diff --git a/test/test-execute/exec-dynamicuser-state-dir.service b/test/test-execute/exec-dynamicuser-state-dir.service index 7e2d88450b..cc09c938cf 100644 --- a/test/test-execute/exec-dynamicuser-state-dir.service +++ b/test/test-execute/exec-dynamicuser-state-dir.service @@ -2,14 +2,14 @@ Description=Test DynamicUser= with StateDirectory= [Service] -ExecStart=/usr/bin/test -w /var/lib/waldo -ExecStart=/usr/bin/test -w /var/lib/quux/pief -ExecStart=/bin/touch /var/lib/waldo/yay -ExecStart=/bin/touch /var/lib/quux/pief/yayyay -ExecStart=/usr/bin/test -f /var/lib/waldo/yay -ExecStart=/usr/bin/test -f /var/lib/quux/pief/yayyay -ExecStart=/usr/bin/test -f /var/lib/private/waldo/yay -ExecStart=/usr/bin/test -f /var/lib/private/quux/pief/yayyay +ExecStart=/bin/sh -c 'test -w /var/lib/waldo' +ExecStart=/bin/sh -c 'test -w /var/lib/quux/pief' +ExecStart=/bin/sh -c 'touch /var/lib/waldo/yay' +ExecStart=/bin/sh -c 'touch /var/lib/quux/pief/yayyay' +ExecStart=/bin/sh -c 'test -f /var/lib/waldo/yay' +ExecStart=/bin/sh -c 'test -f /var/lib/quux/pief/yayyay' +ExecStart=/bin/sh -c 'test -f /var/lib/private/waldo/yay' +ExecStart=/bin/sh -c 'test -f /var/lib/private/quux/pief/yayyay' # Make sure that /var/lib/private/waldo is really the only writable directory besides the obvious candidates ExecStart=/bin/sh -x -c 'test $$(find / -type d -writable 2> /dev/null | egrep -v -e \'^(/var/tmp$$|/tmp$$|/proc/|/dev/mqueue$$|/dev/shm$$)\' | sort -u | tr -d '\\\\n') = /var/lib/private/quux/pief/var/lib/private/waldo' diff --git a/test/test-execute/exec-read-only-path-succeed.service b/test/test-execute/exec-read-only-path-succeed.service index b54d48f281..754dc92790 100644 --- a/test/test-execute/exec-read-only-path-succeed.service +++ b/test/test-execute/exec-read-only-path-succeed.service @@ -1,8 +1,8 @@ [Service] Type=oneshot # This should work, as we explicitly disable the effect of ReadOnlyPaths= -ExecStart=+/bin/touch /tmp/thisisasimpletest +ExecStart=+/bin/sh -c 'touch /tmp/thisisasimpletest' # This should also work, as we do not disable the effect of ReadOnlyPaths= but invert the exit code -ExecStart=/bin/sh -x -c '! /bin/touch /tmp/thisisasimpletest' -ExecStart=+/bin/rm /tmp/thisisasimpletest +ExecStart=/bin/sh -x -c '! touch /tmp/thisisasimpletest' +ExecStart=+/bin/sh -c 'rm /tmp/thisisasimpletest' ReadOnlyPaths=/tmp diff --git a/test/test-execute/exec-systemcallfilter-failing.service b/test/test-execute/exec-systemcallfilter-failing.service index 5c6422f0fd..bcebc99507 100644 --- a/test/test-execute/exec-systemcallfilter-failing.service +++ b/test/test-execute/exec-systemcallfilter-failing.service @@ -2,7 +2,7 @@ Description=Test for SystemCallFilter [Service] -ExecStart=/bin/echo "This should not be seen" +ExecStart=/bin/sh -c 'echo "This should not be seen"' Type=oneshot SystemCallFilter=ioperm SystemCallFilter=~ioperm diff --git a/test/test-execute/exec-systemcallfilter-failing2.service b/test/test-execute/exec-systemcallfilter-failing2.service index 3516078e1f..2fdc0ed772 100644 --- a/test/test-execute/exec-systemcallfilter-failing2.service +++ b/test/test-execute/exec-systemcallfilter-failing2.service @@ -2,6 +2,6 @@ Description=Test for SystemCallFilter [Service] -ExecStart=/bin/echo "This should not be seen" +ExecStart=/bin/sh -c 'echo "This should not be seen"' Type=oneshot SystemCallFilter=~write open execve exit_group close mmap munmap fstat DONOTEXIST diff --git a/test/test-execute/exec-systemcallfilter-not-failing.service b/test/test-execute/exec-systemcallfilter-not-failing.service index c794b67edd..f3a752b3ef 100644 --- a/test/test-execute/exec-systemcallfilter-not-failing.service +++ b/test/test-execute/exec-systemcallfilter-not-failing.service @@ -2,7 +2,7 @@ Description=Test for SystemCallFilter [Service] -ExecStart=/bin/echo "Foo bar" +ExecStart=/bin/sh -c 'echo "Foo bar"' Type=oneshot SystemCallFilter=~read write open execve ioperm SystemCallFilter=ioctl diff --git a/test/test-execute/exec-systemcallfilter-not-failing2.service b/test/test-execute/exec-systemcallfilter-not-failing2.service index a62c81bd48..1df076ab90 100644 --- a/test/test-execute/exec-systemcallfilter-not-failing2.service +++ b/test/test-execute/exec-systemcallfilter-not-failing2.service @@ -2,6 +2,6 @@ Description=Test for SystemCallFilter [Service] -ExecStart=/bin/echo "Foo bar" +ExecStart=/bin/sh -c 'echo "Foo bar"' Type=oneshot SystemCallFilter= diff --git a/test/test-execute/exec-systemcallfilter-system-user-nfsnobody.service b/test/test-execute/exec-systemcallfilter-system-user-nfsnobody.service index 9393e0a998..b1195d0d25 100644 --- a/test/test-execute/exec-systemcallfilter-system-user-nfsnobody.service +++ b/test/test-execute/exec-systemcallfilter-system-user-nfsnobody.service @@ -2,7 +2,7 @@ Description=Test for SystemCallFilter in system mode with User set [Service] -ExecStart=/bin/echo "Foo bar" +ExecStart=/bin/sh -c 'echo "Foo bar"' Type=oneshot User=nfsnobody SystemCallFilter=~read write open execve ioperm diff --git a/test/test-execute/exec-systemcallfilter-system-user.service b/test/test-execute/exec-systemcallfilter-system-user.service index 462f94133d..da129a30e4 100644 --- a/test/test-execute/exec-systemcallfilter-system-user.service +++ b/test/test-execute/exec-systemcallfilter-system-user.service @@ -2,7 +2,7 @@ Description=Test for SystemCallFilter in system mode with User set [Service] -ExecStart=/bin/echo "Foo bar" +ExecStart=/bin/sh -c 'echo "Foo bar"' Type=oneshot User=nobody SystemCallFilter=~read write open execve ioperm