SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #30548 from yuwata/analyze-check-all-executables

Browse Source 
analyze: check all executables
This commit is contained in:
Yu Watanabe
2023-12-21 03:36:35 +09:00
committed by GitHub
parent 47ac844ee6 abf0ccc1c6
commit 935cf7b3a1
2 changed files with 26 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/analyze/analyze-verify-util.c
+11 -7
View File
@@ -201,19 +201,23 @@ static int verify_executables(Unit *u, const char *root) {
assert(u);
ExecCommand *exec =
u->type == UNIT_SOCKET ? SOCKET(u)->control_command :
u->type == UNIT_MOUNT ? MOUNT(u)->control_command :
u->type == UNIT_SWAP ? SWAP(u)->control_command : NULL;
RET_GATHER(r, verify_executable(u, exec, root));
if (u->type == UNIT_MOUNT)
FOREACH_ARRAY(i, MOUNT(u)->exec_command, ELEMENTSOF(MOUNT(u)->exec_command))
RET_GATHER(r, verify_executable(u, i, root));
if (u->type == UNIT_SERVICE)
FOREACH_ARRAY(i, SERVICE(u)->exec_command, ELEMENTSOF(SERVICE(u)->exec_command))
RET_GATHER(r, verify_executable(u, *i, root));
LIST_FOREACH(command, j, *i)
RET_GATHER(r, verify_executable(u, j, root));
if (u->type == UNIT_SOCKET)
FOREACH_ARRAY(i, SOCKET(u)->exec_command, ELEMENTSOF(SOCKET(u)->exec_command))
RET_GATHER(r, verify_executable(u, *i, root));
LIST_FOREACH(command, j, *i)
RET_GATHER(r, verify_executable(u, j, root));
if (u->type == UNIT_SWAP)
FOREACH_ARRAY(i, SWAP(u)->exec_command, ELEMENTSOF(SWAP(u)->exec_command))
RET_GATHER(r, verify_executable(u, i, root));
return r;
}
test/units/testsuite-65.sh
+15 -1
View File
@@ -179,7 +179,10 @@ systemd-analyze security --json=short | jq
if [[ ! -v ASAN_OPTIONS ]]; then
# check that systemd-analyze cat-config paths work in a chroot
mkdir -p /tmp/root
mount --rbind / /tmp/root
mount --bind / /tmp/root
if mountpoint -q /usr; then
mount --bind /usr /tmp/root/usr
fi
systemd-analyze cat-config systemd/system-preset >/tmp/out1
chroot /tmp/root systemd-analyze cat-config systemd/system-preset >/tmp/out2
diff /tmp/out{1,2}
@@ -334,6 +337,17 @@ systemd-analyze verify /tmp/hoge@test.service
(! systemd-analyze verify /tmp/hoge@nonexist.service)
(! systemd-analyze verify /tmp/hoge@.service)
# test that all commands are verified.
cat <<EOF >/tmp/multi-exec-start.service
[Service]
Type=oneshot
ExecStart=true
ExecStart=ls
EOF
systemd-analyze verify /tmp/multi-exec-start.service
echo 'ExecStart=command-should-not-exist' >>/tmp/multi-exec-start.service
(! systemd-analyze verify /tmp/multi-exec-start.service)
# Added an additional "INVALID_ID" id to the .json to verify that nothing breaks when input is malformed
# The PrivateNetwork id description and weight was changed to verify that 'security' is actually reading in
# values from the .json file when required. The default weight for "PrivateNetwork" is 2500, and the new weight