1
0
mirror of https://github.com/systemd/systemd.git synced 2024-10-29 21:55:36 +03:00
Commit Graph

404 Commits

Author SHA1 Message Date
Zbigniew Jędrzejewski-Szmek
d7ff524039 tree-wide: drop manually-crafted message for missing variables
Bash will generate a very nice message for us:
/tmp/ff.sh: line 1: SOMEVAR: parameter null or not set

Let's save some keystrokes by not replacing this with our own inferior
messages.
2022-05-04 20:53:46 +09:00
Lennart Poettering
41be3b099f
Merge pull request #23170 from poettering/creds-copy
import system credentials from sd-stub + qemu fw_cfg + kernel cmdline explicitly in PID 1
2022-05-02 16:32:21 +02:00
Luca Boccassi
6a59dfa108 analyze security: print DeviceAllow list
Many sandboxing options add implicit DeviceAllow rules, which might be confusing
for users running systemd-analyze security and not expecting it.
Print the list.

Fixes https://github.com/systemd/systemd/issues/23185
2022-05-01 13:43:01 +09:00
Luca Boccassi
444d9abd06 analyze: fix crash with online security check
1449b0f8a9 fixed seccomp arch check for the offline case,
but broke it for the normal case, as when coming from D-Bus the
list of seccomp architectures is already converted to string.

Fixes https://github.com/systemd/systemd/issues/23224
2022-05-01 11:47:44 +09:00
Lennart Poettering
93a1f57db8 test: test new credential features 2022-04-28 18:12:00 +02:00
Frantisek Sumsal
98f8c31638 test: extend the "hashed" unit names coverage a bit
Follow-up to #22759.
2022-04-23 08:45:25 +09:00
Lennart Poettering
42a3f23cc1 test: also test nspawn system→service inheritance of creds 2022-04-22 11:32:47 +02:00
Lennart Poettering
6d085447fa test: make sure that SetCredential=/LoadCredential fallback won#t regress 2022-04-22 11:32:47 +02:00
Luca Boccassi
3603f15171 nspawn: fix --ephemeral with --machine
Follow-up for 2362fdde1b

When --machine is specified with --ephemeral, no random suffix is added, so
the recently added assert would fail.

Add a top-level variable with the expected file name for nspawn files, and
compute it when the rest of the names are computed.
2022-04-20 02:33:01 +09:00
Luca Boccassi
2362fdde1b nspawn: fix locating config files with --ephemeral
When --ephemeral is used, a random 16 characters suffix is added to the image
name, so matching on .nspawn files based on the image name no longer works.

Fixes https://github.com/systemd/systemd/issues/13297
2022-04-19 06:17:16 +09:00
Frantisek Sumsal
18161cf0ca test: partition the MD device
Also, loop the assemble/disassemble part couple of times to test udev
even harder.

Resolves: #23092
2022-04-17 21:53:12 +09:00
Frantisek Sumsal
6d49e0945f test: cleanup after the MD + LVM test case as well 2022-04-17 16:14:30 +09:00
Yu Watanabe
7be87278a3
Merge pull request #23021 from fbuihuu/tmpfiles-fix-precedence-with-plus-sign
Tmpfiles fix precedence with plus sign
2022-04-16 01:36:51 +09:00
Frantisek Sumsal
d3ce9bed68 test: add a test case for MD + LVM + ext4 2022-04-14 12:54:16 +02:00
Frantisek Sumsal
1bb3887595 test: extend testcase_mdadm_basic() with RAID 5 and 10 2022-04-14 12:45:23 +02:00
Lennart Poettering
4bcf5c11c8
Merge pull request #23011 from mrc0mmand/TEST-64-md
test: add MD-related tests to TEST-64
2022-04-13 22:26:50 +02:00
Michal Sekletar
b26f4f0028 tests: reflect that we can now handle devices with very long sysfs paths 2022-04-13 17:46:52 +02:00
Frantisek Sumsal
3c9af05cae test: add MD-related tests to TEST-64 2022-04-14 00:12:02 +09:00
Franck Bui
402f2b3ce8 test: add test checking tmpfiles conf file precedence 2022-04-11 11:22:39 +02:00
Franck Bui
9f55d48ba5 test tmpfiles: add a test for 'w+' 2022-04-11 11:22:39 +02:00
Michal Sekletar
2ef0101e0b tests: add test case for long unit names 2022-04-08 15:18:29 +02:00
Luca Boccassi
cedf5b1aef core: fix dm-verity auto-discovery in MountImageUnit()
The implementation of MountImageUnit()/systemctl mount-image was
changed to use a /proc/self/fd path as the source, but that causes
the dm-verity files autodiscovery to fail, as it looks for files
in the same directory as the image.

Use the original file path when setting up dm-verity.
2022-04-07 17:31:04 +01:00
Yu Watanabe
70a3ce51f3 test: drop unnecessary use of loop device
To avoid inferences with udevd.
2022-04-07 01:44:39 +09:00
Yu Watanabe
bc6bd62c0e test: use udevadm lock when partitioning block devices
We can use `sfdisk --lock` for these cases, but some CI environments
have old sfdisk which does not support `--lock` option.
2022-04-07 01:42:44 +09:00
Yu Watanabe
3452ae90ea test: --initialized=yes is the default for udevadm wait 2022-04-07 00:40:33 +09:00
Yu Watanabe
14f9c81fb4 test: use udevadm wait and lock
Hopefully fixes #22911.
2022-04-05 05:00:39 +09:00
Frantisek Sumsal
c189d3bd78 test: use the new udevadm wait verb to wait for the loop device
The original workaround didn't work, as `systemd-repart` kept failing
 even when the `/dev/loopX` device was present:

 ```
 [   13.959419] H testsuite-58.sh[280]: + LOOP=/dev/loop1
 [   13.959636] H testsuite-58.sh[280]: + :
 [   13.959764] H testsuite-58.sh[280]: + test -e /dev/loop1
 [   13.959895] H testsuite-58.sh[280]: + break
 [   13.960023] H testsuite-58.sh[280]: + systemd-repart --pretty=yes --definitions=/tmp/testsuite-58-sector/ --seed=750b6cd5c4ae4012a15e7be3c29e6a47 --empty=require --dry-run=no /dev/loop1
 [   13.970538] H testsuite-58.sh[363]: Device '/dev/loop1' has no dm-crypt/dm-verity device, no need to look for underlying block device.
 [   13.970538] H testsuite-58.sh[363]: Failed to determine canonical path for '/dev/loop1': No such file or directory
 [   13.970538] H testsuite-58.sh[363]: Failed to open file or determine backing device of /dev/loop1: No such file or directory
 ```
2022-04-04 15:58:03 +02:00
Yu Watanabe
37ebfe49de
Merge pull request #22926 from bluca/analyze_offline_filter
analyze: fix offline checks for syscall filter and 'native' architecture
2022-04-01 23:43:18 +09:00
Luca Boccassi
1449b0f8a9 analyze: fix offline check for 'native' syscall architecture
Enum values are stored in the set, not strings
2022-04-01 10:42:48 +01:00
Yu Watanabe
e529abe24d test: replace helper_wait_for_dev() with 'udevadm wait' 2022-04-01 15:13:18 +09:00
Yu Watanabe
10176f0011 test: add tests for worker error code 2022-03-30 01:27:29 +09:00
Luca Boccassi
2350712e32 portable: allow reattaching when one image has a version and the other does not
A reattach might go from img.raw to img_0.1.raw or viceversa, but this is
not allowed right now as we try to match the full name.

Also take into account that running strcspn(a, '/') on an image name, without
leading path, will return the length of the full string, but the versions
might be different so they won't match, eg:

img_0.1.raw -> 12
img_0.1.1.raw -> 14

So adjust the check to take that into account, and skip it if we are not
dealing with directories
2022-03-29 14:02:48 +01:00
Frantisek Sumsal
41d1aaea64 test: use flock when calling mkfs.btrfs
As stated in https://github.com/systemd/systemd/issues/21819#issuecomment-1064377645
`mkfs.btrfs` doesn't hold the lock for the whole duration of
`mkfs.btrfs`, thus causing unexpected races & test fails. Let's
wrap the `mkfs.btrfs` calls in an flock wrapper to mitigate this.

Hopefully fixes: #21819
2022-03-25 10:28:07 +09:00
Zbigniew Jędrzejewski-Szmek
74fbb24f64 TEST-68: instead of calling daemon-reload, just use different cleanup units
On a very slow machine, things are executed out-of-order, and something
pins the previously-exited unit. Instead of fighting with this with daemon-reload,
let's just use a different cleanup unit.

Hopefully fixes #22755.
2022-03-24 14:11:54 +01:00
Zbigniew Jędrzejewski-Szmek
6741235430 TEST-68: get rid of unnecessary descriptions
The name of the unit already says all, no need to duplicate this.
And the comments can easily get out of date, as they did.
2022-03-24 13:45:38 +01:00
Frantisek Sumsal
c3d83ff940 test: don't try to execute a non-existing script 2022-03-21 15:55:49 +01:00
Lennart Poettering
7910ec3bcd test: add integration test for sysupdate 2022-03-19 00:13:55 +01:00
Luca Boccassi
1219bd4306 Add tests and documentation for all remaining sandboxing in user manager 2022-03-18 10:09:56 +01:00
Grigori Goronzy
fd8b924820 cryptenroll: add tests for TPM2 unlocking
Add tests for enrolling and unlocking. Various cases are tested:

- Default PCR 7 policy w/o PIN, good and bad cases (wrong PCR)
- PCR 7 + PIN policy, good and bad cases (wrong PCR, wrong PIN)
- Non-default PCR 0+7 policy w/o PIN, good and bad cases (wrong PCR 0)

v2: rename test, fix tss2 library installation, fix CI failures
v3: fix ppc64, load module
2022-03-15 21:17:00 +01:00
Yu Watanabe
6626ea08f6 test: wait for loopback device being actually created
It seems there exists a short time period that we cannot see the
loopback device after `losetup` is finished:
```
testsuite-58.sh[367]: ++ losetup -b 1024 -P --show -f /tmp/testsuite-58-sector-1024.img
kernel: loop1: detected capacity change from 0 to 204800
testsuite-58.sh[285]: + LOOP=/dev/loop1
testsuite-58.sh[285]: + systemd-repart --pretty=yes --definitions=/tmp/testsuite-58-sector/ --seed=750b6cd5c4ae4012a15e7be3c29e6a47 --empty=require --dry-run=no /dev/loop1
testsuite-58.sh[368]: Device '/dev/loop1' has no dm-crypt/dm-verity device, no need to look for underlying block device.
testsuite-58.sh[368]: Failed to determine canonical path for '/dev/loop1': No such file or directory
testsuite-58.sh[368]: Failed to open file or determine backing device of /dev/loop1: No such file or directory
```
2022-03-15 12:35:50 +09:00
Yu Watanabe
8c166c962d test: format disk image through loopback device
It seems that the change on the image file sometimes not propagated on
the loopback device immediately.
2022-03-15 12:35:50 +09:00
Yu Watanabe
cc75e1f7c9 test: use /var/tmp for storing disk images
The Ubuntu CI on ppc64el seems to have a issue on tmpfs, and files
may not be fsynced. See c10caebb98.
For safety, let's use /var/tmp to store disk images.
2022-03-15 12:35:50 +09:00
Luca Boccassi
24759d8f08 core: support ExtensionDirectories in user manager
Unprivileged overlayfs is supported since Linux 5.11. The only
change needed to get ExtensionDirectories to work is to avoid
hard-coding the staging directory to the system manager runtime
directory, everything else just works (TM).
2022-03-10 20:38:10 +00:00
Zbigniew Jędrzejewski-Szmek
a257c941ad manager: pass monitor metadata in more cases
The first ExecStartPre or the first ExecStart commands would get the metadata,
but not the subsequent ones. Also check that we do not pass it in
ExecStartPost.
2022-03-10 14:51:28 +00:00
Zbigniew Jędrzejewski-Szmek
f086cca248 TEST-68: enhance testing of chained commands
The test would fail when the the same handler was used for multiple
*failing* units. We need to call 'reset-failed' to let the manager forget
about the earlier ones.

systemd-analyze log-target console is removed, because it's easier to follow
the logs if logging it to the journal.
2022-03-10 14:51:28 +00:00
Zbigniew Jędrzejewski-Szmek
ff7b9a2693 TEST-68-PROPAGATE-EXIT-STATUS: deobfuscate shell code and fix typo
After the cleanup, it was fairly easy to see the wrong variable name ;)
2022-03-10 14:43:14 +00:00
Luca Boccassi
c19c4ab148 test: cover template OnFailure/OnSuccess handlers in TEST-68-PROPAGATE-EXIT-STATUS 2022-03-10 14:43:14 +00:00
Luca Boccassi
95c81c55b2 core: split $MONITOR_METADATA and return it only if a single unit triggers OnFailure/OnSuccess
Remove the list logic, and simply skip passing metadata if more than one
unit triggered an OnFailure/OnSuccess handler.
Instead of a single env var to loop over, provide each separate item
as its own variable.

Fixes https://github.com/systemd/systemd/issues/22370
2022-03-10 14:43:14 +00:00
Luca Boccassi
ea63a260d4 core: support MountAPIVFS and RootDirectory in user manager
The only piece missing was to somehow make /proc appear in the
new user+mount namespace. It is not possible to mount a new
/proc instance, not even with hidepid=invisible,subset=pid, in
a user namespace unless a PID namespace is created too (and also
at the same time as the other namespaces, it is not possible to
mount a new /proc in a child process that creates a PID namespace
forked from a parent that created a user+mount namespace, it has
to happen at the same time).

Use the host's /proc with a bind-mount as a fallback for this
case. User session services would already run with it, so
nothing is lost.
2022-03-10 10:21:03 +00:00
Luca Boccassi
4c0ab40ab8 test: set log level of user manager in TEST-43 to debug 2022-03-09 02:08:25 +00:00