var/lib/machines/scratch4
|
||||
|
||||
# Test removal
|
||||
machinectl remove scratch4
|
||||
test ! -f /var/lib/machines/scratch4
|
||||
machinectl image-status scratch4 && { echo 'unexpected success'; exit 1; }
|
||||
(! machinectl image-status scratch4)
|
||||
|
||||
# Test import-tar hyphen/stdin pipe behavior
|
||||
# shellcheck disable=SC2002
|
||||
@ -138,7 +138,7 @@ rm -rf /var/tmp/scratch
|
||||
# Test removal
|
||||
machinectl remove scratch5
|
||||
test ! -f /var/lib/machines/scratch5
|
||||
machinectl image-status scratch5 && { echo 'unexpected success'; exit 1; }
|
||||
(! machinectl image-status scratch5)
|
||||
|
||||
echo OK >/testok
|
||||
|
||||
|
@ -33,7 +33,7 @@ test -d /var/lib/testservice
|
||||
test -d /var/cache/testservice
|
||||
test -d /var/log/testservice
|
||||
|
||||
systemctl clean testservice && { echo 'unexpected success'; exit 1; }
|
||||
(! systemctl clean testservice)
|
||||
|
||||
systemctl stop testservice
|
||||
|
||||
@ -108,7 +108,7 @@ test -L /var/lib/testservice
|
||||
test -L /var/cache/testservice
|
||||
test -L /var/log/testservice
|
||||
|
||||
systemctl clean testservice && { echo 'unexpected success'; exit 1; }
|
||||
(! systemctl clean testservice)
|
||||
|
||||
systemctl stop testservice
|
||||
|
||||
@ -197,7 +197,7 @@ test -d /var/lib/hoge
|
||||
test -d /var/cache/hoge
|
||||
test -d /var/log/hoge
|
||||
|
||||
systemctl clean tmp-hoge.mount && { echo 'unexpected success'; exit 1; }
|
||||
(! systemctl clean tmp-hoge.mount)
|
||||
|
||||
test -d /etc/hoge
|
||||
test -d /run/hoge
|
||||
@ -273,7 +273,7 @@ test -d /var/lib/testsocket
|
||||
test -d /var/cache/testsocket
|
||||
test -d /var/log/testsocket
|
||||
|
||||
systemctl clean testservice.socket && { echo 'unexpected success'; exit 1; }
|
||||
(! systemctl clean testservice.socket)
|
||||
|
||||
systemctl stop testservice.socket
|
||||
|
||||
|
@ -23,8 +23,7 @@ test_directory() {
|
||||
systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz:yyy test -f "${path}"/yyy/test
|
||||
systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}=zzz:xxx zzz:xxx2" -p TemporaryFileSystem="${path}" bash -c "test -f ${path}/xxx/test && test -f ${path}/xxx2/test"
|
||||
systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz:xxx -p TemporaryFileSystem="${path}":ro test -f "${path}"/xxx/test
|
||||
systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing)
|
||||
|
||||
test -d "${path}"/zzz
|
||||
test ! -L "${path}"/zzz
|
||||
@ -48,8 +47,7 @@ test_directory() {
|
||||
systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}=zzz:xxx zzz:xxx2" \
|
||||
-p TemporaryFileSystem="${path}" -p EnvironmentFile=-/usr/lib/systemd/systemd-asan-env bash -c "test -f ${path}/xxx/test && test -f ${path}/xxx2/test"
|
||||
systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"=zzz:xxx -p TemporaryFileSystem="${path}":ro test -f "${path}"/xxx/test
|
||||
systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing)
|
||||
|
||||
test -L "${path}"/zzz
|
||||
test -d "${path}"/private/zzz
|
||||
@ -72,8 +70,7 @@ test_directory() {
|
||||
systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz:xxx -p TemporaryFileSystem="${path}" test -f "${path}"/xxx/test
|
||||
systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}=zzz:xxx zzz:xxx2" -p TemporaryFileSystem="${path}" bash -c "test -f ${path}/xxx/test && test -f ${path}/xxx2/test"
|
||||
systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz:xxx -p TemporaryFileSystem="${path}":ro test -f "${path}"/xxx/test
|
||||
systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing)
|
||||
|
||||
test -d "${path}"/zzz
|
||||
test ! -L "${path}"/zzz
|
||||
|
@ -21,7 +21,7 @@ systemctl daemon-reload
|
||||
systemctl start "$SERVICE_NAME"
|
||||
systemctl status "$SERVICE_NAME"
|
||||
# The reload SHOULD fail but SHOULD NOT affect the service state
|
||||
systemctl reload "$SERVICE_NAME" && { echo 'unexpected success'; exit 1; }
|
||||
(! systemctl reload "$SERVICE_NAME")
|
||||
systemctl status "$SERVICE_NAME"
|
||||
systemctl stop "$SERVICE_NAME"
|
||||
|
||||
@ -39,7 +39,7 @@ systemctl daemon-reload
|
||||
systemctl start "$SERVICE_NAME"
|
||||
systemctl status "$SERVICE_NAME"
|
||||
# The reload SHOULD fail but SHOULD NOT affect the service state
|
||||
systemctl reload "$SERVICE_NAME" && { echo 'unexpected success'; exit 1; }
|
||||
(! systemctl reload "$SERVICE_NAME")
|
||||
systemctl status "$SERVICE_NAME"
|
||||
systemctl stop "$SERVICE_NAME"
|
||||
|
||||
|
@ -10,15 +10,14 @@ systemd-analyze log-level debug
|
||||
systemd-analyze log-target console
|
||||
|
||||
# test one: Restart=on-failure should restart the service
|
||||
systemd-run --unit=one -p Type=oneshot -p Restart=on-failure /bin/bash -c "exit 1" \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run --unit=one -p Type=oneshot -p Restart=on-failure /bin/bash -c "exit 1")
|
||||
|
||||
for ((secs = 0; secs < MAX_SECS; secs++)); do
|
||||
[[ "$(systemctl show one.service -P NRestarts)" -le 0 ]] || break
|
||||
sleep 1
|
||||
[[ "$(systemctl show one.service -P NRestarts)" -le 0 ]] || break
|
||||
sleep 1
|
||||
done
|
||||
if [[ "$(systemctl show one.service -P NRestarts)" -le 0 ]]; then
|
||||
exit 1
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TMP_FILE="/tmp/test-41-oneshot-restart-test"
|
||||
@ -27,27 +26,26 @@ TMP_FILE="/tmp/test-41-oneshot-restart-test"
|
||||
|
||||
# test two: make sure StartLimitBurst correctly limits the number of restarts
|
||||
# and restarts execution of the unit from the first ExecStart=
|
||||
systemd-run --unit=two \
|
||||
(! systemd-run --unit=two \
|
||||
-p StartLimitIntervalSec=120 \
|
||||
-p StartLimitBurst=3 \
|
||||
-p Type=oneshot \
|
||||
-p Restart=on-failure \
|
||||
-p ExecStart="/bin/bash -c \"printf a >> $TMP_FILE\"" /bin/bash -c "exit 1" \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
-p ExecStart="/bin/bash -c \"printf a >> $TMP_FILE\"" /bin/bash -c "exit 1")
|
||||
|
||||
# wait for at least 3 restarts
|
||||
for ((secs = 0; secs < MAX_SECS; secs++)); do
|
||||
[[ $(cat $TMP_FILE) != "aaa" ]] || break
|
||||
sleep 1
|
||||
[[ $(cat $TMP_FILE) != "aaa" ]] || break
|
||||
sleep 1
|
||||
done
|
||||
if [[ $(cat $TMP_FILE) != "aaa" ]]; then
|
||||
exit 1
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# wait for 5 more seconds to make sure there aren't excess restarts
|
||||
sleep 5
|
||||
if [[ $(cat $TMP_FILE) != "aaa" ]]; then
|
||||
exit 1
|
||||
exit 1
|
||||
fi
|
||||
|
||||
systemd-analyze log-level info
|
||||
|
@ -4,18 +4,20 @@ set -eux
|
||||
|
||||
systemd-analyze log-level debug
|
||||
|
||||
systemd-run --unit=simple1.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=simple -p ExecStopPost='/bin/touch /run/simple1' true
|
||||
systemd-run --unit=simple1.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=simple \
|
||||
-p ExecStopPost='/bin/touch /run/simple1' true
|
||||
test -f /run/simple1
|
||||
|
||||
systemd-run --unit=simple2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=simple -p ExecStopPost='/bin/touch /run/simple2' false \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run --unit=simple2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=simple \
|
||||
-p ExecStopPost='/bin/touch /run/simple2' false)
|
||||
test -f /run/simple2
|
||||
|
||||
systemd-run --unit=exec1.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=exec -p ExecStopPost='/bin/touch /run/exec1' sleep 1
|
||||
systemd-run --unit=exec1.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=exec \
|
||||
-p ExecStopPost='/bin/touch /run/exec1' sleep 1
|
||||
test -f /run/exec1
|
||||
|
||||
systemd-run --unit=exec2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=exec -p ExecStopPost='/bin/touch /run/exec2' sh -c 'sleep 1; false' \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run --unit=exec2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=exec \
|
||||
-p ExecStopPost='/bin/touch /run/exec2' sh -c 'sleep 1; false')
|
||||
test -f /run/exec2
|
||||
|
||||
cat >/tmp/forking1.sh <<EOF
|
||||
@ -31,7 +33,8 @@ systemd-notify MAINPID=\$MAINPID
|
||||
EOF
|
||||
chmod +x /tmp/forking1.sh
|
||||
|
||||
systemd-run --unit=forking1.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=forking -p NotifyAccess=exec -p ExecStopPost='/bin/touch /run/forking1' /tmp/forking1.sh
|
||||
systemd-run --unit=forking1.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=forking -p NotifyAccess=exec \
|
||||
-p ExecStopPost='/bin/touch /run/forking1' /tmp/forking1.sh
|
||||
test -f /run/forking1
|
||||
|
||||
cat >/tmp/forking2.sh <<EOF
|
||||
@ -39,7 +42,7 @@ cat >/tmp/forking2.sh <<EOF
|
||||
|
||||
set -eux
|
||||
|
||||
( sleep 4; exit 1 ) &
|
||||
(sleep 4; exit 1) &
|
||||
MAINPID=\$!
|
||||
disown
|
||||
|
||||
@ -47,28 +50,30 @@ systemd-notify MAINPID=\$MAINPID
|
||||
EOF
|
||||
chmod +x /tmp/forking2.sh
|
||||
|
||||
systemd-run --unit=forking2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=forking -p NotifyAccess=exec -p ExecStopPost='/bin/touch /run/forking2' /tmp/forking2.sh \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run --unit=forking2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=forking -p NotifyAccess=exec \
|
||||
-p ExecStopPost='/bin/touch /run/forking2' /tmp/forking2.sh)
|
||||
test -f /run/forking2
|
||||
|
||||
systemd-run --unit=oneshot1.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=oneshot -p ExecStopPost='/bin/touch /run/oneshot1' true
|
||||
systemd-run --unit=oneshot1.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=oneshot \
|
||||
-p ExecStopPost='/bin/touch /run/oneshot1' true
|
||||
test -f /run/oneshot1
|
||||
|
||||
systemd-run --unit=oneshot2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=oneshot -p ExecStopPost='/bin/touch /run/oneshot2' false \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run --unit=oneshot2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=oneshot \
|
||||
-p ExecStopPost='/bin/touch /run/oneshot2' false)
|
||||
test -f /run/oneshot2
|
||||
|
||||
systemd-run --unit=dbus1.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=dbus -p BusName=systemd.test.ExecStopPost -p ExecStopPost='/bin/touch /run/dbus1' \
|
||||
busctl call org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus RequestName su systemd.test.ExecStopPost 4 \
|
||||
|| :
|
||||
systemd-run --unit=dbus1.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=dbus -p BusName=systemd.test.ExecStopPost \
|
||||
-p ExecStopPost='/bin/touch /run/dbus1' \
|
||||
busctl call org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus RequestName su systemd.test.ExecStopPost 4 || :
|
||||
test -f /run/dbus1
|
||||
|
||||
systemd-run --unit=dbus2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=dbus -p BusName=systemd.test.ExecStopPost -p ExecStopPost='/bin/touch /run/dbus2' true
|
||||
systemd-run --unit=dbus2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=dbus -p BusName=systemd.test.ExecStopPost \
|
||||
-p ExecStopPost='/bin/touch /run/dbus2' true
|
||||
test -f /run/dbus2
|
||||
|
||||
# https://github.com/systemd/systemd/issues/19920
|
||||
systemd-run --unit=dbus3.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=dbus -p ExecStopPost='/bin/touch /run/dbus3' true \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run --unit=dbus3.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=dbus \
|
||||
-p ExecStopPost='/bin/touch /run/dbus3' true)
|
||||
|
||||
cat >/tmp/notify1.sh <<EOF
|
||||
#!/usr/bin/env bash
|
||||
@ -79,18 +84,19 @@ systemd-notify --ready
|
||||
EOF
|
||||
chmod +x /tmp/notify1.sh
|
||||
|
||||
systemd-run --unit=notify1.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=notify -p ExecStopPost='/bin/touch /run/notify1' /tmp/notify1.sh
|
||||
systemd-run --unit=notify1.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=notify \
|
||||
-p ExecStopPost='/bin/touch /run/notify1' /tmp/notify1.sh
|
||||
test -f /run/notify1
|
||||
|
||||
systemd-run --unit=notify2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=notify -p ExecStopPost='/bin/touch /run/notify2' true \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run --unit=notify2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=notify \
|
||||
-p ExecStopPost='/bin/touch /run/notify2' true)
|
||||
test -f /run/notify2
|
||||
|
||||
systemd-run --unit=idle1.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=idle -p ExecStopPost='/bin/touch /run/idle1' true
|
||||
test -f /run/idle1
|
||||
|
||||
systemd-run --unit=idle2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=idle -p ExecStopPost='/bin/touch /run/idle2' false \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run --unit=idle2.service --wait -p StandardOutput=tty -p StandardError=tty -p Type=idle \
|
||||
-p ExecStopPost='/bin/touch /run/idle2' false)
|
||||
test -f /run/idle2
|
||||
|
||||
systemd-analyze log-level info
|
||||
|
@ -35,13 +35,12 @@ runas testuser systemd-run --wait --user --unit=test-unprotected-home \
|
||||
test -e /home/testuser/works.txt
|
||||
|
||||
# Confirm that creating a file in home is blocked under read-only
|
||||
runas testuser systemd-run --wait --user --unit=test-protect-home-read-only \
|
||||
(! runas testuser systemd-run --wait --user --unit=test-protect-home-read-only \
|
||||
-p PrivateUsers=yes -p ProtectHome=read-only \
|
||||
-P bash -c '
|
||||
test -e /home/testuser/works.txt || exit 10
|
||||
touch /home/testuser/blocked.txt && exit 11
|
||||
' \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
')
|
||||
test ! -e /home/testuser/blocked.txt
|
||||
|
||||
# Check that tmpfs hides the whole directory
|
||||
@ -63,10 +62,9 @@ runas testuser systemd-run --wait --user --unit=test-protect-home-yes \
|
||||
# namespace (no CAP_SETGID in the parent namespace to write the additional
|
||||
# mapping of the user supplied group and thus cannot change groups to an
|
||||
# unmapped group ID)
|
||||
runas testuser systemd-run --wait --user --unit=test-group-fail \
|
||||
(! runas testuser systemd-run --wait --user --unit=test-group-fail \
|
||||
-p PrivateUsers=yes -p Group=daemon \
|
||||
-P true \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
-P true)
|
||||
|
||||
# Check that with a new user namespace we can bind mount
|
||||
# files and use a different root directory
|
||||
@ -94,31 +92,26 @@ runas testuser systemd-run --wait --user --unit=test-network \
|
||||
-p PrivateUsers=yes -p PrivateNetwork=yes \
|
||||
/bin/sh -x -c '! ip link | grep -E "^[0-9]+: " | grep -Ev ": (lo|(erspan|gre|gretap|ip_vti|ip6_vti|ip6gre|ip6tnl|sit|tunl)0@.*):"'
|
||||
|
||||
runas testuser systemd-run --wait --user --unit=test-hostname \
|
||||
(! runas testuser systemd-run --wait --user --unit=test-hostname \
|
||||
-p PrivateUsers=yes -p ProtectHostname=yes \
|
||||
hostnamectl hostname foo \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
hostnamectl hostname foo)
|
||||
|
||||
runas testuser systemd-run --wait --user --unit=test-clock \
|
||||
(! runas testuser systemd-run --wait --user --unit=test-clock \
|
||||
-p PrivateUsers=yes -p ProtectClock=yes \
|
||||
timedatectl set-time "2012-10-30 18:17:16" \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
timedatectl set-time "2012-10-30 18:17:16")
|
||||
|
||||
runas testuser systemd-run --wait --user --unit=test-kernel-tunable \
|
||||
(! runas testuser systemd-run --wait --user --unit=test-kernel-tunable \
|
||||
-p PrivateUsers=yes -p ProtectKernelTunables=yes \
|
||||
sh -c "echo 0 > /proc/sys/user/max_user_namespaces" \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
sh -c "echo 0 > /proc/sys/user/max_user_namespaces")
|
||||
|
||||
runas testuser systemd-run --wait --user --unit=test-kernel-mod \
|
||||
(! runas testuser systemd-run --wait --user --unit=test-kernel-mod \
|
||||
-p PrivateUsers=yes -p ProtectKernelModules=yes \
|
||||
sh -c "modprobe -r overlay && modprobe overlay" \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
sh -c "modprobe -r overlay && modprobe overlay")
|
||||
|
||||
if sysctl kernel.dmesg_restrict=0; then
|
||||
runas testuser systemd-run --wait --user --unit=test-kernel-log \
|
||||
(! runas testuser systemd-run --wait --user --unit=test-kernel-log \
|
||||
-p PrivateUsers=yes -p ProtectKernelLogs=yes -p LogNamespace=yes \
|
||||
dmesg \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
dmesg)
|
||||
fi
|
||||
|
||||
unsquashfs -no-xattrs -d /tmp/img /usr/share/minimal_0.raw
|
||||
|
@ -11,7 +11,7 @@ journalctl -o cat --namespace=foobar >/tmp/hello-world
|
||||
journalctl -o cat >/tmp/no-hello-world
|
||||
|
||||
grep "^hello world$" /tmp/hello-world
|
||||
grep "^hello world$" /tmp/no-hello-world && { echo 'unexpected success'; exit 1; }
|
||||
(! grep "^hello world$" /tmp/no-hello-world)
|
||||
|
||||
systemd-analyze log-level info
|
||||
|
||||
|
@ -154,14 +154,12 @@ if ! systemd-detect-virt -cq ; then
|
||||
fi
|
||||
|
||||
PASSWORD=xEhErW0ndafV4s homectl with test-user -- test ! -f /home/test-user/xyz
|
||||
PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz)
|
||||
PASSWORD=xEhErW0ndafV4s homectl with test-user -- touch /home/test-user/xyz
|
||||
PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz
|
||||
PASSWORD=xEhErW0ndafV4s homectl with test-user -- rm /home/test-user/xyz
|
||||
PASSWORD=xEhErW0ndafV4s homectl with test-user -- test ! -f /home/test-user/xyz
|
||||
PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz)
|
||||
|
||||
wait_for_state test-user inactive
|
||||
homectl remove test-user
|
||||
|
@ -331,8 +331,8 @@ systemctl is-active testservice-50e.service
|
||||
|
||||
# ExtensionDirectories will set up an overlay
|
||||
mkdir -p "${image_dir}/app0" "${image_dir}/app1"
|
||||
systemd-run -P --property ExtensionDirectories="${image_dir}/nonexistent" --property RootImage="${image}.raw" cat /opt/script0.sh && { echo 'unexpected success'; exit 1; }
|
||||
systemd-run -P --property ExtensionDirectories="${image_dir}/app0" --property RootImage="${image}.raw" cat /opt/script0.sh && { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run -P --property ExtensionDirectories="${image_dir}/nonexistent" --property RootImage="${image}.raw" cat /opt/script0.sh)
|
||||
(! systemd-run -P --property ExtensionDirectories="${image_dir}/app0" --property RootImage="${image}.raw" cat /opt/script0.sh)
|
||||
systemd-dissect --mount /usr/share/app0.raw "${image_dir}/app0"
|
||||
systemd-dissect --mount /usr/share/app1.raw "${image_dir}/app1"
|
||||
systemd-run -P --property ExtensionDirectories="${image_dir}/app0" --property RootImage="${image}.raw" cat /opt/script0.sh | grep -q -F "extension-release.app0"
|
||||
|
@ -54,16 +54,14 @@ if [ "$expected_credential" != "" ] ; then
|
||||
fi
|
||||
|
||||
# Verify that the creds are immutable
|
||||
systemd-run -p LoadCredential=passwd:/etc/passwd \
|
||||
(! systemd-run -p LoadCredential=passwd:/etc/passwd \
|
||||
-p DynamicUser=1 \
|
||||
--wait \
|
||||
touch '${CREDENTIALS_DIRECTORY}/passwd' \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
systemd-run -p LoadCredential=passwd:/etc/passwd \
|
||||
touch '${CREDENTIALS_DIRECTORY}/passwd')
|
||||
(! systemd-run -p LoadCredential=passwd:/etc/passwd \
|
||||
-p DynamicUser=1 \
|
||||
--wait \
|
||||
rm '${CREDENTIALS_DIRECTORY}/passwd' \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
rm '${CREDENTIALS_DIRECTORY}/passwd')
|
||||
|
||||
# Check directory-based loading
|
||||
mkdir -p /tmp/ts54-creds/sub
|
||||
|
@ -35,15 +35,13 @@ systemd-run --wait --unit=two -p Type=notify -p ExitType=cgroup \
|
||||
/tmp/test56-exit-cgroup.sh 'systemctl stop two'
|
||||
|
||||
# false exec condition: systemd-run should exit immediately with status code: 1
|
||||
systemd-run --wait --unit=three -p Type=notify -p ExitType=cgroup \
|
||||
(! systemd-run --wait --unit=three -p Type=notify -p ExitType=cgroup \
|
||||
-p ExecCondition=false \
|
||||
/tmp/test56-exit-cgroup.sh \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
/tmp/test56-exit-cgroup.sh)
|
||||
|
||||
# service should exit uncleanly (main process exits with SIGKILL)
|
||||
systemd-run --wait --unit=four -p Type=notify -p ExitType=cgroup \
|
||||
/tmp/test56-exit-cgroup.sh 'systemctl kill --signal 9 four' \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-run --wait --unit=four -p Type=notify -p ExitType=cgroup \
|
||||
/tmp/test56-exit-cgroup.sh 'systemctl kill --signal 9 four')
|
||||
|
||||
|
||||
# Multiple level process tree, parent process exits quickly
|
||||
|
@ -19,16 +19,13 @@ EOF
|
||||
|
||||
set +e
|
||||
# Default behaviour is to recurse through all dependencies when unit is loaded
|
||||
systemd-analyze verify --root=/tmp/img/ testfile.service \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-analyze verify --root=/tmp/img/ testfile.service)
|
||||
|
||||
# As above, recurses through all dependencies when unit is loaded
|
||||
systemd-analyze verify --recursive-errors=yes --root=/tmp/img/ testfile.service \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-analyze verify --recursive-errors=yes --root=/tmp/img/ testfile.service)
|
||||
|
||||
# Recurses through unit file and its direct dependencies when unit is loaded
|
||||
systemd-analyze verify --recursive-errors=one --root=/tmp/img/ testfile.service \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-analyze verify --recursive-errors=one --root=/tmp/img/ testfile.service)
|
||||
|
||||
set -e
|
||||
|
||||
@ -58,8 +55,7 @@ systemd-analyze verify --recursive-errors=no /tmp/testfile2.service
|
||||
|
||||
set +e
|
||||
# Non-zero exit status since all associated dependencies are recursively loaded when the unit file is loaded
|
||||
systemd-analyze verify --recursive-errors=yes /tmp/testfile2.service \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-analyze verify --recursive-errors=yes /tmp/testfile2.service)
|
||||
set -e
|
||||
|
||||
rm /tmp/testfile.service
|
||||
@ -81,19 +77,15 @@ rm /tmp/.testfile.service
|
||||
# Alias a unit file's name on disk (see #20061)
|
||||
cp /tmp/testfile.service /tmp/testsrvc
|
||||
|
||||
systemd-analyze verify /tmp/testsrvc \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
(! systemd-analyze verify /tmp/testsrvc)
|
||||
|
||||
systemd-analyze verify /tmp/testsrvc:alias.service
|
||||
|
||||
# Zero exit status since the value used for comparison determine exposure to security threats is by default 100
|
||||
systemd-analyze security --offline=true /tmp/testfile.service
|
||||
|
||||
set +e
|
||||
#The overall exposure level assigned to the unit is greater than the set threshold
|
||||
systemd-analyze security --threshold=90 --offline=true /tmp/testfile.service \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
set -e
|
||||
(! systemd-analyze security --threshold=90 --offline=true /tmp/testfile.service)
|
||||
|
||||
# Ensure we print the list of ACLs, see https://github.com/systemd/systemd/issues/23185
|
||||
systemd-analyze security --offline=true /tmp/testfile.service | grep -q -F "/dev/sda"
|
||||
@ -584,19 +576,15 @@ systemd-analyze security --threshold=25 --offline=true \
|
||||
--profile=strict \
|
||||
--root=/tmp/img/ testfile.service
|
||||
|
||||
set +e
|
||||
# The trusted profile doesn't add any sanboxing options
|
||||
systemd-analyze security --threshold=25 --offline=true \
|
||||
(! systemd-analyze security --threshold=25 --offline=true \
|
||||
--security-policy=/tmp/testfile.json \
|
||||
--profile=/usr/lib/systemd/portable/profile/trusted/service.conf \
|
||||
--root=/tmp/img/ testfile.service \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
--root=/tmp/img/ testfile.service)
|
||||
|
||||
systemd-analyze security --threshold=50 --offline=true \
|
||||
(! systemd-analyze security --threshold=50 --offline=true \
|
||||
--security-policy=/tmp/testfile.json \
|
||||
--root=/tmp/img/ testfile.service \
|
||||
&& { echo 'unexpected success'; exit 1; }
|
||||
set -e
|
||||
--root=/tmp/img/ testfile.service)
|
||||
|
||||
rm /tmp/img/usr/lib/systemd/system/testfile.service
|
||||
|
||||
|
@ -18,7 +18,7 @@ env PASSWORD=passphrase systemd-cryptenroll --tpm2-device=auto $img
|
||||
|
||||
# Check with wrong PCR
|
||||
tpm2_pcrextend 7:sha256=0000000000000000000000000000000000000000000000000000000000000000
|
||||
/usr/lib/systemd/systemd-cryptsetup attach test-volume $img - tpm2-device=auto,headless=1 && { echo 'unexpected success'; exit 1; }
|
||||
(! /usr/lib/systemd/systemd-cryptsetup attach test-volume $img - tpm2-device=auto,headless=1)
|
||||
|
||||
# Enroll unlock with PCR+PIN policy
|
||||
systemd-cryptenroll --wipe-slot=tpm2 $img
|
||||
@ -27,11 +27,11 @@ env PIN=123456 /usr/lib/systemd/systemd-cryptsetup attach test-volume $img - tpm
|
||||
/usr/lib/systemd/systemd-cryptsetup detach test-volume
|
||||
|
||||
# Check failure with wrong PIN
|
||||
env PIN=123457 /usr/lib/systemd/systemd-cryptsetup attach test-volume $img - tpm2-device=auto,headless=1 && { echo 'unexpected success'; exit 1; }
|
||||
(! env PIN=123457 /usr/lib/systemd/systemd-cryptsetup attach test-volume $img - tpm2-device=auto,headless=1)
|
||||
|
||||
# Check failure with wrong PCR (and correct PIN)
|
||||
tpm2_pcrextend 7:sha256=0000000000000000000000000000000000000000000000000000000000000000
|
||||
env PIN=123456 /usr/lib/systemd/systemd-cryptsetup attach test-volume $img - tpm2-device=auto,headless=1 && { echo 'unexpected success'; exit 1; }
|
||||
(! env PIN=123456 /usr/lib/systemd/systemd-cryptsetup attach test-volume $img - tpm2-device=auto,headless=1)
|
||||
|
||||
# Enroll unlock with PCR 0+7
|
||||
systemd-cryptenroll --wipe-slot=tpm2 $img
|
||||
|
Loading…
x
Reference in New Issue
Block a user