shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-05 15:21:37 +03:00
Code
4fa744a35c
systemd/test/units/testsuite-43.sh

69 lines
2.2 KiB
Bash
Raw Normal View History

treewide: more portable bash shebangs As in 2a5fcfae024ffc370bb780572279f45a1da3f946 and in 3e67e5c9928f8b1e1c5a63def88d53ed1fed12eb using /usr/bin/env allows bash to be looked up in PATH rather than being hard-coded. As with the previous changes the same arguments apply - distributions have scripts to rewrite shebangs on installation and they know what locations to rely on. - For tests/compilation we should rather rely on the user to have setup there PATH correctly. In particular this makes testing from git easier on NixOS where do not provide /bin/bash to improve compose-ability.
2020-03-04 12:35:06 +03:00
#!/usr/bin/env bash
core: add test case for PrivateUsers=true in user manager The test exercises that PrivateTmp=yes and ProtectHome={read-only,tmpfs} directives work as expected when PrivateUsers=yes in a user manager. Some code is also added to test-functions to help set up test cases that exercise the user manager.
2019-11-13 21:32:24 +03:00
set -ex
set -o pipefail
systemd-analyze log-level debug
runas() {
declare userid=$1
shift
test: hardcode shell to use let's make sure we always invoke our commands through /bin/sh, since on some distros su will use /bin/nologin (or whatever is listed in /etc/passwd) as shell otherwise and we don#t want that.
2020-01-03 20:25:51 +03:00
su "$userid" -s /bin/sh -c 'XDG_RUNTIME_DIR=/run/user/$UID exec "$@"' -- sh "$@"
core: add test case for PrivateUsers=true in user manager The test exercises that PrivateTmp=yes and ProtectHome={read-only,tmpfs} directives work as expected when PrivateUsers=yes in a user manager. Some code is also added to test-functions to help set up test cases that exercise the user manager.
2019-11-13 21:32:24 +03:00
}
test: don't rely on "nobody" user for TEST-43 The name is not as universal as we want, still, hence let's use our own user we create with sysusers.d/. That should yield same behaviour everywhere (and also test sysusers a bit as side effect).
2020-01-03 20:27:14 +03:00
runas testuser systemd-run --user --unit=test-private-users \
core: add test case for PrivateUsers=true in user manager The test exercises that PrivateTmp=yes and ProtectHome={read-only,tmpfs} directives work as expected when PrivateUsers=yes in a user manager. Some code is also added to test-functions to help set up test cases that exercise the user manager.
2019-11-13 21:32:24 +03:00
-p PrivateUsers=yes -P echo hello
test: don't rely on "nobody" user for TEST-43 The name is not as universal as we want, still, hence let's use our own user we create with sysusers.d/. That should yield same behaviour everywhere (and also test sysusers a bit as side effect).
2020-01-03 20:27:14 +03:00
runas testuser systemd-run --user --unit=test-private-tmp-innerfile \
core: add test case for PrivateUsers=true in user manager The test exercises that PrivateTmp=yes and ProtectHome={read-only,tmpfs} directives work as expected when PrivateUsers=yes in a user manager. Some code is also added to test-functions to help set up test cases that exercise the user manager.
2019-11-13 21:32:24 +03:00
-p PrivateUsers=yes -p PrivateTmp=yes \
-P touch /tmp/innerfile.txt
# File should not exist outside the job's tmp directory.
test ! -e /tmp/innerfile.txt
touch /tmp/outerfile.txt
# File should not appear in unit's private tmp.
test: don't rely on "nobody" user for TEST-43 The name is not as universal as we want, still, hence let's use our own user we create with sysusers.d/. That should yield same behaviour everywhere (and also test sysusers a bit as side effect).
2020-01-03 20:27:14 +03:00
runas testuser systemd-run --user --unit=test-private-tmp-outerfile \
core: add test case for PrivateUsers=true in user manager The test exercises that PrivateTmp=yes and ProtectHome={read-only,tmpfs} directives work as expected when PrivateUsers=yes in a user manager. Some code is also added to test-functions to help set up test cases that exercise the user manager.
2019-11-13 21:32:24 +03:00
-p PrivateUsers=yes -p PrivateTmp=yes \
-P test ! -e /tmp/outerfile.txt
# Confirm that creating a file in home works
test: don't rely on "nobody" user for TEST-43 The name is not as universal as we want, still, hence let's use our own user we create with sysusers.d/. That should yield same behaviour everywhere (and also test sysusers a bit as side effect).
2020-01-03 20:27:14 +03:00
runas testuser systemd-run --user --unit=test-unprotected-home \
-P touch /home/testuser/works.txt
test -e /home/testuser/works.txt
core: add test case for PrivateUsers=true in user manager The test exercises that PrivateTmp=yes and ProtectHome={read-only,tmpfs} directives work as expected when PrivateUsers=yes in a user manager. Some code is also added to test-functions to help set up test cases that exercise the user manager.
2019-11-13 21:32:24 +03:00
# Confirm that creating a file in home is blocked under read-only
test: don't rely on "nobody" user for TEST-43 The name is not as universal as we want, still, hence let's use our own user we create with sysusers.d/. That should yield same behaviour everywhere (and also test sysusers a bit as side effect).
2020-01-03 20:27:14 +03:00
runas testuser systemd-run --user --unit=test-protect-home-read-only \
core: add test case for PrivateUsers=true in user manager The test exercises that PrivateTmp=yes and ProtectHome={read-only,tmpfs} directives work as expected when PrivateUsers=yes in a user manager. Some code is also added to test-functions to help set up test cases that exercise the user manager.
2019-11-13 21:32:24 +03:00
-p PrivateUsers=yes -p ProtectHome=read-only \
-P bash -c '
test: don't rely on "nobody" user for TEST-43 The name is not as universal as we want, still, hence let's use our own user we create with sysusers.d/. That should yield same behaviour everywhere (and also test sysusers a bit as side effect).
2020-01-03 20:27:14 +03:00
test -e /home/testuser/works.txt
! touch /home/testuser/blocked.txt
core: add test case for PrivateUsers=true in user manager The test exercises that PrivateTmp=yes and ProtectHome={read-only,tmpfs} directives work as expected when PrivateUsers=yes in a user manager. Some code is also added to test-functions to help set up test cases that exercise the user manager.
2019-11-13 21:32:24 +03:00
'
test: don't rely on "nobody" user for TEST-43 The name is not as universal as we want, still, hence let's use our own user we create with sysusers.d/. That should yield same behaviour everywhere (and also test sysusers a bit as side effect).
2020-01-03 20:27:14 +03:00
test ! -e /home/testuser/blocked.txt
core: add test case for PrivateUsers=true in user manager The test exercises that PrivateTmp=yes and ProtectHome={read-only,tmpfs} directives work as expected when PrivateUsers=yes in a user manager. Some code is also added to test-functions to help set up test cases that exercise the user manager.
2019-11-13 21:32:24 +03:00
# Check that tmpfs hides the whole directory
test: don't rely on "nobody" user for TEST-43 The name is not as universal as we want, still, hence let's use our own user we create with sysusers.d/. That should yield same behaviour everywhere (and also test sysusers a bit as side effect).
2020-01-03 20:27:14 +03:00
runas testuser systemd-run --user --unit=test-protect-home-tmpfs \
core: add test case for PrivateUsers=true in user manager The test exercises that PrivateTmp=yes and ProtectHome={read-only,tmpfs} directives work as expected when PrivateUsers=yes in a user manager. Some code is also added to test-functions to help set up test cases that exercise the user manager.
2019-11-13 21:32:24 +03:00
-p PrivateUsers=yes -p ProtectHome=tmpfs \
test: don't rely on "nobody" user for TEST-43 The name is not as universal as we want, still, hence let's use our own user we create with sysusers.d/. That should yield same behaviour everywhere (and also test sysusers a bit as side effect).
2020-01-03 20:27:14 +03:00
-P test ! -e /home/testuser
core: add test case for PrivateUsers=true in user manager The test exercises that PrivateTmp=yes and ProtectHome={read-only,tmpfs} directives work as expected when PrivateUsers=yes in a user manager. Some code is also added to test-functions to help set up test cases that exercise the user manager.
2019-11-13 21:32:24 +03:00
core: create inaccessible nodes for users when making runtime dirs To support ProtectHome=y in a user namespace (which mounts the inaccessible nodes), the nodes need to be accessible by the user. Create these paths and devices in the user runtime directory so they can be used later if needed.
2019-11-20 01:24:52 +03:00
# Confirm that home, /root, and /run/user are inaccessible under "yes"
test: don't rely on "nobody" user for TEST-43 The name is not as universal as we want, still, hence let's use our own user we create with sysusers.d/. That should yield same behaviour everywhere (and also test sysusers a bit as side effect).
2020-01-03 20:27:14 +03:00
runas testuser systemd-run --user --unit=test-protect-home-yes \
core: create inaccessible nodes for users when making runtime dirs To support ProtectHome=y in a user namespace (which mounts the inaccessible nodes), the nodes need to be accessible by the user. Create these paths and devices in the user runtime directory so they can be used later if needed.
2019-11-20 01:24:52 +03:00
-p PrivateUsers=yes -p ProtectHome=yes \
-P bash -c '
test "$(stat -c %a /home)" = "0"
test "$(stat -c %a /root)" = "0"
test "$(stat -c %a /run/user)" = "0"
'
core: add test case for PrivateUsers=true in user manager The test exercises that PrivateTmp=yes and ProtectHome={read-only,tmpfs} directives work as expected when PrivateUsers=yes in a user manager. Some code is also added to test-functions to help set up test cases that exercise the user manager.
2019-11-13 21:32:24 +03:00
# Confirm we cannot change groups because we only have one mapping in the user
# namespace (no CAP_SETGID in the parent namespace to write the additional
# mapping of the user supplied group and thus cannot change groups to an
# unmapped group ID)
test: don't rely on "nobody" user for TEST-43 The name is not as universal as we want, still, hence let's use our own user we create with sysusers.d/. That should yield same behaviour everywhere (and also test sysusers a bit as side effect).
2020-01-03 20:27:14 +03:00
! runas testuser systemd-run --user --unit=test-group-fail \
core: add test case for PrivateUsers=true in user manager The test exercises that PrivateTmp=yes and ProtectHome={read-only,tmpfs} directives work as expected when PrivateUsers=yes in a user manager. Some code is also added to test-functions to help set up test cases that exercise the user manager.
2019-11-13 21:32:24 +03:00
-p PrivateUsers=yes -p Group=daemon \
-P true
systemd-analyze log-level info
echo OK > /testok
exit 0
Copy Permalink