shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-10-31 16:21:26 +03:00
Code

Merge pull request #19800 from poettering/podman-test

Browse Source 
make our testsuite pass in a podman container with default privs
This commit is contained in:
Lennart Poettering 2021-06-03 14:11:59 +02:00 committed by GitHub
commit 8d8053c2fe
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 44 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/test/test-capability.c
View File

@ -159,9 +159,15 @@ static void test_drop_privileges_fail(void) {
}
static void test_drop_privileges(void) {
fork_test(test_drop_privileges_fail);
if (have_effective_cap(CAP_NET_RAW) == 0) /* The remaining two tests only work if we have CAP_NET_RAW
* in the first place. If we are run in some restricted
* container environment we might not. */
return;
fork_test(test_drop_privileges_keep_net_raw);
fork_test(test_drop_privileges_dontkeep_net_raw);
fork_test(test_drop_privileges_fail);
}
static void test_have_effective_cap(void) {

2
src/test/test-exec-util.c
View File

@ -22,7 +22,7 @@
#include "tests.h"
static int here = 0, here2 = 0, here3 = 0;
void *ignore_stdout_args[] = {&here, &here2, &here3};
static void *ignore_stdout_args[] = { &here, &here2, &here3 };
/* noop handlers, just check that arguments are passed correctly */
static int ignore_stdout_func(int fd, void *arg) {

4
src/test/test-execute.c
View File

@ -924,8 +924,8 @@ int main(int argc, char *argv[]) {
can_unshare = have_namespaces();
/* It is needed otherwise cgroup creation fails */
if (getuid() != 0)
return log_tests_skipped("not root");
if (geteuid() != 0 || have_effective_cap(CAP_SYS_ADMIN) <= 0)
return log_tests_skipped("not privileged");
r = enter_cgroup_subroot(NULL);
if (r == -ENOMEDIUM)

9
src/test/test-mount-util.c
View File

@ -4,6 +4,7 @@
#include <sys/statvfs.h>
#include "alloc-util.h"
#include "capability-util.h"
#include "fd-util.h"
#include "fileio.h"
#include "mount-util.h"
@ -75,8 +76,8 @@ static void test_bind_remount_recursive(void) {
_cleanup_free_ char *subdir = NULL;
const char *p;
if (geteuid() != 0) {
(void) log_tests_skipped("not running as root");
if (geteuid() != 0 || have_effective_cap(CAP_SYS_ADMIN) <= 0) {
(void) log_tests_skipped("not running privileged");
return;
}
@ -128,8 +129,8 @@ static void test_bind_remount_recursive(void) {
static void test_bind_remount_one(void) {
pid_t pid;
if (geteuid() != 0) {
(void) log_tests_skipped("not running as root");
if (geteuid() != 0 || have_effective_cap(CAP_SYS_ADMIN) <= 0) {
(void) log_tests_skipped("not running privileged");
return;
}

53
src/test/test-seccomp.c
View File

@ -15,6 +15,7 @@
#endif
#include "alloc-util.h"
#include "capability-util.h"
#include "fd-util.h"
#include "fileio.h"
#include "macro.h"
@ -41,6 +42,10 @@
# define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 0
#endif
static bool have_seccomp_privs(void) {
return geteuid() == 0 && have_effective_cap(CAP_SYS_ADMIN) > 0; /* If we are root but CAP_SYS_ADMIN we can't do caps (unless we also do NNP) */
}
static void test_parse_syscall_and_errno(void) {
_cleanup_free_ char *n = NULL;
int e;
@ -168,8 +173,8 @@ static void test_filter_sets(void) {
log_notice("Seccomp not available, skipping %s", __func__);
return;
}
if (geteuid() != 0) {
log_notice("Not root, skipping %s", __func__);
if (!have_seccomp_privs()) {
log_notice("Not privileged, skipping %s", __func__);
return;
}
@ -303,8 +308,8 @@ static void test_restrict_namespace(void) {
log_notice("Seccomp not available, skipping remaining tests in %s", __func__);
return;
}
if (geteuid() != 0) {
log_notice("Not root, skipping remaining tests in %s", __func__);
if (!have_seccomp_privs()) {
log_notice("Not privileged, skipping remaining tests in %s", __func__);
return;
}
@ -373,8 +378,8 @@ static void test_protect_sysctl(void) {
log_notice("Seccomp not available, skipping %s", __func__);
return;
}
if (geteuid() != 0) {
log_notice("Not root, skipping %s", __func__);
if (!have_seccomp_privs()) {
log_notice("Not privileged, skipping %s", __func__);
return;
}
@ -426,8 +431,8 @@ static void test_protect_syslog(void) {
log_notice("Seccomp not available, skipping %s", __func__);
return;
}
if (geteuid() != 0) {
log_notice("Not root, skipping %s", __func__);
if (!have_seccomp_privs()) {
log_notice("Not privileged, skipping %s", __func__);
return;
}
@ -468,8 +473,8 @@ static void test_restrict_address_families(void) {
log_notice("Seccomp not available, skipping %s", __func__);
return;
}
if (geteuid() != 0) {
log_notice("Not root, skipping %s", __func__);
if (!have_seccomp_privs()) {
log_notice("Not privileged, skipping %s", __func__);
return;
}
@ -557,8 +562,8 @@ static void test_restrict_realtime(void) {
log_notice("Seccomp not available, skipping %s", __func__);
return;
}
if (geteuid() != 0) {
log_notice("Not root, skipping %s", __func__);
if (!have_seccomp_privs()) {
log_notice("Not privileged, skipping %s", __func__);
return;
}
@ -604,8 +609,8 @@ static void test_memory_deny_write_execute_mmap(void) {
log_notice("Seccomp not available, skipping %s", __func__);
return;
}
if (geteuid() != 0) {
log_notice("Not root, skipping %s", __func__);
if (!have_seccomp_privs()) {
log_notice("Not privileged, skipping %s", __func__);
return;
}
#if HAVE_VALGRIND_VALGRIND_H
@ -674,8 +679,8 @@ static void test_memory_deny_write_execute_shmat(void) {
log_notice("Seccomp not available, skipping %s", __func__);
return;
}
if (geteuid() != 0) {
log_notice("Not root, skipping %s", __func__);
if (!have_seccomp_privs()) {
log_notice("Not privileged, skipping %s", __func__);
return;
}
#if HAVE_VALGRIND_VALGRIND_H
@ -739,8 +744,8 @@ static void test_restrict_archs(void) {
log_notice("Seccomp not available, skipping %s", __func__);
return;
}
if (geteuid() != 0) {
log_notice("Not root, skipping %s", __func__);
if (!have_seccomp_privs()) {
log_notice("Not privileged, skipping %s", __func__);
return;
}
@ -779,8 +784,8 @@ static void test_load_syscall_filter_set_raw(void) {
log_notice("Seccomp not available, skipping %s", __func__);
return;
}
if (geteuid() != 0) {
log_notice("Not root, skipping %s", __func__);
if (!have_seccomp_privs()) {
log_notice("Not privileged, skipping %s", __func__);
return;
}
@ -877,8 +882,8 @@ static void test_lock_personality(void) {
log_notice("Seccomp not available, skipping %s", __func__);
return;
}
if (geteuid() != 0) {
log_notice("Not root, skipping %s", __func__);
if (!have_seccomp_privs()) {
log_notice("Not privileged, skipping %s", __func__);
return;
}
@ -941,8 +946,8 @@ static void test_restrict_suid_sgid(void) {
log_notice("Seccomp not available, skipping %s", __func__);
return;
}
if (geteuid() != 0) {
log_notice("Not root, skipping %s", __func__);
if (!have_seccomp_privs()) {
log_notice("Not privileged, skipping %s", __func__);
return;
}