From e4d216f2dc3ffbb9979cf6830215e0c29fd9963d Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Mon, 4 Dec 2023 19:23:54 +0100 Subject: [PATCH 1/2] Revert "sysusers.d: create the user for systemd-journal-upload.service" I have no idea what was my reasoning that led to this change, but it is simply wrong: systemd-journal-upload.service uses User=systemd-journal-upload together with DynamicUser=yes, so the user doesn't have to (and shouldn't) exist before starting the service. See: - https://github.com/systemd/systemd/commit/941afc4b902af21b0675e9e5d417c2ee6b202f30 - https://src.fedoraproject.org/rpms/systemd/c/db8b8fe77ce30244ad82e70ec4e8302b0c9dbf41 This reverts commit 5b9dfd33c6cd4d32ee1fd3681b570e09401c885d. --- sysusers.d/systemd-remote.conf | 1 - 1 file changed, 1 deletion(-) diff --git a/sysusers.d/systemd-remote.conf b/sysusers.d/systemd-remote.conf index 341ae4e0a1..ca20c24896 100644 --- a/sysusers.d/systemd-remote.conf +++ b/sysusers.d/systemd-remote.conf @@ -6,4 +6,3 @@ # (at your option) any later version. u systemd-journal-remote - "systemd Journal Remote" -u systemd-journal-upload - "systemd Journal Upload" From 52c1fb6885e40ffa9fa65f7798608cf651e05c3a Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Mon, 4 Dec 2023 21:33:15 +0100 Subject: [PATCH 2/2] test: set correct group for systemd-journal-upload tests We can't use the systemd-journal-upload user here, since it's created dynamically by DynamicUser=yes. However, we can use the group specified in SupplementaryGroups=, so do exactly that. --- test/test-functions | 5 +++-- test/units/testsuite-04.journal-remote.sh | 7 ++++--- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/test/test-functions b/test/test-functions index 556346d7d5..42b0038789 100644 --- a/test/test-functions +++ b/test/test-functions @@ -157,6 +157,7 @@ BASICTOOLS=( bash capsh cat + chgrp chmod chown chroot @@ -2870,14 +2871,14 @@ inst_binary() { # Same as above, but we need to wrap certain libraries unconditionally # - # chown, getent, login, setfacl, su, useradd, userdel + # chgrp, chown, getent, login, setfacl, su, useradd, userdel # - dlopen() (not only) systemd's PAM modules # ls, mkfs.*, mksquashfs, mkswap, setpriv, stat # - pull in nss_systemd with certain options (like ls -l) when # nsswitch.conf uses [SUCCESS=merge] (like on Arch Linux) # delv, dig - pull in nss_resolve if `resolve` is in nsswitch.conf # tar - called by machinectl in TEST-25 - bin_rx='/(agetty|chown|curl|delv|dig|getfacl|getent|id|login|ls|mkfs\.[a-z0-9]+|mksquashfs|mkswap|setfacl|setpriv|stat|su|tar|useradd|userdel)$' + bin_rx='/(agetty|chgrp|chown|curl|delv|dig|getfacl|getent|id|login|ls|mkfs\.[a-z0-9]+|mksquashfs|mkswap|setfacl|setpriv|stat|su|tar|useradd|userdel)$' if get_bool "$IS_BUILT_WITH_ASAN" && [[ "$bin" =~ $bin_rx ]]; then wrap_binary=1 # Ugh, so we want to disable LSan in most cases for the wrapped binaries, since diff --git a/test/units/testsuite-04.journal-remote.sh b/test/units/testsuite-04.journal-remote.sh index c543129da9..b7d9cbd81b 100755 --- a/test/units/testsuite-04.journal-remote.sh +++ b/test/units/testsuite-04.journal-remote.sh @@ -161,8 +161,8 @@ openssl x509 -req -days 7 \ -CA /run/systemd/remote-pki/ca.crt \ -CAkey /run/systemd/remote-pki/ca.key \ -out /run/systemd/remote-pki/server.crt -setfacl -R -m "u:systemd-journal-remote:rwX" /run/systemd/remote-pki -setfacl -R -m "u:systemd-journal-upload:rwX" /run/systemd/remote-pki +chown -R systemd-journal-remote:systemd-journal /run/systemd/remote-pki +chmod -R g+rwX /run/systemd/remote-pki # Reconfigure journal-upload/journal remote with the new keys cat >/run/systemd/journal-remote.conf.d/99-test.conf </run/systemd/system/systemd-journal-upload.service.d/99-test.conf <