Merge pull request #33916 from yuwata/import-creds-follow-ups

core: several follow-ups for ImportCreds=

src/core/dbus-execute.c

@@ -2225,7 +2225,7 @@ int bus_exec_context_set_transient_property(
                         if (!credential_glob_valid(glob))
                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Credential name or glob is invalid: %s", glob);
 
-                        if (rename && !credential_name_valid(rename))
+                        if (!isempty(rename) && !credential_name_valid(rename))
                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Credential name is invalid: %s", rename);
 
                         empty = false;

src/core/exec-credential.c

@@ -502,6 +502,11 @@ static int load_credential_glob(
                                 free_and_replace(fn, renamed);
                         }
 
+                        if (!credential_name_valid(fn)) {
+                                log_debug("Skipping credential with invalid name: %s", fn);
+                                continue;
+                        }
+
                         if (faccessat(write_dfd, fn, F_OK, AT_SYMLINK_NOFOLLOW) >= 0) {
                                 log_debug("Skipping credential with duplicated ID %s at %s", fn, *p);
                                 continue;

test/units/TEST-54-CREDS.sh

@@ -279,7 +279,38 @@ echo -n ignored >/run/credstore/test.creds.second
 mkdir -p /etc/credstore
 echo -n b >/etc/credstore/test.creds.second
 echo -n c >/etc/credstore/test.creds.third
+# Credential name cannot contain ':'
+echo -n hoge >/etc/credstore/test.creds.hoge:invalid
+
+# Check if credentials with invalid names are not imported.
 systemd-run -p "ImportCredential=test.creds.*" \
+            --unit=test-54-ImportCredential.service \
+            -p DynamicUser=1 \
+            --wait \
+            --pipe \
+            test ! -e '${CREDENTIALS_DIRECTORY}/test.creds.hoge:invalid'
+
+# Check if credentials with invalid names are not imported (with renaming).
+systemd-run -p "ImportCredentialEx=test.creds.*:renamed.creds." \
+            --unit=test-54-ImportCredential.service \
+            -p DynamicUser=1 \
+            --wait \
+            --pipe \
+            test ! -e '${CREDENTIALS_DIRECTORY}/renamed.creds.hoge:invalid'
+
+# Check that all valid credentials are imported.
+systemd-run -p "ImportCredential=test.creds.*" \
+            --unit=test-54-ImportCredential.service \
+            -p DynamicUser=1 \
+            --wait \
+            --pipe \
+            cat '${CREDENTIALS_DIRECTORY}/test.creds.first' \
+                '${CREDENTIALS_DIRECTORY}/test.creds.second' \
+                '${CREDENTIALS_DIRECTORY}/test.creds.third' >/tmp/ts54-concat
+cmp /tmp/ts54-concat <(echo -n abc)
+
+# Check that ImportCredentialEx= works without renaming.
+systemd-run -p "ImportCredentialEx=test.creds.*" \
             --unit=test-54-ImportCredential.service \
             -p DynamicUser=1 \
             --wait \
@@ -319,6 +350,19 @@ systemd-run -p "ImportCredentialEx=test.creds.first:renamed.creds.first" \
             cat '${CREDENTIALS_DIRECTORY}/renamed.creds.first' >/tmp/ts54-concat
 cmp /tmp/ts54-concat <(echo -n a)
 
+# Test that a credential can be imported multiple times with different names.
+systemd-run -p "ImportCredentialEx=test.creds.first" \
+            -p "ImportCredentialEx=test.creds.first:renamed.creds.first" \
+            -p "ImportCredentialEx=test.creds.first:renamed.creds.second" \
+            --unit=test-54-ImportCredential.service \
+            -p DynamicUser=1 \
+            --wait \
+            --pipe \
+            cat '${CREDENTIALS_DIRECTORY}/test.creds.first' \
+                '${CREDENTIALS_DIRECTORY}/renamed.creds.first' \
+                '${CREDENTIALS_DIRECTORY}/renamed.creds.second' >/tmp/ts54-concat
+cmp /tmp/ts54-concat <(echo -n aaa)
+
 # Now test encrypted credentials (only supported when built with OpenSSL though)
 if systemctl --version | grep -q -- +OPENSSL ; then
     echo -n $RANDOM >/tmp/test-54-plaintext