test: add tests for TemporaryFileSystem=
This commit is contained in:
parent
c10b460b5a
commit
4cac89bd7c
|
@ -276,6 +276,14 @@ static void test_exec_inaccessiblepaths(Manager *m) {
|
||||||
test(m, "exec-inaccessiblepaths-mount-propagation.service", 0, CLD_EXITED);
|
test(m, "exec-inaccessiblepaths-mount-propagation.service", 0, CLD_EXITED);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static void test_exec_temporaryfilesystem(Manager *m) {
|
||||||
|
|
||||||
|
test(m, "exec-temporaryfilesystem-options.service", 0, CLD_EXITED);
|
||||||
|
test(m, "exec-temporaryfilesystem-ro.service", 0, CLD_EXITED);
|
||||||
|
test(m, "exec-temporaryfilesystem-rw.service", 0, CLD_EXITED);
|
||||||
|
test(m, "exec-temporaryfilesystem-usr.service", 0, CLD_EXITED);
|
||||||
|
}
|
||||||
|
|
||||||
static void test_exec_systemcallfilter(Manager *m) {
|
static void test_exec_systemcallfilter(Manager *m) {
|
||||||
#if HAVE_SECCOMP
|
#if HAVE_SECCOMP
|
||||||
if (!is_seccomp_available()) {
|
if (!is_seccomp_available()) {
|
||||||
|
@ -569,6 +577,7 @@ int main(int argc, char *argv[]) {
|
||||||
test_exec_supplementarygroups,
|
test_exec_supplementarygroups,
|
||||||
test_exec_systemcallerrornumber,
|
test_exec_systemcallerrornumber,
|
||||||
test_exec_systemcallfilter,
|
test_exec_systemcallfilter,
|
||||||
|
test_exec_temporaryfilesystem,
|
||||||
test_exec_umask,
|
test_exec_umask,
|
||||||
test_exec_unsetenvironment,
|
test_exec_unsetenvironment,
|
||||||
test_exec_user,
|
test_exec_user,
|
||||||
|
|
|
@ -136,6 +136,10 @@ test_data_files = '''
|
||||||
test-execute/exec-systemcallfilter-system-user.service
|
test-execute/exec-systemcallfilter-system-user.service
|
||||||
test-execute/exec-systemcallfilter-with-errno-name.service
|
test-execute/exec-systemcallfilter-with-errno-name.service
|
||||||
test-execute/exec-systemcallfilter-with-errno-number.service
|
test-execute/exec-systemcallfilter-with-errno-number.service
|
||||||
|
test-execute/exec-temporaryfilesystem-options.service
|
||||||
|
test-execute/exec-temporaryfilesystem-ro.service
|
||||||
|
test-execute/exec-temporaryfilesystem-rw.service
|
||||||
|
test-execute/exec-temporaryfilesystem-usr.service
|
||||||
test-execute/exec-umask-0177.service
|
test-execute/exec-umask-0177.service
|
||||||
test-execute/exec-umask-default.service
|
test-execute/exec-umask-default.service
|
||||||
test-execute/exec-unsetenvironment.service
|
test-execute/exec-unsetenvironment.service
|
||||||
|
|
11
test/test-execute/exec-temporaryfilesystem-options.service
Normal file
11
test/test-execute/exec-temporaryfilesystem-options.service
Normal file
|
@ -0,0 +1,11 @@
|
||||||
|
[Unit]
|
||||||
|
Description=Test for TemporaryFileSystem with mount options
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
|
||||||
|
# Check /proc/self/mountinfo
|
||||||
|
ExecStart=/bin/sh -c 'test $$(awk \'$$5 == "/var" { print $$6 }\' /proc/self/mountinfo) = "ro,nodev,relatime"'
|
||||||
|
ExecStart=/bin/sh -c 'test $$(awk \'$$5 == "/var" { print $$11 }\' /proc/self/mountinfo) = "ro,mode=700"'
|
||||||
|
|
||||||
|
TemporaryFileSystem=/var:ro,mode=0700,nostrictatime
|
33
test/test-execute/exec-temporaryfilesystem-ro.service
Normal file
33
test/test-execute/exec-temporaryfilesystem-ro.service
Normal file
|
@ -0,0 +1,33 @@
|
||||||
|
[Unit]
|
||||||
|
Description=Test for TemporaryFileSystem with read-only mode
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
|
||||||
|
# Check directories exist
|
||||||
|
ExecStart=/bin/sh -c 'test -d /var/test-exec-temporaryfilesystem/rw && test -d /var/test-exec-temporaryfilesystem/ro'
|
||||||
|
|
||||||
|
# Check TemporaryFileSystem= are empty
|
||||||
|
ExecStart=/bin/sh -c 'for i in $$(ls -A /var); do test $$i = test-exec-temporaryfilesystem || false; done'
|
||||||
|
|
||||||
|
# Cannot create a file in /var
|
||||||
|
ExecStart=/bin/sh -c '! touch /var/hoge'
|
||||||
|
|
||||||
|
# Create a file in /var/test-exec-temporaryfilesystem/rw
|
||||||
|
ExecStart=/bin/sh -c 'touch /var/test-exec-temporaryfilesystem/rw/thisisasimpletest-temporaryfilesystem'
|
||||||
|
|
||||||
|
# Then, the file can be access through /tmp
|
||||||
|
ExecStart=/bin/sh -c 'test -f /tmp/thisisasimpletest-temporaryfilesystem'
|
||||||
|
|
||||||
|
# Also, through /var/test-exec-temporaryfilesystem/ro
|
||||||
|
ExecStart=/bin/sh -c 'test -f /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
|
||||||
|
|
||||||
|
# The file cannot modify through /var/test-exec-temporaryfilesystem/ro
|
||||||
|
ExecStart=/bin/sh -c '! touch /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
|
||||||
|
|
||||||
|
# Cleanup
|
||||||
|
ExecStart=/bin/sh -c 'rm /tmp/thisisasimpletest-temporaryfilesystem'
|
||||||
|
|
||||||
|
TemporaryFileSystem=/var:ro
|
||||||
|
BindPaths=/tmp:/var/test-exec-temporaryfilesystem/rw
|
||||||
|
BindReadOnlyPaths=/tmp:/var/test-exec-temporaryfilesystem/ro
|
33
test/test-execute/exec-temporaryfilesystem-rw.service
Normal file
33
test/test-execute/exec-temporaryfilesystem-rw.service
Normal file
|
@ -0,0 +1,33 @@
|
||||||
|
[Unit]
|
||||||
|
Description=Test for TemporaryFileSystem
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
|
||||||
|
# Check directories exist
|
||||||
|
ExecStart=/bin/sh -c 'test -d /var/test-exec-temporaryfilesystem/rw && test -d /var/test-exec-temporaryfilesystem/ro'
|
||||||
|
|
||||||
|
# Check TemporaryFileSystem= are empty
|
||||||
|
ExecStart=/bin/sh -c 'for i in $$(ls -A /var); do test $$i = test-exec-temporaryfilesystem || false; done'
|
||||||
|
|
||||||
|
# Create a file in /var
|
||||||
|
ExecStart=/bin/sh -c 'touch /var/hoge'
|
||||||
|
|
||||||
|
# Create a file in /var/test-exec-temporaryfilesystem/rw
|
||||||
|
ExecStart=/bin/sh -c 'touch /var/test-exec-temporaryfilesystem/rw/thisisasimpletest-temporaryfilesystem'
|
||||||
|
|
||||||
|
# Then, the file can be access through /tmp
|
||||||
|
ExecStart=/bin/sh -c 'test -f /tmp/thisisasimpletest-temporaryfilesystem'
|
||||||
|
|
||||||
|
# Also, through /var/test-exec-temporaryfilesystem/ro
|
||||||
|
ExecStart=/bin/sh -c 'test -f /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
|
||||||
|
|
||||||
|
# The file cannot modify through /var/test-exec-temporaryfilesystem/ro
|
||||||
|
ExecStart=/bin/sh -c '! touch /var/test-exec-temporaryfilesystem/ro/thisisasimpletest-temporaryfilesystem'
|
||||||
|
|
||||||
|
# Cleanup
|
||||||
|
ExecStart=/bin/sh -c 'rm /tmp/thisisasimpletest-temporaryfilesystem'
|
||||||
|
|
||||||
|
TemporaryFileSystem=/var
|
||||||
|
BindPaths=/tmp:/var/test-exec-temporaryfilesystem/rw
|
||||||
|
BindReadOnlyPaths=/tmp:/var/test-exec-temporaryfilesystem/ro
|
15
test/test-execute/exec-temporaryfilesystem-usr.service
Normal file
15
test/test-execute/exec-temporaryfilesystem-usr.service
Normal file
|
@ -0,0 +1,15 @@
|
||||||
|
[Unit]
|
||||||
|
Description=Test for TemporaryFileSystem on /usr
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
|
||||||
|
# Check TemporaryFileSystem= are empty
|
||||||
|
ExecStart=/bin/sh -c 'for i in $$(ls -A /usr); do test $$i = lib -o $$i = lib64 -o $$i = bin -o $$i = sbin || false; done'
|
||||||
|
|
||||||
|
# Cannot create files under /usr
|
||||||
|
ExecStart=/bin/sh -c '! touch /usr/hoge'
|
||||||
|
ExecStart=/bin/sh -c '! touch /usr/bin/hoge'
|
||||||
|
|
||||||
|
TemporaryFileSystem=/usr:ro
|
||||||
|
BindReadOnlyPaths=-/usr/lib -/usr/lib64 /usr/bin /usr/sbin
|
Loading…
Reference in a new issue