1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-25 01:34:28 +03:00
Commit Graph

140 Commits

Author SHA1 Message Date
Zbigniew Jędrzejewski-Szmek
63403f07b0 tests: use relative paths in ExecStart= and friends
We want to retain *some* of the full paths in order to test more code paths.
But the default should be to use the command name only. This makes the tests
less visually cluttered.
2024-01-09 11:14:16 +01:00
Luca Boccassi
ae7482b994 core: do not make private /dev/ read-only too soon
The read-only bit is flipped after setting up all the mounts, so that
bind mounts can be added. Remove the early config, and add a unit
test.

Fixes https://github.com/systemd/systemd/issues/30372
2023-12-08 11:09:14 +09:00
Luca Boccassi
f4a35f2ad9 core: do not drop CAP_SETUID if it is in AmbientCapabilities=
Follow-up for 24832d10b6
2023-12-01 10:48:14 +00:00
Iago López Galeiras
e720cebf7c test-execute: add no_new_privs tests for SystemCallFilter
When starting a service with a non-root user and a SystemCallFilter and
other settings (like ProtectClock), the no_new_privs flag should not be set.

Also, test that CapabilityBoundingSet behaves correctly, since we need
to preserve some capabilities to do the seccomp filter and restore the
ones set by the service before executing.
2023-11-07 11:31:53 +01:00
Yu Watanabe
25033cca08 test-execute: check credentials can be read on ExecStartPost= and friends
Prompted by
https://github.com/systemd/systemd/pull/28787#issuecomment-1690614202.
2023-09-07 00:53:28 +09:00
Yu Watanabe
73ff4d48de Revert "core: do not leak mount for credentials directory if mount namespace is enabled"
This reverts commits
- 9ae3624889
  "test-execute: add tests for credentials directory with mount namespace"↲
- 94fe4cf255
  "core: do not leak mount for credentials directory if mount namespace is enabled",
- 7241b9cd72
  "core/credential: make setup_credentials() return path to credentials directory",
- fbaf3b23ae
  "core: set $CREDENTIALS_DIRECTORY only when we set up credentials"

Before the commits, credentials directory set up on ExecStart= was kept
on e.g. ExecStop=. But, with the changes, if a service requests a
private mount namespace, the credentials directory is discarded after
ExecStart= is finished.

Let's revert the change, and find better way later.

Addresses the post-merge comment
https://github.com/systemd/systemd/pull/28787#issuecomment-1690614202.
2023-09-07 00:53:28 +09:00
Yu Watanabe
9ae3624889 test-execute: add tests for credentials directory with mount namespace
This also adds cases that open_tree() and move_mount() are filtered, to
emulate old kernel behavior.
2023-08-22 11:50:20 +09:00
Lennart Poettering
f9c91932b4 execute: add support for XDG_STATE_HOME for placing service state data in --user mode
This adds support for the new XDG_STATE_HOME env var that was added to
the xdg basedir spec. Previously, because the basedir spec didn't know
the concept we'd alias the backing dir for StateDirectory= to the one
for ConfigurationDirectory= when runnin in --user mode. With this change
we'll make separate. This brings us various benefits, such as proper
"systemctl clean" support, where we can clear service state separately
from service configuration, now in user mode too.

This does not come without complications: retaining compatibility with
older setups is difficult, because we cannot possibly identitfy which
files in existing populated config dirs are actually "state" and which
one are true" configuration.

Hence let's deal with this pragmatically: if we detect that a service
that has both dirs configured only has the configuration dir existing,
then symlink the state dir to the configuration dir to retain
compatibility.

This is not great, but it's the only somewhat reasonable way out I can
see.

Fixes: #25739
2023-06-28 22:01:55 +02:00
Luca Boccassi
71588cb6ad test-execute: add unit tests for *DirectorySymlink= 2023-06-08 23:11:42 +01:00
Zbigniew Jędrzejewski-Szmek
b370f050f8 test-execute: use bash instead of perl
I think this is easier to grok too.
2023-05-09 08:11:10 +02:00
Yu Watanabe
600ed5c242 test-execute: add test for NetworkNamespacePath=
Prompted by https://github.com/systemd/systemd/issues/26422#issuecomment-1435772839.
2023-03-04 02:50:15 +09:00
Yu Watanabe
c9a2563225 test-execute: simplify the tests for PrivateNetwork=
If an exotic network driver is loaded, there may exist an unexpected
network interface.
2023-03-04 02:49:13 +09:00
Yu Watanabe
752e92615d test-execute: add test for PrivateNetwork= with/without mount namespacing 2023-02-23 15:09:13 +09:00
Yu Watanabe
b7cca6cc5a test-execute: add basic tests for LoadCredential= and SetCredential= 2023-02-15 10:10:54 +09:00
Yu Watanabe
4e032f654b test-execute: drop capabilities when testing with user manager
Before this, tests are split into two categories, system and user, but
both are running in fully privileged environment. Hence, unprivileged
user scope was mostly not covered by the test.

Let's run all tests in both system and user scopes, and drop capabilities
when Manager is running in user scope.

This also makes the host environment protected more from the test run.
2023-02-15 10:10:54 +09:00
Zbigniew Jędrzejewski-Szmek
7a17e41dcf test: drop whitespace after shell redirection operators
(The one case that is left unchanged is '< <(subcommand)'.)

This way, the style with no gap was already dominant. This way, the reader
immediately knows that ' < ' is a comparison operator and ' << ' is a shift.

In a few cases, replace custom EOF replacement by just EOF. There is no point
in using someting like "_EOL" unless "EOF" appears in the text.
2023-02-06 09:19:04 +01:00
Franck Bui
09415aef94 tests: minor simplification in test-execute
No functional change.
2022-11-04 12:53:17 +01:00
Franck Bui
d723b0467d tests: make test-execute pass on openSUSE
In my understanding user group "3" (aka "sys") is kept for historical reasons
but not really useful these days. That's probably explained why this group
isn't defined on openSUSE.

Hence let's drop reference to this user group, this shouldn't lessen the
revelance of the test since SupplementaryGroups= is still tested with 2 other
groups.
2022-11-04 12:39:56 +01:00
Luca Boccassi
345a809f21 test-execute: do not fail if machine-id is missing
When building in a chroot there might not be any machine-id
2022-10-25 16:00:26 +01:00
Yu Watanabe
f01f70a9a3 test: add more tests for StateDirectory= with DynamicUser=
This also moves the check for writable paths from test-execute to TEST-34.

Closes #10337.
2022-10-03 09:25:00 +09:00
Zbigniew Jędrzejewski-Szmek
8a7adccbdb various: try to use DEFAULT_USER_SHELL for root too
/bin/sh as a shell is punishing. There is no good reason to make
the occasional root login unpleasant.

Since /bin/sh is usually /bin/bash in compat mode, i.e. if one is
available, the other will be too, /bin/bash is almost as good as a default.
But to avoid a regression in the situation where /bin/bash (or
DEFAULT_USER_SHELL) is not installed, we check with access() and fall back
to /bin/sh. This should make this change in behaviour less risky.

(FWIW, e.g. Fedora/RHEL use /bin/bash as default for root.)

This is a follow-up of sorts for 53350c7bba,
which added the default-user-shell option, but most likely with the idea
of using /bin/bash less ;)

Fixes #24369.
2022-08-24 10:02:46 +02:00
Luca Boccassi
646cba5c42 test: ignore LXC filesystem when checking for writable locations
test-execute checks that only /var/lib/private/waldo is writable, but there are
some filesystems that are always writable and excluded. Add /sys/devices/system/cpu
which is created by lxcfs.

Fixes https://github.com/systemd/systemd/issues/23263
2022-05-11 17:11:41 +02:00
Frantisek Sumsal
43b9b2053c core: add %d specifier for the $CREDENTIALS_DIRECTORY
Resolves: #22549
2022-03-17 17:45:01 +01:00
Xiaotian Wu
646b01121a test: add LoongArch 64bit testcase 2021-12-22 11:07:56 +08:00
Lennart Poettering
d9b8771108 test: make test-execute pass on Linux 5.15
Linux 5.15 broke kernel API:

e70344c059

Previously setting IOPRIO_CLASS_NONE for a process would then report
IOPRIO_CLASS_NONE back. But since 5.15 it reports IOPRIO_CLASS_BE
instead. Since IOPRIO_CLASS_NONE is an alias for a special setting of
IOPRIO_CLASS_BE this makes some sense, but it's also a kernel API
breakage that our testsuite trips up on.

(I made some minimal effort to inform the kernel people about this API
breakage during the 5.15 rc phase, but noone was interested.)

Either way let's hadle this gracefully in our test suite and accept
"best-effort" too when "none" was set.

(This is only triggable if the tests are run on 5.15 with full privs)
2021-11-24 16:15:14 +01:00
Lennart Poettering
875afa02fa tests: add test case for UMask=+BindPaths= combination
Inspired by the test case described in #19899
2021-11-12 16:02:26 +01:00
Zbigniew Jędrzejewski-Szmek
22d3cfe54c tests: add spdx license header to test unit/link/network/conf files
Those are all consumed by our parser, so they all support comments.
I was considering whether they should have a license header at all,
but in the end I decided to add it because those files are often created
by copying parts of real unit files. And if the real ones have a license,
then those might as well. It's easier to add it than to make an exception.
2021-10-18 09:04:45 +02:00
Benjamin Berg
e975a94559 test: Add failing/non-failing syscall filter test setting architecture
This adds a high level test verifying that syscall filtering in
combination with a simple architecture filter for the "native"
architecture works fine.
2021-09-30 08:06:25 +09:00
alexlzhu
8c35c10d20 core: Add ExecSearchPath parameter to specify the directory relative to which binaries executed by Exec*= should be found
Currently there does not exist a way to specify a path relative to which
all binaries executed by Exec should be found. The only way is to
specify the absolute path.

This change implements the functionality to specify a path relative to which
binaries executed by Exec*= can be found.

Closes #6308
2021-09-28 14:52:27 +01:00
Yu Watanabe
42867dfeef test-execute: add a testcase for MountAPIVFS=no 2021-08-26 02:54:37 +09:00
Zbigniew Jędrzejewski-Szmek
0ee994836c TEST-*: use spacing before redirection operator, but not after
<< EOF → <<EOF
> foo < bar → >foo <bar
2021-04-08 20:21:50 +02:00
Yu Watanabe
a62f651b32 test: add one more test for system call filter with errno 2021-03-08 21:28:42 +09:00
Topi Miettinen
ddc155b2fd New directives NoExecPaths= ExecPaths=
Implement directives `NoExecPaths=` and `ExecPaths=` to control `MS_NOEXEC`
mount flag for the file system tree. This can be used to implement file system
W^X policies, and for example with allow-listing mode (NoExecPaths=/) a
compromised service would not be able to execute a shell, if that was not
explicitly allowed.

Example:
[Service]
NoExecPaths=/
ExecPaths=/usr/bin/daemon /usr/lib64 /usr/lib

Closes: #17942.
2021-01-29 12:40:52 +00:00
Lucas Werkmeister
58b65c6d6d test: fix exec-standardoutput-truncate test
The cmp in ExecStartPost= was actually failing – ExecStartPost= has the
same StandardOutput as the rest of the service, so the output file is
truncated before cmp can compare it with the expected output – but the
test still passed because test_exec_standardoutput_truncate() calls
test(), which only checks the main result, rather than test_service(),
which checks the result of the whole service. Fix the test by merging
the ExecStartPost= into the ExecStart= – the cmp has to be part of the
same command line as the cat so that the file is not truncated between
the two processes.
2021-01-15 20:22:29 +01:00
Lucas Werkmeister
8d7dab1fda Add truncate: to StandardOutput= etc.
This adds the ability to specify truncate:PATH for StandardOutput= and
StandardError=, similar to the existing append:PATH. The code is mostly
copied from the related append: code. Fixes #8983.
2021-01-15 09:54:50 +01:00
Zbigniew Jędrzejewski-Szmek
f98ca3a11d test-execute: make sure shell execs the child
echo is a built-in, so we were testing execve in our own code, and not in
the running child.
2020-11-06 15:20:34 +01:00
Yu Watanabe
e4c01fe6af test: add test cases for RuntimeDirectoryPreserve=yes 2020-09-18 13:11:39 +02:00
Topi Miettinen
005bfaf118 exec: Add kill action to system call filters
Define explicit action "kill" for SystemCallErrorNumber=.

In addition to errno code, allow specifying "kill" as action for
SystemCallFilter=.

---
v7: seccomp_parse_errno_or_action() returns -EINVAL if !HAVE_SECCOMP
v6: use streq_ptr(), let errno_to_name() handle bad values, kill processes,
 init syscall_errno
v5: actually use seccomp_errno_or_action_to_string(), don't fail bus unit
parsing without seccomp
v4: fix build without seccomp
v3: drop log action
v2: action -> number
2020-09-15 12:54:17 +03:00
Zbigniew Jędrzejewski-Szmek
0b3861d224 test-execute/exec-dynamicuser-statedir.service: fix quoting
All backslashes that should be single in shell syntax need to be written as "\\" because
our parser will remove one level of quoting. Also, single quotes were doubly nested, which
cannot work.

Should fix the following message:
test-execute/exec-dynamicuser-statedir.service:16: Ignoring unknown escape sequences: "test $$(find / \( -path /var/tmp -o -path /tmp -o -path /proc -o -path /dev/mqueue -o -path /dev/shm -o -path /sys/fs/bpf -o -path /dev/.lxc \) -prune -o -type d -writable -print 2>/dev/null | sort -u | tr -d \\n) = /var/lib/private/quux/pief/var/lib/private/waldo"
2020-09-04 18:11:22 +02:00
Lennart Poettering
6b000af4f2 tree-wide: avoid some loaded terms
https://tools.ietf.org/html/draft-knodel-terminology-02
https://lwn.net/Articles/823224/

This gets rid of most but not occasions of these loaded terms:

1. scsi_id and friends are something that is supposed to be removed from
   our tree (see #7594)

2. The test suite defines an API used by the ubuntu CI. We can remove
   this too later, but this needs to be done in sync with the ubuntu CI.

3. In some cases the terms are part of APIs we call or where we expose
   concepts the kernel names the way it names them. (In particular all
   remaining uses of the word "slave" in our codebase are like this,
   it's used by the POSIX PTY layer, by the network subsystem, the mount
   API and the block device subsystem). Getting rid of the term in these
   contexts would mean doing some major fixes of the kernel ABI first.

Regarding the replacements: when whitelist/blacklist is used as noun we
replace with with allow list/deny list, and when used as verb with
allow-list/deny-list.
2020-06-25 09:00:19 +02:00
Michal Koutný
9acb2964d7 test: Simplify hostname checking
Both hostname and uname utilities boil down to uname(2) syscall. Reduce
tests dependency footprint by using uname for checking hostname too.
2020-04-22 10:35:12 +02:00
Frantisek Sumsal
e9cdcbed77 test: ignore IAB capabilities in test-execute
libcap v2.33 introduces a new capability set called IAB[0] which is shown
in the output of `capsh --print` and interferes with the test checks. Let's
drop the IAB set from the output, for now, to mitigate this.

This could be (and probably should be) replaced in the future by the
newly introduced testing options[1][2] in libcap v2.32, namely:
    --has-p=xxx
    --has-i=xxx
    --has-a=xxx

but this needs to wait until the respective libcap version gets a wider
adoption. Until then, let's stick with the relatively ugly sed.

Fixes: #15046

[0] https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=943b011b5e53624eb9cab4e96c1985326e077cdd
[1] https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=588d0439cb6495b03f0ab9f213f0b6b339e7d4b7
[2] https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=e7709bbc1c4712f2ddfc6e6f42892928a8a03782
2020-03-09 18:22:16 +01:00
Nate Jones
ecf63c9102 execute: Make '+' exec prefix ignore PrivateTmp=yes
The man pages state that the '+' prefix in Exec* directives should
ignore filesystem namespacing options such as PrivateTmp. Now it does.

This is very similar to #8842, just with PrivateTmp instead of
PrivateDevices.
2020-02-29 19:32:01 +09:00
Frantisek Sumsal
9569e38503 test: adapt to the new capsh format
Since libcap v2.29 the format of cap_to_text() has been changed which
makes certain `test-execute` subtest fail. Let's remove the offending
part of the output (dropped capabilities) to make it compatible with
both the old and the new libcap.
2020-02-05 10:11:42 +01:00
Lennart Poettering
e56a8790a0 test: add test for https://github.com/systemd/systemd/issues/14560 2020-01-20 17:19:51 +01:00
Anita Zhang
b6657e2c53 test: add test case for PrivateDevices=y and Group=daemon
For root, group enforcement needs to come after PrivateDevices=y set up
according to 096424d123. Add a test to
verify this is the case.
2019-12-18 11:09:30 -08:00
Lennart Poettering
4e67759960 core: be more lenient when checking whether sandboxing is necessary
In some containers unshare() is made unavailable entirely. Let's deal
with this that more gracefully and disable our sandboxing of services
then, so that we work in a container, under the assumption the container
manager is then responsible for sandboxing if we can't do it ourselves.

Previously, we'd insist on sandboxing as soon as any form of BindPath=
is used. With this change we only insist on it if we have a setting like
that where source and destination differ, i.e. there's a mapping
established that actually rearranges things, and thus would result in
systematically different behaviour if skipped (as opposed to mappings
that just make stuff read-only/writable that otherwise arent').

(Let's also update a test that intended to test for this behaviour with
a more specific configuration that still triggers the behaviour with
this change in place)

Fixes: #13955

(For testing purposes unshare() can easily be blocked with
systemd-nspawn --system-call-filter=~unshare.)
2019-11-20 12:30:04 +01:00
Kevin Kuehler
07cab0f72b tests: Add capability tests for ProtectKernelLogs 2019-11-11 12:12:02 -08:00
Balint Reczey
bd89d03544 test: Pass personality test even when i686 userland runs on x86_64 kernel 2019-10-10 00:52:16 +01:00
Balint Reczey
f6084ab0e2 test-execute: Filter /dev/.lxc in exec-dynamicuser-statedir.service
It appears in nested LXC containers and broke the test in Ubuntu CI.

BugLink: https://bugs.launchpad.net/bugs/1845337
2019-10-04 11:56:29 +02:00