| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
| |
different
|
|
|
|
| |
Addresses part of #8983
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
This corresponds nicely with the specifiers we already pass for
/var/lib, /var/cache, /run and so on.
This is particular useful to update the test-path service files to
operate without guessable files, thus allowing multiple parallel
test-path invocations to pass without issues (the idea is to set $TMPDIR
early on in the test to some private directory, and then only use the
new %T or %V specifier to refer to it).
|
|\
| |
| | |
core: allow to specify RestrictNamespaces= multiple times
|
| | |
|
| |
| |
| |
| | |
Fixes #8679.
|
|/
|
|
|
| |
systemd silently strips out backslashes in variables from environment
files. Add a testcase that explicitly tests for this behaviour.
|
| |
|
| |
|
|
|
| |
Follow-up for 250e9fadbcc0ca90e697d7efb40855b054ed3b8f.
|
|
|
|
|
| |
We synthesize the passwd record for UID 0, hence we need to compare with
our synthesized data and not with the data stored in /etc/passwd
|
|
|
|
|
|
|
|
|
| |
We go through the whole file system, so this test can take arbitrary time. But
this test is still quite useful, so let's at least try to make it more efficent
by not descending at all into the directories we would filter out later on
anyway.
Also increase the timeout, in case the previous step doesn't help enough.
|
|
|
|
|
| |
This is not meant to be comprehensive, just the few cases where the /bin/sh -c wrapper
is obviously superfluous.
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Absolute paths make everything simple and quick, but sometimes this requirement
can be annoying. A good example is calling 'test', which will be located in
/usr/bin/ or /bin depending on the distro. The need the provide the full path
makes it harder a portable unit file in such cases.
This patch uses a fixed search path (DEFAULT_PATH which was already used as the
default value of $PATH), and if a non-absolute file name is found, it is
immediately resolved to a full path using this search path when the unit is
loaded. After that, everything behaves as if an absolute path was specified. In
particular, the executable must exist when the unit is loaded.
|
|
|
|
| |
The lines would cause the whole service to fail to be loaded.
|
|
|
| |
Signed-off-by: Neil Sun <neilsun@yunify.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
It's always visible:
$ sudo modprobe sit
$ sudo unshare -n ip l
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN mode DEFAULT group default qlen 1000
...
2: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN mode DEFAULT group default qlen 1000
...
|
|
|
|
|
|
| |
grep already indicates if it matched anything by return value.
Additional advantage is then that if the test fails, the unexpected
matching lines are visible in the log output.
|
|
|
|
|
|
|
| |
Also fix one case where the presence of a newline was used to generate
an invalid environment assignment.
Tested: with mkosi, which builds the local tree and run ninja tests.
|
|
|
|
|
|
| |
CAP_NET_ADMIN is somtrimes dropped by container runtime.
This changes to use CAP_CHOWN instead of CAP_NET_ADMIN, as it is
less likely to be dropped.
|
|
|
|
|
|
|
|
| |
The unit files for test-execute are named like
`exec-(setting-name-in-lower-character)-(optional-text).service`.
However, test units for AmbientCapabilities= are not following this.
So, let's rename them for the consistency.
This does not change anything in the functionality of the test.
|
|
|
|
|
|
| |
The nobody user/group may not synthesized by systemd.
To run tests the functionalities in such situation, this adds tests
by user/group by daemon, as it is expected to exists all environments.
|
| |
|
|
|
|
| |
Follow-up for 932329865741054f52dee2e7fc9bd6159b791fee.
|
| |
|
|
|
|
|
| |
Apparently, world-writable bpffs is intended by the kernel folks, hence
let's make sure we don't choke on it on our tests.
|
|
|
|
|
|
| |
This makes test-execute work on SELinux enabled systems.
Fixes the issue reported at
https://github.com/systemd/systemd/pull/7908#discussion_r169583540
|
| |
|
|
|
|
|
|
| |
We currently look for "nobody" and "nfsnobody" when testing groups, both
of which do not exist on Ubuntu, our main testing environment. Let's
extend the tests slightly to also use "nogroup" if it exists.
|
| |
|
|
|
|
| |
Test for 949befd3f09e8c06a908ec99efd241666c21d944.
|
|
|
|
|
|
| |
This makes rename the test units by a consistent naming scheme,
add several logs, and sort internal functions.
No functional change.
|
| |
|
| |
|
| |
|
|
|
|
|
|
| |
Change python3 path from /bin/python3 to /usr/bin/python3 to make
the test work on Ubuntu Xenial.
Follow-up for #7178.
|
| |
|
| |
|
| |
|
|
|
|
|
| |
(Also, sort list of test unit files in meson.build alphabetically, to
make future additions more systematic)
|
| |
|
|
|
|
| |
Follow-up for a8cabc612b16834260831a8163ae4b479b5c33a5.
|
|
|
|
|
|
|
|
|
|
|
| |
Also, tests for DynamicUser= should really run for system mode, as we
allocate from a system resource.
(This also increases the test timeout to 2min. If one of our tests
really hangs then waiting for 2min longer doesn't hurt either. The old
2s is really short, given that we run in potentially slow VM
environments for this test. This becomes noticable when the slow "find"
command this adds is triggered)
|
| |
|
|
|
| |
Test case for PR #5985.
|
|
|
| |
Closes #5856.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
PermissionsStartOnly= (#5309)
ReadOnlyPaths=, ProtectHome=, InaccessiblePaths= and ProtectSystem= are
about restricting access and little more, hence they should be disabled
if PermissionsStartOnly= is used or ExecStart= lines are prefixed with a
"+". Do that.
(Note that we will still create namespaces and stuff, since that's about
a lot more than just permissions. We'll simply disable the effect of
the four options mentioned above, but nothing else mount related.)
This also adds a test for this, to ensure this works as intended.
No documentation updates, as the documentation are already vague enough
to support the new behaviour ("If true, the permission-related execution
options…"). We could clarify this further, but I think we might want to
extend the switches' behaviour a bit more in future, hence leave it at
this for now.
Fixes: #5308
|