src/test/test-execute.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <stdio.h>
   4 #include <sys/prctl.h>
   5 #include <sys/types.h>
   6
   7 #include "capability-util.h"
   8 #include "cpu-set-util.h"
   9 #include "errno-list.h"
  10 #include "fileio.h"
  11 #include "fs-util.h"
  12 #include "macro.h"
  13 #include "manager.h"
  14 #include "missing_prctl.h"
  15 #include "mkdir.h"
  16 #include "path-util.h"
  17 #include "rm-rf.h"
  18 #if HAVE_SECCOMP
  19 #include "seccomp-util.h"
  20 #endif
  21 #include "service.h"
  22 #include "stat-util.h"
  23 #include "tests.h"
  24 #include "unit.h"
  25 #include "user-util.h"
  26 #include "util.h"
  27 #include "virt.h"
  28
  29 static bool can_unshare;
  30
  31 typedef void (*test_function_t)(Manager *m);
  32
  33 static int cld_dumped_to_killed(int code) {
  34         /* Depending on the system, seccomp version, … some signals might result in dumping, others in plain
  35          * killing. Let's ignore the difference here, and map both cases to CLD_KILLED */
  36         return code == CLD_DUMPED ? CLD_KILLED : code;
  37 }
  38
  39 _unused_ static bool is_run_on_travis_ci(void) {
  40         /* https://docs.travis-ci.com/user/environment-variables#default-environment-variables */
  41         return streq_ptr(getenv("TRAVIS"), "true");
  42 }
  43
  44 static void wait_for_service_finish(Manager *m, Unit *unit) {
  45         Service *service = NULL;
  46         usec_t ts;
  47         usec_t timeout = 2 * USEC_PER_MINUTE;
  48
  49         assert_se(m);
  50         assert_se(unit);
  51
  52         service = SERVICE(unit);
  53         printf("%s\n", unit->id);
  54         exec_context_dump(&service->exec_context, stdout, "\t");
  55         ts = now(CLOCK_MONOTONIC);
  56         while (!IN_SET(service->state, SERVICE_DEAD, SERVICE_FAILED)) {
  57                 int r;
  58                 usec_t n;
  59
  60                 r = sd_event_run(m->event, 100 * USEC_PER_MSEC);
  61                 assert_se(r >= 0);
  62
  63                 n = now(CLOCK_MONOTONIC);
  64                 if (ts + timeout < n) {
  65                         log_error("Test timeout when testing %s", unit->id);
  66                         r = unit_kill(unit, KILL_ALL, SIGKILL, NULL);
  67                         if (r < 0)
  68                                 log_error_errno(r, "Failed to kill %s: %m", unit->id);
  69                         exit(EXIT_FAILURE);
  70                 }
  71         }
  72 }
  73
  74 static void check_main_result(const char *func, Manager *m, Unit *unit, int status_expected, int code_expected) {
  75         Service *service = NULL;
  76
  77         assert_se(m);
  78         assert_se(unit);
  79
  80         wait_for_service_finish(m, unit);
  81
  82         service = SERVICE(unit);
  83         exec_status_dump(&service->main_exec_status, stdout, "\t");
  84
  85         if (cld_dumped_to_killed(service->main_exec_status.code) != cld_dumped_to_killed(code_expected)) {
  86                 log_error("%s: %s: exit code %d, expected %d",
  87                           func, unit->id,
  88                           service->main_exec_status.code, code_expected);
  89                 abort();
  90         }
  91
  92         if (service->main_exec_status.status != status_expected) {
  93                 log_error("%s: %s: exit status %d, expected %d",
  94                           func, unit->id,
  95                           service->main_exec_status.status, status_expected);
  96                 abort();
  97         }
  98 }
  99
 100 static void check_service_result(const char *func, Manager *m, Unit *unit, ServiceResult result_expected) {
 101         Service *service = NULL;
 102
 103         assert_se(m);
 104         assert_se(unit);
 105
 106         wait_for_service_finish(m, unit);
 107
 108         service = SERVICE(unit);
 109
 110         if (service->result != result_expected) {
 111                 log_error("%s: %s: service end result %s, expected %s",
 112                           func, unit->id,
 113                           service_result_to_string(service->result),
 114                           service_result_to_string(result_expected));
 115                 abort();
 116         }
 117 }
 118
 119 static bool check_nobody_user_and_group(void) {
 120         static int cache = -1;
 121         struct passwd *p;
 122         struct group *g;
 123
 124         if (cache >= 0)
 125                 return !!cache;
 126
 127         if (!synthesize_nobody())
 128                 goto invalid;
 129
 130         p = getpwnam(NOBODY_USER_NAME);
 131         if (!p ||
 132             !streq(p->pw_name, NOBODY_USER_NAME) ||
 133             p->pw_uid != UID_NOBODY ||
 134             p->pw_gid != GID_NOBODY)
 135                 goto invalid;
 136
 137         p = getpwuid(UID_NOBODY);
 138         if (!p ||
 139             !streq(p->pw_name, NOBODY_USER_NAME) ||
 140             p->pw_uid != UID_NOBODY ||
 141             p->pw_gid != GID_NOBODY)
 142                 goto invalid;
 143
 144         g = getgrnam(NOBODY_GROUP_NAME);
 145         if (!g ||
 146             !streq(g->gr_name, NOBODY_GROUP_NAME) ||
 147             g->gr_gid != GID_NOBODY)
 148                 goto invalid;
 149
 150         g = getgrgid(GID_NOBODY);
 151         if (!g ||
 152             !streq(g->gr_name, NOBODY_GROUP_NAME) ||
 153             g->gr_gid != GID_NOBODY)
 154                 goto invalid;
 155
 156         cache = 1;
 157         return true;
 158
 159 invalid:
 160         cache = 0;
 161         return false;
 162 }
 163
 164 static bool check_user_has_group_with_same_name(const char *name) {
 165         struct passwd *p;
 166         struct group *g;
 167
 168         assert(name);
 169
 170         p = getpwnam(name);
 171         if (!p ||
 172             !streq(p->pw_name, name))
 173                 return false;
 174
 175         g = getgrgid(p->pw_gid);
 176         if (!g ||
 177             !streq(g->gr_name, name))
 178                 return false;
 179
 180         return true;
 181 }
 182
 183 static bool is_inaccessible_available(void) {
 184         const char *p;
 185
 186         FOREACH_STRING(p,
 187                 "/run/systemd/inaccessible/reg",
 188                 "/run/systemd/inaccessible/dir",
 189                 "/run/systemd/inaccessible/chr",
 190                 "/run/systemd/inaccessible/blk",
 191                 "/run/systemd/inaccessible/fifo",
 192                 "/run/systemd/inaccessible/sock"
 193         ) {
 194                 if (access(p, F_OK) < 0)
 195                         return false;
 196         }
 197
 198         return true;
 199 }
 200
 201 static void test(const char *func, Manager *m, const char *unit_name, int status_expected, int code_expected) {
 202         Unit *unit;
 203
 204         assert_se(unit_name);
 205
 206         assert_se(manager_load_startable_unit_or_warn(m, unit_name, NULL, &unit) >= 0);
 207         assert_se(unit_start(unit) >= 0);
 208         check_main_result(func, m, unit, status_expected, code_expected);
 209 }
 210
 211 static void test_service(const char *func, Manager *m, const char *unit_name, ServiceResult result_expected) {
 212         Unit *unit;
 213
 214         assert_se(unit_name);
 215
 216         assert_se(manager_load_startable_unit_or_warn(m, unit_name, NULL, &unit) >= 0);
 217         assert_se(unit_start(unit) >= 0);
 218         check_service_result(func, m, unit, result_expected);
 219 }
 220
 221 static void test_exec_bindpaths(Manager *m) {
 222         assert_se(mkdir_p("/tmp/test-exec-bindpaths", 0755) >= 0);
 223         assert_se(mkdir_p("/tmp/test-exec-bindreadonlypaths", 0755) >= 0);
 224
 225         test(__func__, m, "exec-bindpaths.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 226
 227         (void) rm_rf("/tmp/test-exec-bindpaths", REMOVE_ROOT|REMOVE_PHYSICAL);
 228         (void) rm_rf("/tmp/test-exec-bindreadonlypaths", REMOVE_ROOT|REMOVE_PHYSICAL);
 229 }
 230
 231 static void test_exec_cpuaffinity(Manager *m) {
 232         _cleanup_(cpu_set_reset) CPUSet c = {};
 233
 234         assert_se(cpu_set_realloc(&c, 8192) >= 0); /* just allocate the maximum possible size */
 235         assert_se(sched_getaffinity(0, c.allocated, c.set) >= 0);
 236
 237         if (!CPU_ISSET_S(0, c.allocated, c.set)) {
 238                 log_notice("Cannot use CPU 0, skipping %s", __func__);
 239                 return;
 240         }
 241
 242         test(__func__, m, "exec-cpuaffinity1.service", 0, CLD_EXITED);
 243         test(__func__, m, "exec-cpuaffinity2.service", 0, CLD_EXITED);
 244
 245         if (!CPU_ISSET_S(1, c.allocated, c.set) ||
 246             !CPU_ISSET_S(2, c.allocated, c.set)) {
 247                 log_notice("Cannot use CPU 1 or 2, skipping remaining tests in %s", __func__);
 248                 return;
 249         }
 250
 251         test(__func__, m, "exec-cpuaffinity3.service", 0, CLD_EXITED);
 252 }
 253
 254 static void test_exec_workingdirectory(Manager *m) {
 255         assert_se(mkdir_p("/tmp/test-exec_workingdirectory", 0755) >= 0);
 256
 257         test(__func__, m, "exec-workingdirectory.service", 0, CLD_EXITED);
 258         test(__func__, m, "exec-workingdirectory-trailing-dot.service", 0, CLD_EXITED);
 259
 260         (void) rm_rf("/tmp/test-exec_workingdirectory", REMOVE_ROOT|REMOVE_PHYSICAL);
 261 }
 262
 263 static void test_exec_personality(Manager *m) {
 264 #if defined(__x86_64__)
 265         test(__func__, m, "exec-personality-x86-64.service", 0, CLD_EXITED);
 266
 267 #elif defined(__s390__)
 268         test(__func__, m, "exec-personality-s390.service", 0, CLD_EXITED);
 269
 270 #elif defined(__powerpc64__)
 271 #  if __BYTE_ORDER == __BIG_ENDIAN
 272         test(__func__, m, "exec-personality-ppc64.service", 0, CLD_EXITED);
 273 #  else
 274         test(__func__, m, "exec-personality-ppc64le.service", 0, CLD_EXITED);
 275 #  endif
 276
 277 #elif defined(__aarch64__)
 278         test(__func__, m, "exec-personality-aarch64.service", 0, CLD_EXITED);
 279
 280 #elif defined(__i386__)
 281         test(__func__, m, "exec-personality-x86.service", 0, CLD_EXITED);
 282 #else
 283         log_notice("Unknown personality, skipping %s", __func__);
 284 #endif
 285 }
 286
 287 static void test_exec_ignoresigpipe(Manager *m) {
 288         test(__func__, m, "exec-ignoresigpipe-yes.service", 0, CLD_EXITED);
 289         test(__func__, m, "exec-ignoresigpipe-no.service", SIGPIPE, CLD_KILLED);
 290 }
 291
 292 static void test_exec_privatetmp(Manager *m) {
 293         assert_se(touch("/tmp/test-exec_privatetmp") >= 0);
 294
 295         test(__func__, m, "exec-privatetmp-yes.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 296         test(__func__, m, "exec-privatetmp-no.service", 0, CLD_EXITED);
 297         test(__func__, m, "exec-privatetmp-disabled-by-prefix.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 298
 299         unlink("/tmp/test-exec_privatetmp");
 300 }
 301
 302 static void test_exec_privatedevices(Manager *m) {
 303         int r;
 304
 305         if (detect_container() > 0) {
 306                 log_notice("Testing in container, skipping %s", __func__);
 307                 return;
 308         }
 309         if (!is_inaccessible_available()) {
 310                 log_notice("Testing without inaccessible, skipping %s", __func__);
 311                 return;
 312         }
 313
 314         test(__func__, m, "exec-privatedevices-yes.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 315         test(__func__, m, "exec-privatedevices-no.service", 0, CLD_EXITED);
 316         test(__func__, m, "exec-privatedevices-disabled-by-prefix.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 317         test(__func__, m, "exec-privatedevices-yes-with-group.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 318
 319         /* We use capsh to test if the capabilities are
 320          * properly set, so be sure that it exists */
 321         r = find_binary("capsh", NULL);
 322         if (r < 0) {
 323                 log_notice_errno(r, "Could not find capsh binary, skipping remaining tests in %s: %m", __func__);
 324                 return;
 325         }
 326
 327         test(__func__, m, "exec-privatedevices-yes-capability-mknod.service", 0, CLD_EXITED);
 328         test(__func__, m, "exec-privatedevices-no-capability-mknod.service", 0, CLD_EXITED);
 329         test(__func__, m, "exec-privatedevices-yes-capability-sys-rawio.service", 0, CLD_EXITED);
 330         test(__func__, m, "exec-privatedevices-no-capability-sys-rawio.service", 0, CLD_EXITED);
 331 }
 332
 333 static void test_exec_protecthome(Manager *m) {
 334         if (!can_unshare) {
 335                 log_notice("Cannot reliably unshare, skipping %s", __func__);
 336                 return;
 337         }
 338
 339         test(__func__, m, "exec-protecthome-tmpfs-vs-protectsystem-strict.service", 0, CLD_EXITED);
 340 }
 341
 342 static void test_exec_protectkernelmodules(Manager *m) {
 343         int r;
 344
 345         if (detect_container() > 0) {
 346                 log_notice("Testing in container, skipping %s", __func__);
 347                 return;
 348         }
 349         if (!is_inaccessible_available()) {
 350                 log_notice("Testing without inaccessible, skipping %s", __func__);
 351                 return;
 352         }
 353
 354         r = find_binary("capsh", NULL);
 355         if (r < 0) {
 356                 log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
 357                 return;
 358         }
 359
 360         test(__func__, m, "exec-protectkernelmodules-no-capabilities.service", 0, CLD_EXITED);
 361         test(__func__, m, "exec-protectkernelmodules-yes-capabilities.service", 0, CLD_EXITED);
 362         test(__func__, m, "exec-protectkernelmodules-yes-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 363 }
 364
 365 static void test_exec_readonlypaths(Manager *m) {
 366
 367         test(__func__, m, "exec-readonlypaths-simple.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 368
 369         if (path_is_read_only_fs("/var") > 0) {
 370                 log_notice("Directory /var is readonly, skipping remaining tests in %s", __func__);
 371                 return;
 372         }
 373
 374         test(__func__, m, "exec-readonlypaths.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 375         test(__func__, m, "exec-readonlypaths-with-bindpaths.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 376         test(__func__, m, "exec-readonlypaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 377 }
 378
 379 static void test_exec_readwritepaths(Manager *m) {
 380
 381         if (path_is_read_only_fs("/") > 0) {
 382                 log_notice("Root directory is readonly, skipping %s", __func__);
 383                 return;
 384         }
 385
 386         test(__func__, m, "exec-readwritepaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 387 }
 388
 389 static void test_exec_inaccessiblepaths(Manager *m) {
 390
 391         if (!is_inaccessible_available()) {
 392                 log_notice("Testing without inaccessible, skipping %s", __func__);
 393                 return;
 394         }
 395
 396         test(__func__, m, "exec-inaccessiblepaths-sys.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 397
 398         if (path_is_read_only_fs("/") > 0) {
 399                 log_notice("Root directory is readonly, skipping remaining tests in %s", __func__);
 400                 return;
 401         }
 402
 403         test(__func__, m, "exec-inaccessiblepaths-mount-propagation.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 404 }
 405
 406 static void test_exec_temporaryfilesystem(Manager *m) {
 407
 408         test(__func__, m, "exec-temporaryfilesystem-options.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 409         test(__func__, m, "exec-temporaryfilesystem-ro.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 410         test(__func__, m, "exec-temporaryfilesystem-rw.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 411         test(__func__, m, "exec-temporaryfilesystem-usr.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 412 }
 413
 414 static void test_exec_systemcallfilter(Manager *m) {
 415 #if HAVE_SECCOMP
 416         int r;
 417
 418         if (!is_seccomp_available()) {
 419                 log_notice("Seccomp not available, skipping %s", __func__);
 420                 return;
 421         }
 422
 423         test(__func__, m, "exec-systemcallfilter-not-failing.service", 0, CLD_EXITED);
 424         test(__func__, m, "exec-systemcallfilter-not-failing2.service", 0, CLD_EXITED);
 425         test(__func__, m, "exec-systemcallfilter-failing.service", SIGSYS, CLD_KILLED);
 426         test(__func__, m, "exec-systemcallfilter-failing2.service", SIGSYS, CLD_KILLED);
 427
 428         r = find_binary("python3", NULL);
 429         if (r < 0) {
 430                 log_notice_errno(r, "Skipping remaining tests in %s, could not find python3 binary: %m", __func__);
 431                 return;
 432         }
 433
 434         test(__func__, m, "exec-systemcallfilter-with-errno-name.service", errno_from_name("EILSEQ"), CLD_EXITED);
 435         test(__func__, m, "exec-systemcallfilter-with-errno-number.service", 255, CLD_EXITED);
 436         test(__func__, m, "exec-systemcallfilter-with-errno-multi.service", errno_from_name("EILSEQ"), CLD_EXITED);
 437 #endif
 438 }
 439
 440 static void test_exec_systemcallerrornumber(Manager *m) {
 441 #if HAVE_SECCOMP
 442         int r;
 443
 444         if (!is_seccomp_available()) {
 445                 log_notice("Seccomp not available, skipping %s", __func__);
 446                 return;
 447         }
 448
 449         r = find_binary("python3", NULL);
 450         if (r < 0) {
 451                 log_notice_errno(r, "Skipping %s, could not find python3 binary: %m", __func__);
 452                 return;
 453         }
 454
 455         test(__func__, m, "exec-systemcallerrornumber-name.service", errno_from_name("EACCES"), CLD_EXITED);
 456         test(__func__, m, "exec-systemcallerrornumber-number.service", 255, CLD_EXITED);
 457 #endif
 458 }
 459
 460 static void test_exec_restrictnamespaces(Manager *m) {
 461 #if HAVE_SECCOMP
 462         if (!is_seccomp_available()) {
 463                 log_notice("Seccomp not available, skipping %s", __func__);
 464                 return;
 465         }
 466
 467         test(__func__, m, "exec-restrictnamespaces-no.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 468         test(__func__, m, "exec-restrictnamespaces-yes.service", 1, CLD_EXITED);
 469         test(__func__, m, "exec-restrictnamespaces-mnt.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 470         test(__func__, m, "exec-restrictnamespaces-mnt-blacklist.service", 1, CLD_EXITED);
 471         test(__func__, m, "exec-restrictnamespaces-merge-and.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 472         test(__func__, m, "exec-restrictnamespaces-merge-or.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 473         test(__func__, m, "exec-restrictnamespaces-merge-all.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
 474 #endif
 475 }
 476
 477 static void test_exec_systemcallfilter_system(Manager *m) {
 478 /* Skip this particular test case when running under ASan, as
 479  * LSan intermittently segfaults when accessing memory right
 480  * after the test finishes. Generally, ASan & LSan don't like
 481  * the seccomp stuff.
 482  */
 483 #if HAVE_SECCOMP && !HAS_FEATURE_ADDRESS_SANITIZER
 484         if (!is_seccomp_available()) {
 485                 log_notice("Seccomp not available, skipping %s", __func__);
 486                 return;
 487         }
 488
 489         test(__func__, m, "exec-systemcallfilter-system-user.service", 0, CLD_EXITED);
 490
 491         if (!check_nobody_user_and_group()) {
 492                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 493                 return;
 494         }
 495
 496         if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) {
 497                 log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__);
 498                 return;
 499         }
 500
 501         test(__func__, m, "exec-systemcallfilter-system-user-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 502 #endif
 503 }
 504
 505 static void test_exec_user(Manager *m) {
 506         test(__func__, m, "exec-user.service", 0, CLD_EXITED);
 507
 508         if (!check_nobody_user_and_group()) {
 509                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 510                 return;
 511         }
 512
 513         if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) {
 514                 log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__);
 515                 return;
 516         }
 517
 518         test(__func__, m, "exec-user-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 519 }
 520
 521 static void test_exec_group(Manager *m) {
 522         test(__func__, m, "exec-group.service", 0, CLD_EXITED);
 523
 524         if (!check_nobody_user_and_group()) {
 525                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 526                 return;
 527         }
 528
 529         if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) {
 530                 log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__);
 531                 return;
 532         }
 533
 534         test(__func__, m, "exec-group-" NOBODY_GROUP_NAME ".service", 0, CLD_EXITED);
 535 }
 536
 537 static void test_exec_supplementarygroups(Manager *m) {
 538         test(__func__, m, "exec-supplementarygroups.service", 0, CLD_EXITED);
 539         test(__func__, m, "exec-supplementarygroups-single-group.service", 0, CLD_EXITED);
 540         test(__func__, m, "exec-supplementarygroups-single-group-user.service", 0, CLD_EXITED);
 541         test(__func__, m, "exec-supplementarygroups-multiple-groups-default-group-user.service", 0, CLD_EXITED);
 542         test(__func__, m, "exec-supplementarygroups-multiple-groups-withgid.service", 0, CLD_EXITED);
 543         test(__func__, m, "exec-supplementarygroups-multiple-groups-withuid.service", 0, CLD_EXITED);
 544 }
 545
 546 static void test_exec_dynamicuser(Manager *m) {
 547
 548         test(__func__, m, "exec-dynamicuser-fixeduser.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 549         if (check_user_has_group_with_same_name("adm"))
 550                 test(__func__, m, "exec-dynamicuser-fixeduser-adm.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 551         if (check_user_has_group_with_same_name("games"))
 552                 test(__func__, m, "exec-dynamicuser-fixeduser-games.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 553         test(__func__, m, "exec-dynamicuser-fixeduser-one-supplementarygroup.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 554         test(__func__, m, "exec-dynamicuser-supplementarygroups.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 555         test(__func__, m, "exec-dynamicuser-statedir.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 556
 557         (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 558         (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 559         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 560         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 561
 562         test(__func__, m, "exec-dynamicuser-statedir-migrate-step1.service", 0, CLD_EXITED);
 563         test(__func__, m, "exec-dynamicuser-statedir-migrate-step2.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
 564
 565         (void) rm_rf("/var/lib/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 566         (void) rm_rf("/var/lib/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 567         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate", REMOVE_ROOT|REMOVE_PHYSICAL);
 568         (void) rm_rf("/var/lib/private/test-dynamicuser-migrate2", REMOVE_ROOT|REMOVE_PHYSICAL);
 569 }
 570
 571 static void test_exec_environment(Manager *m) {
 572         test(__func__, m, "exec-environment-no-substitute.service", 0, CLD_EXITED);
 573         test(__func__, m, "exec-environment.service", 0, CLD_EXITED);
 574         test(__func__, m, "exec-environment-multiple.service", 0, CLD_EXITED);
 575         test(__func__, m, "exec-environment-empty.service", 0, CLD_EXITED);
 576 }
 577
 578 static void test_exec_environmentfile(Manager *m) {
 579         static const char e[] =
 580                 "VAR1='word1 word2'\n"
 581                 "VAR2=word3 \n"
 582                 "# comment1\n"
 583                 "\n"
 584                 "; comment2\n"
 585                 " ; # comment3\n"
 586                 "line without an equal\n"
 587                 "VAR3='$word 5 6'\n"
 588                 "VAR4='new\nline'\n"
 589                 "VAR5=password\\with\\backslashes";
 590         int r;
 591
 592         r = write_string_file("/tmp/test-exec_environmentfile.conf", e, WRITE_STRING_FILE_CREATE);
 593         assert_se(r == 0);
 594
 595         test(__func__, m, "exec-environmentfile.service", 0, CLD_EXITED);
 596
 597         (void) unlink("/tmp/test-exec_environmentfile.conf");
 598 }
 599
 600 static void test_exec_passenvironment(Manager *m) {
 601         /* test-execute runs under MANAGER_USER which, by default, forwards all
 602          * variables present in the environment, but only those that are
 603          * present _at the time it is created_!
 604          *
 605          * So these PassEnvironment checks are still expected to work, since we
 606          * are ensuring the variables are not present at manager creation (they
 607          * are unset explicitly in main) and are only set here.
 608          *
 609          * This is still a good approximation of how a test for MANAGER_SYSTEM
 610          * would work.
 611          */
 612         assert_se(setenv("VAR1", "word1 word2", 1) == 0);
 613         assert_se(setenv("VAR2", "word3", 1) == 0);
 614         assert_se(setenv("VAR3", "$word 5 6", 1) == 0);
 615         assert_se(setenv("VAR4", "new\nline", 1) == 0);
 616         assert_se(setenv("VAR5", "passwordwithbackslashes", 1) == 0);
 617         test(__func__, m, "exec-passenvironment.service", 0, CLD_EXITED);
 618         test(__func__, m, "exec-passenvironment-repeated.service", 0, CLD_EXITED);
 619         test(__func__, m, "exec-passenvironment-empty.service", 0, CLD_EXITED);
 620         assert_se(unsetenv("VAR1") == 0);
 621         assert_se(unsetenv("VAR2") == 0);
 622         assert_se(unsetenv("VAR3") == 0);
 623         assert_se(unsetenv("VAR4") == 0);
 624         assert_se(unsetenv("VAR5") == 0);
 625         test(__func__, m, "exec-passenvironment-absent.service", 0, CLD_EXITED);
 626 }
 627
 628 static void test_exec_umask(Manager *m) {
 629         test(__func__, m, "exec-umask-default.service", 0, CLD_EXITED);
 630         test(__func__, m, "exec-umask-0177.service", 0, CLD_EXITED);
 631 }
 632
 633 static void test_exec_runtimedirectory(Manager *m) {
 634         test(__func__, m, "exec-runtimedirectory.service", 0, CLD_EXITED);
 635         test(__func__, m, "exec-runtimedirectory-mode.service", 0, CLD_EXITED);
 636         test(__func__, m, "exec-runtimedirectory-owner.service", 0, CLD_EXITED);
 637
 638         if (!check_nobody_user_and_group()) {
 639                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 640                 return;
 641         }
 642
 643         if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) {
 644                 log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__);
 645                 return;
 646         }
 647
 648         test(__func__, m, "exec-runtimedirectory-owner-" NOBODY_GROUP_NAME ".service", 0, CLD_EXITED);
 649 }
 650
 651 static void test_exec_capabilityboundingset(Manager *m) {
 652         int r;
 653
 654         r = find_binary("capsh", NULL);
 655         if (r < 0) {
 656                 log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
 657                 return;
 658         }
 659
 660         if (have_effective_cap(CAP_CHOWN) <= 0 ||
 661             have_effective_cap(CAP_FOWNER) <= 0 ||
 662             have_effective_cap(CAP_KILL) <= 0) {
 663                 log_notice("Skipping %s, this process does not have enough capabilities", __func__);
 664                 return;
 665         }
 666
 667         test(__func__, m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED);
 668         test(__func__, m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED);
 669         test(__func__, m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED);
 670         test(__func__, m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED);
 671 }
 672
 673 static void test_exec_basic(Manager *m) {
 674         test(__func__, m, "exec-basic.service", 0, CLD_EXITED);
 675 }
 676
 677 static void test_exec_ambientcapabilities(Manager *m) {
 678         int r;
 679
 680         /* Check if the kernel has support for ambient capabilities. Run
 681          * the tests only if that's the case. Clearing all ambient
 682          * capabilities is fine, since we are expecting them to be unset
 683          * in the first place for the tests. */
 684         r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
 685         if (r < 0 && IN_SET(errno, EINVAL, EOPNOTSUPP, ENOSYS)) {
 686                 log_notice("Skipping %s, the kernel does not support ambient capabilities", __func__);
 687                 return;
 688         }
 689
 690         if (have_effective_cap(CAP_CHOWN) <= 0 ||
 691             have_effective_cap(CAP_NET_RAW) <= 0) {
 692                 log_notice("Skipping %s, this process does not have enough capabilities", __func__);
 693                 return;
 694         }
 695
 696         test(__func__, m, "exec-ambientcapabilities.service", 0, CLD_EXITED);
 697         test(__func__, m, "exec-ambientcapabilities-merge.service", 0, CLD_EXITED);
 698
 699         if (!check_nobody_user_and_group()) {
 700                 log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
 701                 return;
 702         }
 703
 704         if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) {
 705                 log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__);
 706                 return;
 707         }
 708
 709         test(__func__, m, "exec-ambientcapabilities-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 710         test(__func__, m, "exec-ambientcapabilities-merge-" NOBODY_USER_NAME ".service", 0, CLD_EXITED);
 711 }
 712
 713 static void test_exec_privatenetwork(Manager *m) {
 714         int r;
 715
 716         r = find_binary("ip", NULL);
 717         if (r < 0) {
 718                 log_notice_errno(r, "Skipping %s, could not find ip binary: %m", __func__);
 719                 return;
 720         }
 721
 722         test(__func__, m, "exec-privatenetwork-yes.service", can_unshare ? 0 : EXIT_NETWORK, CLD_EXITED);
 723 }
 724
 725 static void test_exec_oomscoreadjust(Manager *m) {
 726         test(__func__, m, "exec-oomscoreadjust-positive.service", 0, CLD_EXITED);
 727
 728         if (detect_container() > 0) {
 729                 log_notice("Testing in container, skipping remaining tests in %s", __func__);
 730                 return;
 731         }
 732         test(__func__, m, "exec-oomscoreadjust-negative.service", 0, CLD_EXITED);
 733 }
 734
 735 static void test_exec_ioschedulingclass(Manager *m) {
 736         test(__func__, m, "exec-ioschedulingclass-none.service", 0, CLD_EXITED);
 737         test(__func__, m, "exec-ioschedulingclass-idle.service", 0, CLD_EXITED);
 738         test(__func__, m, "exec-ioschedulingclass-best-effort.service", 0, CLD_EXITED);
 739
 740         if (detect_container() > 0) {
 741                 log_notice("Testing in container, skipping remaining tests in %s", __func__);
 742                 return;
 743         }
 744         test(__func__, m, "exec-ioschedulingclass-realtime.service", 0, CLD_EXITED);
 745 }
 746
 747 static void test_exec_unsetenvironment(Manager *m) {
 748         test(__func__, m, "exec-unsetenvironment.service", 0, CLD_EXITED);
 749 }
 750
 751 static void test_exec_specifier(Manager *m) {
 752         test(__func__, m, "exec-specifier.service", 0, CLD_EXITED);
 753         test(__func__, m, "exec-specifier@foo-bar.service", 0, CLD_EXITED);
 754         test(__func__, m, "exec-specifier-interpolation.service", 0, CLD_EXITED);
 755 }
 756
 757 static void test_exec_standardinput(Manager *m) {
 758         test(__func__, m, "exec-standardinput-data.service", 0, CLD_EXITED);
 759         test(__func__, m, "exec-standardinput-file.service", 0, CLD_EXITED);
 760         test(__func__, m, "exec-standardinput-file-cat.service", 0, CLD_EXITED);
 761 }
 762
 763 static void test_exec_standardoutput(Manager *m) {
 764         test(__func__, m, "exec-standardoutput-file.service", 0, CLD_EXITED);
 765 }
 766
 767 static void test_exec_standardoutput_append(Manager *m) {
 768         test(__func__, m, "exec-standardoutput-append.service", 0, CLD_EXITED);
 769 }
 770
 771 static void test_exec_condition(Manager *m) {
 772         test_service(__func__, m, "exec-condition-failed.service", SERVICE_FAILURE_EXIT_CODE);
 773         test_service(__func__, m, "exec-condition-skip.service", SERVICE_SKIP_CONDITION);
 774 }
 775
 776 typedef struct test_entry {
 777         test_function_t f;
 778         const char *name;
 779 } test_entry;
 780
 781 #define entry(x) {x, #x}
 782
 783 static int run_tests(UnitFileScope scope, const test_entry tests[], char **patterns) {
 784         const test_entry *test = NULL;
 785         _cleanup_(manager_freep) Manager *m = NULL;
 786         int r;
 787
 788         assert_se(tests);
 789
 790         r = manager_new(scope, MANAGER_TEST_RUN_BASIC, &m);
 791         m->default_std_output = EXEC_OUTPUT_NULL; /* don't rely on host journald */
 792         if (manager_errno_skip_test(r))
 793                 return log_tests_skipped_errno(r, "manager_new");
 794         assert_se(r >= 0);
 795         assert_se(manager_startup(m, NULL, NULL) >= 0);
 796
 797         for (test = tests; test && test->f; test++)
 798                 if (strv_fnmatch_or_empty(patterns, test->name, FNM_NOESCAPE))
 799                         test->f(m);
 800                 else
 801                         log_info("Skipping %s because it does not match any pattern.", test->name);
 802
 803         return 0;
 804 }
 805
 806 int main(int argc, char *argv[]) {
 807         _cleanup_(rm_rf_physical_and_freep) char *runtime_dir = NULL;
 808         _cleanup_free_ char *test_execute_path = NULL;
 809
 810         static const test_entry user_tests[] = {
 811                 entry(test_exec_basic),
 812                 entry(test_exec_ambientcapabilities),
 813                 entry(test_exec_bindpaths),
 814                 entry(test_exec_capabilityboundingset),
 815                 entry(test_exec_condition),
 816                 entry(test_exec_cpuaffinity),
 817                 entry(test_exec_environment),
 818                 entry(test_exec_environmentfile),
 819                 entry(test_exec_group),
 820                 entry(test_exec_ignoresigpipe),
 821                 entry(test_exec_inaccessiblepaths),
 822                 entry(test_exec_ioschedulingclass),
 823                 entry(test_exec_oomscoreadjust),
 824                 entry(test_exec_passenvironment),
 825                 entry(test_exec_personality),
 826                 entry(test_exec_privatedevices),
 827                 entry(test_exec_privatenetwork),
 828                 entry(test_exec_privatetmp),
 829                 entry(test_exec_protecthome),
 830                 entry(test_exec_protectkernelmodules),
 831                 entry(test_exec_readonlypaths),
 832                 entry(test_exec_readwritepaths),
 833                 entry(test_exec_restrictnamespaces),
 834                 entry(test_exec_runtimedirectory),
 835                 entry(test_exec_standardinput),
 836                 entry(test_exec_standardoutput),
 837                 entry(test_exec_standardoutput_append),
 838                 entry(test_exec_supplementarygroups),
 839                 entry(test_exec_systemcallerrornumber),
 840                 entry(test_exec_systemcallfilter),
 841                 entry(test_exec_temporaryfilesystem),
 842                 entry(test_exec_umask),
 843                 entry(test_exec_unsetenvironment),
 844                 entry(test_exec_user),
 845                 entry(test_exec_workingdirectory),
 846                 {},
 847         };
 848         static const test_entry system_tests[] = {
 849                 entry(test_exec_dynamicuser),
 850                 entry(test_exec_specifier),
 851                 entry(test_exec_systemcallfilter_system),
 852                 {},
 853         };
 854         int r;
 855
 856         test_setup_logging(LOG_DEBUG);
 857
 858 #if HAS_FEATURE_ADDRESS_SANITIZER
 859         if (is_run_on_travis_ci()) {
 860                 log_notice("Running on TravisCI under ASan, skipping, see https://github.com/systemd/systemd/issues/10696");
 861                 return EXIT_TEST_SKIP;
 862         }
 863 #endif
 864
 865         (void) unsetenv("USER");
 866         (void) unsetenv("LOGNAME");
 867         (void) unsetenv("SHELL");
 868         (void) unsetenv("HOME");
 869
 870         can_unshare = have_namespaces();
 871
 872         /* It is needed otherwise cgroup creation fails */
 873         if (getuid() != 0)
 874                 return log_tests_skipped("not root");
 875
 876         r = enter_cgroup_subroot(NULL);
 877         if (r == -ENOMEDIUM)
 878                 return log_tests_skipped("cgroupfs not available");
 879
 880         assert_se(runtime_dir = setup_fake_runtime_dir());
 881         test_execute_path = path_join(get_testdata_dir(), "test-execute");
 882         assert_se(set_unit_path(test_execute_path) >= 0);
 883
 884         /* Unset VAR1, VAR2 and VAR3 which are used in the PassEnvironment test
 885          * cases, otherwise (and if they are present in the environment),
 886          * `manager_default_environment` will copy them into the default
 887          * environment which is passed to each created job, which will make the
 888          * tests that expect those not to be present to fail.
 889          */
 890         assert_se(unsetenv("VAR1") == 0);
 891         assert_se(unsetenv("VAR2") == 0);
 892         assert_se(unsetenv("VAR3") == 0);
 893
 894         r = run_tests(UNIT_FILE_USER, user_tests, argv + 1);
 895         if (r != 0)
 896                 return r;
 897
 898         r = run_tests(UNIT_FILE_SYSTEM, system_tests, argv + 1);
 899         if (r != 0)
 900                 return r;
 901
 902 #if HAVE_SECCOMP
 903         /* The following tests are for 1beab8b0d0ff2d7d1436b52d4a0c3d56dc908962. */
 904         if (!is_seccomp_available()) {
 905                 log_notice("Seccomp not available, skipping unshare() filtered tests.");
 906                 return 0;
 907         }
 908
 909         _cleanup_hashmap_free_ Hashmap *s = NULL;
 910         assert_se(s = hashmap_new(NULL));
 911         r = seccomp_syscall_resolve_name("unshare");
 912         assert_se(r != __NR_SCMP_ERROR);
 913         assert_se(hashmap_put(s, UINT32_TO_PTR(r + 1), INT_TO_PTR(-1)) >= 0);
 914         assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EOPNOTSUPP), true) >= 0);
 915         assert_se(unshare(CLONE_NEWNS) < 0);
 916         assert_se(errno == EOPNOTSUPP);
 917
 918         can_unshare = false;
 919
 920         r = run_tests(UNIT_FILE_USER, user_tests, argv + 1);
 921         if (r != 0)
 922                 return r;
 923
 924         return run_tests(UNIT_FILE_SYSTEM, system_tests, argv + 1);
 925 #else
 926         return 0;
 927 #endif
 928 }