1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-23 21:35:11 +03:00
Commit Graph

118 Commits

Author SHA1 Message Date
Lennart Poettering
b294e5943f core: introduce specifiers for /tmp and /var/tmp
This corresponds nicely with the specifiers we already pass for
/var/lib, /var/cache, /run and so on.

This is particular useful to update the test-path service files to
operate without guessable files, thus allowing multiple parallel
test-path invocations to pass without issues (the idea is to set $TMPDIR
early on in the test to some private directory, and then only use the
new %T or %V specifier to refer to it).
2018-05-29 11:39:15 +02:00
Lennart Poettering
cdc0f9be92
Merge pull request #8817 from yuwata/cleanup-nsflags
core: allow to specify RestrictNamespaces= multiple times
2018-05-24 16:49:13 +02:00
Yu Watanabe
1c5873096e test-execute: remove state directories before running tests
Fixes #8679.
2018-05-10 22:50:51 -07:00
Joost Heitbrink
b6887d7ae4 test: add testcase for environment file variables with backslashes
systemd silently strips out backslashes in variables from environment
files. Add a testcase that explicitly tests for this behaviour.
2018-05-11 13:15:16 +09:00
Yu Watanabe
1dcf96c29f test: add tests for merging RestrictNamespaces= 2018-05-05 11:07:37 +09:00
Yu Watanabe
9c6f2e5ab9 test: fix descriptions 2018-05-01 13:44:29 +09:00
Yu Watanabe
cfa24ca0e6 test: add tests for PrivateDevices= with '+' prefix 2018-05-01 13:44:24 +09:00
Yu Watanabe
545673d4b0 test: add tests for %j and %J specifier in test-execute (#8838)
Follow-up for 250e9fadbc.
2018-04-27 13:07:23 +02:00
Lennart Poettering
63d6135fea tests: compare with correct shell
We synthesize the passwd record for UID 0, hence we need to compare with
our synthesized data and not with the data stored in /etc/passwd
2018-04-19 11:41:28 +02:00
Zbigniew Jędrzejewski-Szmek
7e4a49b42b test-execute: make find invocation a bit more efficent, increase timeout
We go through the whole file system, so this test can take arbitrary time.  But
this test is still quite useful, so let's at least try to make it more efficent
by not descending at all into the directories we would filter out later on
anyway.

Also increase the timeout, in case the previous step doesn't help enough.
2018-04-16 16:09:46 +02:00
Zbigniew Jędrzejewski-Szmek
42345b178d test: drop the use of /bin/sh in various test services
This is not meant to be comprehensive, just the few cases where the /bin/sh -c wrapper
is obviously superfluous.
2018-04-16 16:09:46 +02:00
Zbigniew Jędrzejewski-Szmek
5008da1ec1 systemd: do not require absolute paths in ExecStart
Absolute paths make everything simple and quick, but sometimes this requirement
can be annoying. A good example is calling 'test', which will be located in
/usr/bin/ or /bin depending on the distro. The need the provide the full path
makes it harder a portable unit file in such cases.

This patch uses a fixed search path (DEFAULT_PATH which was already used as the
default value of $PATH), and if a non-absolute file name is found, it is
immediately resolved to a full path using this search path when the unit is
loaded. After that, everything behaves as if an absolute path was specified. In
particular, the executable must exist when the unit is loaded.
2018-04-16 16:09:46 +02:00
Zbigniew Jędrzejewski-Szmek
c0af656c52 test-execute/exec-specifier.service: fix quoting
The lines would cause the whole service to fail to be loaded.
2018-04-12 16:20:02 +02:00
Feng Sun
709e86f18f fix missed bracket of exec-personality-ppc64le.service (#8650)
Signed-off-by: Neil Sun <neilsun@yunify.com>
2018-04-04 11:10:42 +02:00
Zbigniew Jędrzejewski-Szmek
a5935c6601 test-execute: skip exec-specifier-interpolation if perl is missing 2018-03-22 15:57:56 +01:00
Zbigniew Jędrzejewski-Szmek
6b08180ca6 test-execute: allow sit0@ to exist in private network namespace
It's always visible:

$ sudo modprobe sit
$ sudo unshare -n ip l
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    ...
2: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    ...
2018-03-22 15:57:56 +01:00
Zbigniew Jędrzejewski-Szmek
c725631f4b test-execute: simplify checks if grep output is empty
grep already indicates if it matched anything by return value.
Additional advantage is then that if the test fails, the unexpected
matching lines are visible in the log output.
2018-03-22 15:57:56 +01:00
Filipe Brandenburger
9b796f3523 test-execute: Introduce tests for environment values containing newlines
Also fix one case where the presence of a newline was used to generate
an invalid environment assignment.

Tested: with mkosi, which builds the local tree and run ninja tests.
2018-03-16 16:31:17 -07:00
Yu Watanabe
e5ba1d324d test-execute: use CAP_CHOWN instead of CAP_NET_ADMIN
CAP_NET_ADMIN is somtrimes dropped by container runtime.
This changes to use CAP_CHOWN instead of CAP_NET_ADMIN, as it is
less likely to be dropped.
2018-03-05 00:02:22 +09:00
Yu Watanabe
b6dc25eebc test-execute: rename tests for AmbientCapabilities=
The unit files for test-execute are named like
`exec-(setting-name-in-lower-character)-(optional-text).service`.
However, test units for AmbientCapabilities= are not following this.
So, let's rename them for the consistency.
This does not change anything in the functionality of the test.
2018-03-04 16:37:58 +09:00
Yu Watanabe
69b0740785 test-execute: add tests with user/group daemon
The nobody user/group may not synthesized by systemd.
To run tests the functionalities in such situation, this adds tests
by user/group by daemon, as it is expected to exists all environments.
2018-03-02 16:42:53 +09:00
Yu Watanabe
d2f95a223f test-execute: add a test for the case that NOBODY_GROUP_NAME is nogroup 2018-03-01 18:31:26 +09:00
Yu Watanabe
4c40f267c7 test: use "$$" to pass a literal dollar sign
Follow-up for 9323298657.
2018-02-26 12:50:07 +09:00
Yu Watanabe
ac1f08b92b test: use setup_fake_runtime_dir() in test-execute 2018-02-26 12:50:03 +09:00
Lennart Poettering
72a1db0bb2 test: don't complain if bpffs is world-writable
Apparently, world-writable bpffs is intended by the kernel folks, hence
let's make sure we don't choke on it on our tests.
2018-02-21 16:43:36 +01:00
Yu Watanabe
9323298657 test: fix test for TemporaryFileSystem= (#8241)
This makes test-execute work on SELinux enabled systems.

Fixes the issue reported at
https://github.com/systemd/systemd/pull/7908#discussion_r169583540
2018-02-21 16:43:35 +01:00
Yu Watanabe
4cac89bd7c test: add tests for TemporaryFileSystem= 2018-02-21 09:18:14 +09:00
Lennart Poettering
66d73cc728 test-execute: use the "nogroup" group if it exists for testing
We currently look for "nobody" and "nfsnobody" when testing groups, both
of which do not exist on Ubuntu, our main testing environment. Let's
extend the tests slightly to also use "nogroup" if it exists.
2017-12-06 13:40:50 +01:00
Yu Watanabe
4e79aeaa65 test-execute: add tests for CPUAffinity= 2017-12-06 10:44:20 +09:00
Yu Watanabe
028f3a7f9c test-execute: add test for that DynamicUser= migrate StateDirectory=
Test for 949befd3f0.
2017-12-06 00:37:09 +09:00
Yu Watanabe
f0e018e748 test-execute: cleanup
This makes rename the test units by a consistent naming scheme,
add several logs, and sort internal functions.
No functional change.
2017-12-06 00:36:55 +09:00
Yu Watanabe
8b3c4b5757 test-execute: test more % specifiers (#7450) 2017-11-24 10:17:28 +01:00
Lennart Poettering
666d787787 test: add basic test for StandardInput=file: 2017-11-17 11:13:44 +01:00
Lennart Poettering
da543f6a77 test: add tests for StandardInputText= and StandardInputData= 2017-11-17 11:13:44 +01:00
Yu Watanabe
7f749487c5 test-execute: change path to python3 (#7306)
Change python3 path from /bin/python3 to /usr/bin/python3 to make
the test work on Ubuntu Xenial.

Follow-up for #7178.
2017-11-12 16:09:00 +01:00
Yu Watanabe
7a18854fe7 test-execute: update test for SystemCallErrorNumber= 2017-11-11 21:54:29 +09:00
Yu Watanabe
b4891260b9 test: add tests for syscall:errno style in SystemCallFilter= 2017-11-11 21:54:20 +09:00
Yu Watanabe
23fd04e92d test: add test for ReadOnlyPaths= with RuntimeDirectory= 2017-11-08 15:48:32 +09:00
Lennart Poettering
9672b58398 test: add simple test for validating some of the unit specifiers we support
(Also, sort list of test unit files in meson.build alphabetically, to
make future additions more systematic)
2017-10-26 18:01:04 +02:00
Yu Watanabe
038a373651 test-execute: always use /bin/sh 2017-10-12 13:26:39 +09:00
Yu Watanabe
d053b72bdd test: add test for BindPaths= and BindReadOnlyPaths=
Follow-up for a8cabc612b.
2017-10-12 13:25:06 +09:00
Lennart Poettering
8adb3d63e6 test: add test for DynamicUser= + StateDirectory=
Also, tests for DynamicUser= should really run for system mode, as we
allocate from a system resource.

(This also increases the test timeout to 2min. If one of our tests
really hangs then waiting for 2min longer doesn't hurt either. The old
2s is really short, given that we run in potentially slow VM
environments for this test. This becomes noticable when the slow "find"
command this adds is triggered)
2017-10-02 17:41:44 +02:00
Lennart Poettering
42cc99d5ec test: add test case for UnsetEnvironment= 2017-09-14 15:17:40 +02:00
Timothée Ravier
c090d74dd9 test: ensure 'InaccessiblePaths=/proc' option works (#6017)
Test case for PR #5985.
2017-05-25 07:47:08 +03:00
Evgeny Vereshchagin
b8d79b4b68 tests: stop creating /TEST (#5943)
Closes #5856.
2017-05-11 18:56:39 -04:00
Lennart Poettering
6818c54ca6 core: skip ReadOnlyPaths= and other permission-related mounts on PermissionsStartOnly= (#5309)
ReadOnlyPaths=, ProtectHome=, InaccessiblePaths= and ProtectSystem= are
about restricting access and little more, hence they should be disabled
if PermissionsStartOnly= is used or ExecStart= lines are prefixed with a
"+". Do that.

(Note that we will still create namespaces and stuff, since that's about
a lot more than just permissions. We'll simply disable the effect of
the four options mentioned above, but nothing else mount related.)

This also adds a test for this, to ensure this works as intended.

No documentation updates, as the documentation are already vague enough
to support the new behaviour ("If true, the permission-related execution
options…"). We could clarify this further, but I think we might want to
extend the switches' behaviour a bit more in future, hence leave it at
this for now.

Fixes: #5308
2017-02-12 00:44:46 -05:00
Michal Sekletar
01349f5d01 tests: fix failure of test-execute if /dev/mem is not available (#5028)
/dev/mem isn't necessarily available. Recently, I've encountered arm64
systems that didn't provide raw memory access via /dev/mem. Instead,
let's use /dev/kmsg since we don't support systems w/o it anyway.
2017-01-06 10:27:35 +01:00
Djalal Harouni
97e60383c0 test: add tests for RestrictNamespaces= 2016-11-15 15:50:19 +01:00
Djalal Harouni
5c67067f0e test: test DynamicUser= with SupplementaryGroups= 2016-11-03 08:38:28 +01:00
Djalal Harouni
2b9ac11ed9 test: test DynamicUser= with a fixed user 2016-11-03 08:37:15 +01:00
Djalal Harouni
50ca7a35a1 test: lets add more tests to cover SupplementaryGroups= cases. 2016-10-24 12:38:53 +02:00
Djalal Harouni
bf9ace96fc test: add more tests for SupplementaryGroups= 2016-10-23 23:27:16 +02:00
Djalal Harouni
86b838eaa3 test: Add simple test for supplementary groups 2016-10-23 23:27:14 +02:00
Djalal Harouni
4982dbcc30 test: add test to make sure that ProtectKernelModules=yes disconnect mount propagation 2016-10-12 14:12:36 +02:00
Djalal Harouni
625d8769fa test: add test to make sure that CAP_SYS_RAWIO was removed on PrivateDevices=yes 2016-10-12 13:47:59 +02:00
Djalal Harouni
3ae33295f0 test: add capability tests for ProtectKernelModules=
This just adds capabilities test.
2016-10-12 13:36:27 +02:00
Djalal Harouni
cdfbd1fb26 test: make sure that {readonly|inaccessible|readwrite}paths disconnect mount propagation
Better safe.
2016-09-27 09:24:46 +02:00
Djalal Harouni
f78b36f016 test: add tests for simple ReadOnlyPaths= case 2016-09-27 09:24:43 +02:00
Djalal Harouni
615a1f4b26 test: add CAP_MKNOD tests for PrivateDevices= 2016-09-25 13:04:30 +02:00
Jan Synacek
1259186355 test: fix test-execute personality tests on ppc64 and aarch64 (#3825) 2016-08-02 16:22:56 +02:00
Ronny Chevalier
50f130c286 test-execute: add nfsnobody alternative as a nobody user 2016-02-28 15:00:18 +01:00
Ronny Chevalier
19c0b0b9a5 core: set NoNewPrivileges for seccomp if we don't have CAP_SYS_ADMIN
The manpage of seccomp specify that using seccomp with
SECCOMP_SET_MODE_FILTER will return EACCES if the caller do not have
CAP_SYS_ADMIN set, or if the no_new_privileges bit is not set. Hence,
without NoNewPrivilege set, it is impossible to use a SystemCall*
directive with a User directive set in system mode.

Now, NoNewPrivileges is set if we are in user mode, or if we are in
system mode and we don't have CAP_SYS_ADMIN, and SystemCall*
directives are used.
2016-02-28 14:44:26 +01:00
Evgeny Vereshchagin
252549990f tests: add test for https://github.com/systemd/systemd/issues/2637
+ perl -e 'exit(!(qq{0} eq qq{\x25U}))'
exec-spec-interpolation.service: Main process exited, code=exited, status=1/FAILURE
exec-spec-interpolation.service: Unit entered failed state.
exec-spec-interpolation.service: Failed with result 'exit-code'.
        PID: 11270
        Start Timestamp: Wed 2016-02-17 22:21:31 UTC
        Exit Timestamp: Wed 2016-02-17 22:21:31 UTC
        Exit Code: exited
        Exit Status: 1
Assertion 'service->main_exec_status.status == status_expected' failed at src/test/test-execute.c:65, function check(). Aborting.
2016-02-17 22:40:26 +00:00
Ismo Puustinen
70d7aea5c7 tests: test ambient capabilities.
The ambient capability tests are only run if the kernel has support for
ambient capabilities.
2016-01-12 12:14:50 +02:00
Filipe Brandenburger
4c80d201ac test-execute: Add tests for new PassEnvironment= directive
Check the base case, plus erasing the list, listing the same variable
name more than once and when variables are absent from the manager
execution environment.

Confirmed that `sudo ./test-execute` passes and that modifying the test
cases (or the values of the set variables in test-execute.c) is enough
to make the test cases fail.
2015-11-11 07:55:23 -08:00
Filipe Brandenburger
cdaf507048 test-execute: Fix systemd escaping and shell issues
In most cases, systemd requires escaping $ (for systemd variable
substitution) and % (for specifiers) by doubling them. This was somewhat
of an issue in tests like exec-environment*.service where systemd was
doing the substitutions and we were not really checking that those were
available in the actual environment of the command. Fix that.

Expressions such as `exit $(test ...)` are incorrect. They only work
because $(test ...) will produce no output, so the command will become a
bare "exit" which will exit with the status of the latest executed
command which turns out to be the test... The direct approach is simply
calling "test" as the last command, for which the shell will propagate
the exit status.

One situation where this was breaking tests was on `exit $(test ...) &&
$(test ...) && $(test ...)` where the second and third tests were not
really executing, since the first command is actually `exit` so && was
doing nothing there. Fixed it by just using `test ... && test ... &&
test ...` as it was initially intended.

Pass -x to all shell executions for them to produce useful debugging
output to stderr. Consequently, removed most of the explicit `echo`s
that are no longer needed.

Mark all units as Type=oneshot explicitly.

Also made sure all shell variables are properly quoted.

v2: Added an explicit LC_ALL=C to ionice invocations since some locales
(such as French) will add a space before the colon in the output.

Tested by running `sudo ./test-execute` and confirming all tests enabled
on my system (essentially all of them except for the s390 one) passed.
Tweaked the variables or options or expected values and confirmed the
tests do indeed fail when the values are not exactly the expected ones.

v2: Also tested with `LANG=fr_FR.UTF-8 sudo ./test-execute` to confirm
it still works in a different locale.
2015-11-10 07:58:29 -08:00
Evgeny Vereshchagin
64810140a1 test-execute: don't use /usr/bin/uname. use sh and PATH 2015-11-06 15:45:32 +00:00
Ronny Chevalier
ac40081621 test-execute: move all files related to a specific directory
To avoid polluting test/
2015-10-31 15:07:19 +01:00