systemd/test/test-execute/exec-readonlypaths.service

# SPDX-License-Identifier: LGPL-2.1-or-later
[Unit]
Description=Test for ReadOnlyPaths=

[Service]
ReadOnlyPaths=/usr /etc /sys /dev -/i-dont-exist
PrivateDevices=yes
ExecStart=sh -x -c 'test ! -w /usr && test ! -w /etc && test ! -w /sys && test ! -w /sys/fs/cgroup'
ExecStart=sh -x -c 'test ! -w /dev && test ! -w /dev/shm && test ! -e /i-dont-exist && test -w /var'
Type=oneshot
tests: add spdx license header to test unit/link/network/conf files Those are all consumed by our parser, so they all support comments. I was considering whether they should have a license header at all, but in the end I decided to add it because those files are often created by copying parts of real unit files. And if the real ones have a license, then those might as well. It's easier to add it than to make an exception. 2021-10-17 18:07:22 +02:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
test: add tests for simple ReadOnlyPaths= case 2016-09-25 19:24:25 +02:00			`[Unit]`
			`Description=Test for ReadOnlyPaths=`

			`[Service]`
namespace: don't try to remount superblocks We can't remount the underlying superblocks, if we are inside a user namespace and running Linux <= 4.17. We can only change the per-mount flags (MS_REMOUNT \| MS_BIND). This type of mount() call can only change the per-mount flags, so we don't have to worry about passing the right string options now. Fixes #9914 ("Since 1beab8b was merged, systemd has been failing to start systemd-resolved inside unprivileged containers" ... "Failed to re-mount '/run/systemd/unit-root/dev' read-only: Operation not permitted"). > It's basically my fault :-). I pointed out we could remount read-only > without MS_BIND when reviewing the PR that added TemporaryFilesystem=, > and poettering suggested to change PrivateDevices= at the same time. > I think it's safe to change back, and I don't expect anyone will notice > a difference in behaviour. > > It just surprised me to realize that > `TemporaryFilesystem=/tmp:size=10M,ro,nosuid` would not apply `ro` to the > superblock (underlying filesystem), like mount -osize=10M,ro,nosuid does. > Maybe a comment could note the kernel version (v4.18), that lets you > remount without MS_BIND inside a user namespace. This makes the code longer and I guess this function is still ugly, sorry. One obstacle to cleaning it up is the interaction between `PrivateDevices=yes` and `ReadOnlyPaths=/dev`. I've added a test for the existing behaviour, which I think is now the correct behaviour. 2018-08-30 00:32:54 +01:00			`ReadOnlyPaths=/usr /etc /sys /dev -/i-dont-exist`
			`PrivateDevices=yes`
tests: use relative paths in ExecStart= and friends We want to retain some of the full paths in order to test more code paths. But the default should be to use the command name only. This makes the tests less visually cluttered. 2024-01-04 15:24:52 +01:00			`ExecStart=sh -x -c 'test ! -w /usr && test ! -w /etc && test ! -w /sys && test ! -w /sys/fs/cgroup'`
			`ExecStart=sh -x -c 'test ! -w /dev && test ! -w /dev/shm && test ! -e /i-dont-exist && test -w /var'`
test: add tests for simple ReadOnlyPaths= case 2016-09-25 19:24:25 +02:00			`Type=oneshot`