mirror of
https://github.com/systemd/systemd.git
synced 2024-12-23 21:35:11 +03:00
test: add capability tests for ProtectKernelModules=
This just adds capabilities test.
This commit is contained in:
parent
502d704e5e
commit
3ae33295f0
@ -1639,6 +1639,8 @@ EXTRA_DIST += \
|
||||
test/test-execute/exec-privatedevices-yes.service \
|
||||
test/test-execute/exec-privatedevices-no-capability-mknod.service \
|
||||
test/test-execute/exec-privatedevices-yes-capability-mknod.service \
|
||||
test/test-execute/exec-protectkernelmodules-no-capabilities.service \
|
||||
test/test-execute/exec-protectkernelmodules-yes-capabilities.service \
|
||||
test/test-execute/exec-privatetmp-no.service \
|
||||
test/test-execute/exec-privatetmp-yes.service \
|
||||
test/test-execute/exec-readonlypaths.service \
|
||||
|
@ -142,6 +142,16 @@ static void test_exec_privatedevices_capabilities(Manager *m) {
|
||||
test(m, "exec-privatedevices-no-capability-mknod.service", 0, CLD_EXITED);
|
||||
}
|
||||
|
||||
static void test_exec_protectkernelmodules_capabilities(Manager *m) {
|
||||
if (detect_container() > 0) {
|
||||
log_notice("testing in container, skipping protectkernelmodules tests");
|
||||
return;
|
||||
}
|
||||
|
||||
test(m, "exec-protectkernelmodules-no-capabilities.service", 0, CLD_EXITED);
|
||||
test(m, "exec-protectkernelmodules-yes-capabilities.service", 0, CLD_EXITED);
|
||||
}
|
||||
|
||||
static void test_exec_readonlypaths(Manager *m) {
|
||||
test(m, "exec-readonlypaths.service", 0, CLD_EXITED);
|
||||
test(m, "exec-readonlypaths-mount-propagation.service", 0, CLD_EXITED);
|
||||
@ -368,6 +378,7 @@ int main(int argc, char *argv[]) {
|
||||
test_exec_privatetmp,
|
||||
test_exec_privatedevices,
|
||||
test_exec_privatedevices_capabilities,
|
||||
test_exec_protectkernelmodules_capabilities,
|
||||
test_exec_readonlypaths,
|
||||
test_exec_readwritepaths,
|
||||
test_exec_inaccessiblepaths,
|
||||
|
@ -0,0 +1,7 @@
|
||||
[Unit]
|
||||
Description=Test CAP_SYS_MODULE ProtectKernelModules=no
|
||||
|
||||
[Service]
|
||||
ProtectKernelModules=no
|
||||
ExecStart=/bin/sh -x -c 'capsh --print | grep cap_sys_module'
|
||||
Type=oneshot
|
@ -0,0 +1,7 @@
|
||||
[Unit]
|
||||
Description=Test CAP_SYS_MODULE for ProtectKernelModules=yes
|
||||
|
||||
[Service]
|
||||
ProtectKernelModules=yes
|
||||
ExecStart=/bin/sh -x -c '! capsh --print | grep cap_sys_module'
|
||||
Type=oneshot
|
Loading…
Reference in New Issue
Block a user