picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

test: add test to make sure that CAP_SYS_RAWIO was removed on PrivateDevices=yes

This commit is contained in:
Djalal Harouni 2016-10-07 20:41:38 +02:00
parent 2cd0a73547
commit 625d8769fa
3 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/test/test-execute.c
View File

@ -140,6 +140,8 @@ static void test_exec_privatedevices_capabilities(Manager *m) {
}
test(m, "exec-privatedevices-yes-capability-mknod.service", 0, CLD_EXITED);
test(m, "exec-privatedevices-no-capability-mknod.service", 0, CLD_EXITED);
test(m, "exec-privatedevices-yes-capability-sys-rawio.service", 0, CLD_EXITED);
test(m, "exec-privatedevices-no-capability-sys-rawio.service", 0, CLD_EXITED);
}
static void test_exec_protectkernelmodules_capabilities(Manager *m) {

7
test/test-execute/exec-privatedevices-no-capability-sys-rawio.service Normal file
View File

@ -0,0 +1,7 @@
[Unit]
Description=Test CAP_SYS_RAWIO capability for PrivateDevices=no
[Service]
PrivateDevices=no
ExecStart=/bin/sh -x -c 'capsh --print | grep cap_sys_rawio'
Type=oneshot

7
test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service Normal file
View File

@ -0,0 +1,7 @@
[Unit]
Description=Test CAP_SYS_RAWIO capability for PrivateDevices=yes
[Service]
PrivateDevices=yes
ExecStart=/bin/sh -x -c '! capsh --print | grep cap_sys_rawio'
Type=oneshot