Merge pull request #7908 from yuwata/rfe-7895

core: add TemporaryFileSystem= setting and 'tmpfs' option to ProtectHome=

src/test/test-execute.c

@@ -276,6 +276,14 @@ static void test_exec_inaccessiblepaths(Manager *m) {
         test(m, "exec-inaccessiblepaths-mount-propagation.service", 0, CLD_EXITED);
 }
 
+static void test_exec_temporaryfilesystem(Manager *m) {
+
+        test(m, "exec-temporaryfilesystem-options.service", 0, CLD_EXITED);
+        test(m, "exec-temporaryfilesystem-ro.service", 0, CLD_EXITED);
+        test(m, "exec-temporaryfilesystem-rw.service", 0, CLD_EXITED);
+        test(m, "exec-temporaryfilesystem-usr.service", 0, CLD_EXITED);
+}
+
 static void test_exec_systemcallfilter(Manager *m) {
 #if HAVE_SECCOMP
         if (!is_seccomp_available()) {
@@ -569,6 +577,7 @@ int main(int argc, char *argv[]) {
                 test_exec_supplementarygroups,
                 test_exec_systemcallerrornumber,
                 test_exec_systemcallfilter,
+                test_exec_temporaryfilesystem,
                 test_exec_umask,
                 test_exec_unsetenvironment,
                 test_exec_user,

src/test/test-mount-util.c

@@ -261,6 +261,60 @@ static void test_path_is_mount_point(void) {
         assert_se(rm_rf(tmp_dir, REMOVE_ROOT|REMOVE_PHYSICAL) == 0);
 }
 
+static void test_mount_option_mangle(void) {
+        char *opts = NULL;
+        unsigned long f;
+
+        assert_se(mount_option_mangle(NULL, MS_RDONLY|MS_NOSUID, &f, &opts) == 0);
+        assert_se(f == (MS_RDONLY|MS_NOSUID));
+        assert_se(opts == NULL);
+
+        assert_se(mount_option_mangle("", MS_RDONLY|MS_NOSUID, &f, &opts) == 0);
+        assert_se(f == (MS_RDONLY|MS_NOSUID));
+        assert_se(opts == NULL);
+
+        assert_se(mount_option_mangle("ro,nosuid,nodev,noexec", 0, &f, &opts) == 0);
+        assert_se(f == (MS_RDONLY|MS_NOSUID|MS_NODEV|MS_NOEXEC));
+        assert_se(opts == NULL);
+
+        assert_se(mount_option_mangle("ro,nosuid,nodev,noexec,mode=755", 0, &f, &opts) == 0);
+        assert_se(f == (MS_RDONLY|MS_NOSUID|MS_NODEV|MS_NOEXEC));
+        assert_se(streq(opts, "mode=755"));
+        opts = mfree(opts);
+
+        assert_se(mount_option_mangle("rw,nosuid,foo,hogehoge,nodev,mode=755", 0, &f, &opts) == 0);
+        assert_se(f == (MS_NOSUID|MS_NODEV));
+        assert_se(streq(opts, "foo,hogehoge,mode=755"));
+        opts = mfree(opts);
+
+        assert_se(mount_option_mangle("rw,nosuid,nodev,noexec,relatime,net_cls,net_prio", MS_RDONLY, &f, &opts) == 0);
+        assert_se(f == (MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_RELATIME));
+        assert_se(streq(opts, "net_cls,net_prio"));
+        opts = mfree(opts);
+
+        assert_se(mount_option_mangle("rw,nosuid,nodev,relatime,size=1630748k,mode=700,uid=1000,gid=1000", MS_RDONLY, &f, &opts) == 0);
+        assert_se(f == (MS_NOSUID|MS_NODEV|MS_RELATIME));
+        assert_se(streq(opts, "size=1630748k,mode=700,uid=1000,gid=1000"));
+        opts = mfree(opts);
+
+        assert_se(mount_option_mangle("size=1630748k,rw,gid=1000,,,nodev,relatime,,mode=700,nosuid,uid=1000", MS_RDONLY, &f, &opts) == 0);
+        assert_se(f == (MS_NOSUID|MS_NODEV|MS_RELATIME));
+        assert_se(streq(opts, "size=1630748k,gid=1000,mode=700,uid=1000"));
+        opts = mfree(opts);
+
+        assert_se(mount_option_mangle("rw,exec,size=8143984k,nr_inodes=2035996,mode=755", MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, &f, &opts) == 0);
+        assert_se(f == (MS_NOSUID|MS_NODEV));
+        assert_se(streq(opts, "size=8143984k,nr_inodes=2035996,mode=755"));
+        opts = mfree(opts);
+
+        assert_se(mount_option_mangle("rw,relatime,fmask=0022,,,dmask=0022", MS_RDONLY, &f, &opts) == 0);
+        assert_se(f == MS_RELATIME);
+        assert_se(streq(opts, "fmask=0022,dmask=0022"));
+        opts = mfree(opts);
+
+        assert_se(mount_option_mangle("rw,relatime,fmask=0022,dmask=0022,\"hogehoge", MS_RDONLY, &f, &opts) < 0);
+}
+
 int main(int argc, char *argv[]) {
 
         log_set_max_level(LOG_DEBUG);
@@ -275,6 +329,7 @@ int main(int argc, char *argv[]) {
 
         test_mnt_id();
         test_path_is_mount_point();
+        test_mount_option_mangle();
 
         return 0;
 }

src/test/test-ns.c

@@ -86,6 +86,7 @@ int main(int argc, char *argv[]) {
                             (char **) inaccessible,
                             NULL,
                             &(BindMount) { .source = (char*) "/usr/bin", .destination = (char*) "/etc/systemd", .read_only = true }, 1,
+                            &(TemporaryFileSystem) { .path = (char*) "/var", .options = (char*) "ro" }, 1,
                             tmp_dir,
                             var_tmp_dir,
                             PROTECT_HOME_NO,