From c538fecc617d7a5fe0048b1df49f69dead92353f Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Wed, 6 Mar 2024 15:04:22 +0100 Subject: [PATCH 1/2] ci: make the build dir accessible when running w/o privileges Otherwise the unprivileged part of test-execute gets silently skipped: /* test_run_tests_unprivileged */ Successfully forked off '(test-execute-unprivileged)' as PID 20998. ... pin_callout_binary: build dir binary: /home/runner/work/systemd/systemd/build/systemd-executor pin_callout_binary: open(/home/runner/work/systemd/systemd/build/systemd-executor)=-13 Failed to pin executor binary: No such file or directory (test-execute-unprivileged): manager_new, skipping tests: No such file or directory (test-execute-unprivileged) succeeded. --- .github/workflows/unit_tests.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/unit_tests.sh b/.github/workflows/unit_tests.sh index c1a5ede383..a416396021 100755 --- a/.github/workflows/unit_tests.sh +++ b/.github/workflows/unit_tests.sh @@ -53,6 +53,11 @@ for phase in "${PHASES[@]}"; do apt-get -y build-dep systemd apt-get -y install "${ADDITIONAL_DEPS[@]}" pip3 install -r .github/workflows/requirements.txt --require-hashes + + # Make sure the build dir is accessible even when drop privileges, otherwise the unprivileged + # part of test-execute gets skipped, since it can't run systemd-executor + chmod o+x /home/runner + capsh --drop=all -- -c "stat $PWD/meson.build" ;; RUN|RUN_GCC|RUN_CLANG|RUN_CLANG_RELEASE) if [[ "$phase" =~ ^RUN_CLANG ]]; then From 7161af9612d2d4f79cfbe8ed34ea7614d08901f7 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Wed, 6 Mar 2024 15:21:10 +0100 Subject: [PATCH 2/2] ci: explicitly change oom-{score}-adj before running tests For some reason root in GH actions is able to _decrease_ its oom score even after dropping all capabilities (including CAP_SYS_RESOURCE), until the oom score is changed explicitly after sudo: $ systemd-detect-virt microsoft $ sudo su - ~# capsh --drop=all -- -c 'capsh --print; grep -H . /proc/self/oom*; choom -p $$ -n -101' Current: = Bounding set = Ambient set = Current IAB: !cap_chown,!cap_dac_override,!cap_dac_read_search,...,!cap_sys_resource,...,!cap_checkpoint_restore Securebits: 00/0x0/1'b0 secure-noroot: no (unlocked) secure-no-suid-fixup: no (unlocked) secure-keep-caps: no (unlocked) secure-no-ambient-raise: no (unlocked) uid=0(root) euid=0(root) gid=0(root) groups=0(root) Guessed mode: UNCERTAIN (0) /proc/self/oom_adj:8 /proc/self/oom_score:1000 /proc/self/oom_score_adj:500 pid 22180's OOM score adjust value changed from 500 to -101 ~# choom -p $$ -n 500 pid 22027's OOM score adjust value changed from 500 to 500 ~# capsh --drop=all -- -c 'capsh --print; grep -H . /proc/self/oom*; choom -p $$ -n -101' Current: = Bounding set = Ambient set = ... uid=0(root) euid=0(root) gid=0(root) groups=0(root) Guessed mode: UNCERTAIN (0) /proc/self/oom_adj:8 /proc/self/oom_score:1000 /proc/self/oom_score_adj:500 choom: failed to set score adjust value: Permission denied I have no idea what's going on, but it breaks exec-oomscoreadjust-negative.service from test-execute when running unprivileged. --- .github/workflows/unit_tests.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/unit_tests.sh b/.github/workflows/unit_tests.sh index a416396021..cf9dd19151 100755 --- a/.github/workflows/unit_tests.sh +++ b/.github/workflows/unit_tests.sh @@ -42,6 +42,12 @@ set -ex MESON_ARGS=(-Dcryptolib=${CRYPTOLIB:-auto}) +# (Re)set the current oom-{score-}adj. For some reason root on GH actions is able to _decrease_ +# its oom-score even after dropping all capabilities (including CAP_SYS_RESOURCE), until the +# score is explicitly changed after sudo. No idea what's going on, but it breaks +# exec-oomscoreadjust-negative.service from test-execute when running unprivileged. +choom -p $$ -n 0 + for phase in "${PHASES[@]}"; do case $phase in SETUP)