Merge pull request #14472 from poettering/test-43-fixes
Various robustness fixes for TEST-43-PRIVATEUSER-UNPRIV
This commit is contained in:
commit
ffe61e19cb
|
@ -15,20 +15,23 @@ test_setup() {
|
||||||
|
|
||||||
mask_supporting_services
|
mask_supporting_services
|
||||||
|
|
||||||
usermod --root $initdir -d /home/nobody -s /bin/bash nobody
|
# Allocate user for running test case under
|
||||||
mkdir $initdir/home $initdir/home/nobody
|
mkdir -p $initdir/etc/sysusers.d
|
||||||
# Ubuntu's equivalent is nogroup
|
cat >$initdir/etc/sysusers.d/testuser.conf <<EOF
|
||||||
chown nobody:nobody $initdir/home/nobody || chown nobody:nogroup $initdir/home/nobody
|
u testuser 4711 "Test User" /home/testuser
|
||||||
|
EOF
|
||||||
|
|
||||||
enable_user_manager nobody
|
mkdir -p $initdir/home/testuser -m 0700
|
||||||
|
chown 4711:4711 $initdir/home/testuser
|
||||||
|
|
||||||
nobody_uid=$(id -u nobody)
|
enable_user_manager testuser
|
||||||
|
|
||||||
# setup the testsuite service
|
# setup the testsuite service
|
||||||
cat >$initdir/etc/systemd/system/testsuite.service <<EOF
|
cat >$initdir/etc/systemd/system/testsuite.service <<EOF
|
||||||
[Unit]
|
[Unit]
|
||||||
Description=Testsuite service
|
Description=Testsuite service
|
||||||
After=systemd-logind.service user@$nobody_uid.service
|
After=systemd-logind.service user@4711.service
|
||||||
|
Wants=user@4711.service
|
||||||
|
|
||||||
[Service]
|
[Service]
|
||||||
ExecStart=/testsuite.sh
|
ExecStart=/testsuite.sh
|
||||||
|
|
|
@ -7,15 +7,13 @@ systemd-analyze log-level debug
|
||||||
runas() {
|
runas() {
|
||||||
declare userid=$1
|
declare userid=$1
|
||||||
shift
|
shift
|
||||||
su "$userid" -c 'XDG_RUNTIME_DIR=/run/user/$UID "$@"' -- sh "$@"
|
su "$userid" -s /bin/sh -c 'XDG_RUNTIME_DIR=/run/user/$UID exec "$@"' -- sh "$@"
|
||||||
}
|
}
|
||||||
|
|
||||||
runas nobody systemctl --user --wait is-system-running
|
runas testuser systemd-run --user --unit=test-private-users \
|
||||||
|
|
||||||
runas nobody systemd-run --user --unit=test-private-users \
|
|
||||||
-p PrivateUsers=yes -P echo hello
|
-p PrivateUsers=yes -P echo hello
|
||||||
|
|
||||||
runas nobody systemd-run --user --unit=test-private-tmp-innerfile \
|
runas testuser systemd-run --user --unit=test-private-tmp-innerfile \
|
||||||
-p PrivateUsers=yes -p PrivateTmp=yes \
|
-p PrivateUsers=yes -p PrivateTmp=yes \
|
||||||
-P touch /tmp/innerfile.txt
|
-P touch /tmp/innerfile.txt
|
||||||
# File should not exist outside the job's tmp directory.
|
# File should not exist outside the job's tmp directory.
|
||||||
|
@ -23,31 +21,31 @@ test ! -e /tmp/innerfile.txt
|
||||||
|
|
||||||
touch /tmp/outerfile.txt
|
touch /tmp/outerfile.txt
|
||||||
# File should not appear in unit's private tmp.
|
# File should not appear in unit's private tmp.
|
||||||
runas nobody systemd-run --user --unit=test-private-tmp-outerfile \
|
runas testuser systemd-run --user --unit=test-private-tmp-outerfile \
|
||||||
-p PrivateUsers=yes -p PrivateTmp=yes \
|
-p PrivateUsers=yes -p PrivateTmp=yes \
|
||||||
-P test ! -e /tmp/outerfile.txt
|
-P test ! -e /tmp/outerfile.txt
|
||||||
|
|
||||||
# Confirm that creating a file in home works
|
# Confirm that creating a file in home works
|
||||||
runas nobody systemd-run --user --unit=test-unprotected-home \
|
runas testuser systemd-run --user --unit=test-unprotected-home \
|
||||||
-P touch /home/nobody/works.txt
|
-P touch /home/testuser/works.txt
|
||||||
test -e /home/nobody/works.txt
|
test -e /home/testuser/works.txt
|
||||||
|
|
||||||
# Confirm that creating a file in home is blocked under read-only
|
# Confirm that creating a file in home is blocked under read-only
|
||||||
runas nobody systemd-run --user --unit=test-protect-home-read-only \
|
runas testuser systemd-run --user --unit=test-protect-home-read-only \
|
||||||
-p PrivateUsers=yes -p ProtectHome=read-only \
|
-p PrivateUsers=yes -p ProtectHome=read-only \
|
||||||
-P bash -c '
|
-P bash -c '
|
||||||
test -e /home/nobody/works.txt
|
test -e /home/testuser/works.txt
|
||||||
! touch /home/nobody/blocked.txt
|
! touch /home/testuser/blocked.txt
|
||||||
'
|
'
|
||||||
test ! -e /home/nobody/blocked.txt
|
test ! -e /home/testuser/blocked.txt
|
||||||
|
|
||||||
# Check that tmpfs hides the whole directory
|
# Check that tmpfs hides the whole directory
|
||||||
runas nobody systemd-run --user --unit=test-protect-home-tmpfs \
|
runas testuser systemd-run --user --unit=test-protect-home-tmpfs \
|
||||||
-p PrivateUsers=yes -p ProtectHome=tmpfs \
|
-p PrivateUsers=yes -p ProtectHome=tmpfs \
|
||||||
-P test ! -e /home/nobody
|
-P test ! -e /home/testuser
|
||||||
|
|
||||||
# Confirm that home, /root, and /run/user are inaccessible under "yes"
|
# Confirm that home, /root, and /run/user are inaccessible under "yes"
|
||||||
runas nobody systemd-run --user --unit=test-protect-home-yes \
|
runas testuser systemd-run --user --unit=test-protect-home-yes \
|
||||||
-p PrivateUsers=yes -p ProtectHome=yes \
|
-p PrivateUsers=yes -p ProtectHome=yes \
|
||||||
-P bash -c '
|
-P bash -c '
|
||||||
test "$(stat -c %a /home)" = "0"
|
test "$(stat -c %a /home)" = "0"
|
||||||
|
@ -59,7 +57,7 @@ runas nobody systemd-run --user --unit=test-protect-home-yes \
|
||||||
# namespace (no CAP_SETGID in the parent namespace to write the additional
|
# namespace (no CAP_SETGID in the parent namespace to write the additional
|
||||||
# mapping of the user supplied group and thus cannot change groups to an
|
# mapping of the user supplied group and thus cannot change groups to an
|
||||||
# unmapped group ID)
|
# unmapped group ID)
|
||||||
! runas nobody systemd-run --user --unit=test-group-fail \
|
! runas testuser systemd-run --user --unit=test-group-fail \
|
||||||
-p PrivateUsers=yes -p Group=daemon \
|
-p PrivateUsers=yes -p Group=daemon \
|
||||||
-P true
|
-P true
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue