From b6dc25eebc1a0061fe62eca206b57ef21b33c154 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Sat, 3 Mar 2018 22:15:36 +0900 Subject: [PATCH 1/4] test-execute: rename tests for AmbientCapabilities= The unit files for test-execute are named like `exec-(setting-name-in-lower-character)-(optional-text).service`. However, test units for AmbientCapabilities= are not following this. So, let's rename them for the consistency. This does not change anything in the functionality of the test. --- src/test/test-execute.c | 12 ++++++------ test/meson.build | 12 ++++++------ ...exec-ambientcapabilities-merge-nfsnobody.service} | 0 ...=> exec-ambientcapabilities-merge-nobody.service} | 0 ...ervice => exec-ambientcapabilities-merge.service} | 0 ...ce => exec-ambientcapabilities-nfsnobody.service} | 0 ...rvice => exec-ambientcapabilities-nobody.service} | 0 ...tset.service => exec-ambientcapabilities.service} | 0 8 files changed, 12 insertions(+), 12 deletions(-) rename test/test-execute/{exec-capabilityambientset-merge-nfsnobody.service => exec-ambientcapabilities-merge-nfsnobody.service} (100%) rename test/test-execute/{exec-capabilityambientset-merge-nobody.service => exec-ambientcapabilities-merge-nobody.service} (100%) rename test/test-execute/{exec-capabilityambientset-merge.service => exec-ambientcapabilities-merge.service} (100%) rename test/test-execute/{exec-capabilityambientset-nfsnobody.service => exec-ambientcapabilities-nfsnobody.service} (100%) rename test/test-execute/{exec-capabilityambientset-nobody.service => exec-ambientcapabilities-nobody.service} (100%) rename test/test-execute/{exec-capabilityambientset.service => exec-ambientcapabilities.service} (100%) diff --git a/src/test/test-execute.c b/src/test/test-execute.c index d910471d1f..592b8d4be0 100644 --- a/src/test/test-execute.c +++ b/src/test/test-execute.c @@ -538,7 +538,7 @@ static void test_exec_capabilityboundingset(Manager *m) { test(m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED); } -static void test_exec_capabilityambientset(Manager *m) { +static void test_exec_ambientcapabilities(Manager *m) { int r; /* Check if the kernel has support for ambient capabilities. Run @@ -551,8 +551,8 @@ static void test_exec_capabilityambientset(Manager *m) { return; } - test(m, "exec-capabilityambientset.service", 0, CLD_EXITED); - test(m, "exec-capabilityambientset-merge.service", 0, CLD_EXITED); + test(m, "exec-ambientcapabilities.service", 0, CLD_EXITED); + test(m, "exec-ambientcapabilities-merge.service", 0, CLD_EXITED); if (!check_nobody_user_and_group()) { log_error_errno(errno, "nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); @@ -564,8 +564,8 @@ static void test_exec_capabilityambientset(Manager *m) { return; } - test(m, "exec-capabilityambientset-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); - test(m, "exec-capabilityambientset-merge-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); + test(m, "exec-ambientcapabilities-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); + test(m, "exec-ambientcapabilities-merge-" NOBODY_USER_NAME ".service", 0, CLD_EXITED); } static void test_exec_privatenetwork(Manager *m) { @@ -633,8 +633,8 @@ static int run_tests(UnitFileScope scope, const test_function_t *tests) { int main(int argc, char *argv[]) { _cleanup_(rm_rf_physical_and_freep) char *runtime_dir = NULL; static const test_function_t user_tests[] = { + test_exec_ambientcapabilities, test_exec_bindpaths, - test_exec_capabilityambientset, test_exec_capabilityboundingset, test_exec_cpuaffinity, test_exec_environment, diff --git a/test/meson.build b/test/meson.build index ac6a70d38d..f86cf388e0 100644 --- a/test/meson.build +++ b/test/meson.build @@ -45,13 +45,13 @@ test_data_files = ''' sockets.target son.service sysinit.target + test-execute/exec-ambientcapabilities-merge-nfsnobody.service + test-execute/exec-ambientcapabilities-merge-nobody.service + test-execute/exec-ambientcapabilities-merge.service + test-execute/exec-ambientcapabilities-nfsnobody.service + test-execute/exec-ambientcapabilities-nobody.service + test-execute/exec-ambientcapabilities.service test-execute/exec-bindpaths.service - test-execute/exec-capabilityambientset-merge-nfsnobody.service - test-execute/exec-capabilityambientset-merge-nobody.service - test-execute/exec-capabilityambientset-merge.service - test-execute/exec-capabilityambientset-nfsnobody.service - test-execute/exec-capabilityambientset-nobody.service - test-execute/exec-capabilityambientset.service test-execute/exec-capabilityboundingset-invert.service test-execute/exec-capabilityboundingset-merge.service test-execute/exec-capabilityboundingset-reset.service diff --git a/test/test-execute/exec-capabilityambientset-merge-nfsnobody.service b/test/test-execute/exec-ambientcapabilities-merge-nfsnobody.service similarity index 100% rename from test/test-execute/exec-capabilityambientset-merge-nfsnobody.service rename to test/test-execute/exec-ambientcapabilities-merge-nfsnobody.service diff --git a/test/test-execute/exec-capabilityambientset-merge-nobody.service b/test/test-execute/exec-ambientcapabilities-merge-nobody.service similarity index 100% rename from test/test-execute/exec-capabilityambientset-merge-nobody.service rename to test/test-execute/exec-ambientcapabilities-merge-nobody.service diff --git a/test/test-execute/exec-capabilityambientset-merge.service b/test/test-execute/exec-ambientcapabilities-merge.service similarity index 100% rename from test/test-execute/exec-capabilityambientset-merge.service rename to test/test-execute/exec-ambientcapabilities-merge.service diff --git a/test/test-execute/exec-capabilityambientset-nfsnobody.service b/test/test-execute/exec-ambientcapabilities-nfsnobody.service similarity index 100% rename from test/test-execute/exec-capabilityambientset-nfsnobody.service rename to test/test-execute/exec-ambientcapabilities-nfsnobody.service diff --git a/test/test-execute/exec-capabilityambientset-nobody.service b/test/test-execute/exec-ambientcapabilities-nobody.service similarity index 100% rename from test/test-execute/exec-capabilityambientset-nobody.service rename to test/test-execute/exec-ambientcapabilities-nobody.service diff --git a/test/test-execute/exec-capabilityambientset.service b/test/test-execute/exec-ambientcapabilities.service similarity index 100% rename from test/test-execute/exec-capabilityambientset.service rename to test/test-execute/exec-ambientcapabilities.service From 5cd33ccc2c67ff8d271d367510821bb2582840eb Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Sun, 4 Mar 2018 16:53:50 +0900 Subject: [PATCH 2/4] test-execute: change log level from error to notice Skipping some tests due to the missing e.g., capsh binary or kernel support, are not error. This changes the log level for such messages. --- src/test/test-execute.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/src/test/test-execute.c b/src/test/test-execute.c index 592b8d4be0..ce88e2ea07 100644 --- a/src/test/test-execute.c +++ b/src/test/test-execute.c @@ -248,7 +248,7 @@ static void test_exec_privatedevices(Manager *m) { * properly set, so be sure that it exists */ r = find_binary("capsh", NULL); if (r < 0) { - log_error_errno(r, "Could not find capsh binary, skipping remaining tests in %s: %m", __func__); + log_notice_errno(r, "Could not find capsh binary, skipping remaining tests in %s: %m", __func__); return; } @@ -272,7 +272,7 @@ static void test_exec_protectkernelmodules(Manager *m) { r = find_binary("capsh", NULL); if (r < 0) { - log_error_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); + log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); return; } @@ -382,12 +382,12 @@ static void test_exec_systemcallfilter_system(Manager *m) { test(m, "exec-systemcallfilter-system-user.service", 0, CLD_EXITED); if (!check_nobody_user_and_group()) { - log_error_errno(errno, "nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); + log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); return; } if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { - log_error("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); + log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); return; } @@ -399,12 +399,12 @@ static void test_exec_user(Manager *m) { test(m, "exec-user.service", 0, CLD_EXITED); if (!check_nobody_user_and_group()) { - log_error_errno(errno, "nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); + log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); return; } if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { - log_error("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); + log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); return; } @@ -415,12 +415,12 @@ static void test_exec_group(Manager *m) { test(m, "exec-group.service", 0, CLD_EXITED); if (!check_nobody_user_and_group()) { - log_error_errno(errno, "nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); + log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); return; } if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) { - log_error("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__); + log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__); return; } @@ -511,12 +511,12 @@ static void test_exec_runtimedirectory(Manager *m) { test(m, "exec-runtimedirectory-owner.service", 0, CLD_EXITED); if (!check_nobody_user_and_group()) { - log_error_errno(errno, "nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); + log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); return; } if (!STR_IN_SET(NOBODY_GROUP_NAME, "nobody", "nfsnobody", "nogroup")) { - log_error("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__); + log_notice("Unsupported nobody group name '%s', skipping remaining tests in %s", NOBODY_GROUP_NAME, __func__); return; } @@ -528,7 +528,7 @@ static void test_exec_capabilityboundingset(Manager *m) { r = find_binary("capsh", NULL); if (r < 0) { - log_error_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); + log_notice_errno(r, "Skipping %s, could not find capsh binary: %m", __func__); return; } @@ -547,7 +547,7 @@ static void test_exec_ambientcapabilities(Manager *m) { * in the first place for the tests. */ r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0); if (r < 0 && IN_SET(errno, EINVAL, EOPNOTSUPP, ENOSYS)) { - log_error("Skipping %s, the kernel does not support ambient capabilities", __func__); + log_notice("Skipping %s, the kernel does not support ambient capabilities", __func__); return; } @@ -555,12 +555,12 @@ static void test_exec_ambientcapabilities(Manager *m) { test(m, "exec-ambientcapabilities-merge.service", 0, CLD_EXITED); if (!check_nobody_user_and_group()) { - log_error_errno(errno, "nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); + log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__); return; } if (!STR_IN_SET(NOBODY_USER_NAME, "nobody", "nfsnobody")) { - log_error("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); + log_notice("Unsupported nobody user name '%s', skipping remaining tests in %s", NOBODY_USER_NAME, __func__); return; } @@ -573,7 +573,7 @@ static void test_exec_privatenetwork(Manager *m) { r = find_binary("ip", NULL); if (r < 0) { - log_error_errno(r, "Skipping %s, could not find ip binary: %m", __func__); + log_notice_errno(r, "Skipping %s, could not find ip binary: %m", __func__); return; } From b7856f9218e23fde0932072786b640fdef37582f Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 5 Mar 2018 00:00:35 +0900 Subject: [PATCH 3/4] test-execute: check capabilities before running tests Fixes #8193. --- src/test/test-execute.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/test/test-execute.c b/src/test/test-execute.c index ce88e2ea07..788249e885 100644 --- a/src/test/test-execute.c +++ b/src/test/test-execute.c @@ -24,6 +24,7 @@ #include #include +#include "capability-util.h" #include "cpu-set-util.h" #include "errno-list.h" #include "fileio.h" @@ -532,6 +533,13 @@ static void test_exec_capabilityboundingset(Manager *m) { return; } + if (have_effective_cap(CAP_CHOWN) <= 0 || + have_effective_cap(CAP_FOWNER) <= 0 || + have_effective_cap(CAP_KILL) <= 0) { + log_notice("Skipping %s, this process does not have enough capabilities", __func__); + return; + } + test(m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED); test(m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED); test(m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED); @@ -551,6 +559,12 @@ static void test_exec_ambientcapabilities(Manager *m) { return; } + if (have_effective_cap(CAP_NET_ADMIN) <= 0 || + have_effective_cap(CAP_NET_RAW) <= 0) { + log_notice("Skipping %s, this process does not have enough capabilities", __func__); + return; + } + test(m, "exec-ambientcapabilities.service", 0, CLD_EXITED); test(m, "exec-ambientcapabilities-merge.service", 0, CLD_EXITED); From e5ba1d324d3bda239907cd704a2f9646e777b820 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 5 Mar 2018 00:02:22 +0900 Subject: [PATCH 4/4] test-execute: use CAP_CHOWN instead of CAP_NET_ADMIN CAP_NET_ADMIN is somtrimes dropped by container runtime. This changes to use CAP_CHOWN instead of CAP_NET_ADMIN, as it is less likely to be dropped. --- src/test/test-execute.c | 2 +- .../exec-ambientcapabilities-merge-nfsnobody.service | 4 ++-- .../exec-ambientcapabilities-merge-nobody.service | 4 ++-- test/test-execute/exec-ambientcapabilities-merge.service | 4 ++-- test/test-execute/exec-ambientcapabilities-nfsnobody.service | 4 ++-- test/test-execute/exec-ambientcapabilities-nobody.service | 4 ++-- test/test-execute/exec-ambientcapabilities.service | 4 ++-- 7 files changed, 13 insertions(+), 13 deletions(-) diff --git a/src/test/test-execute.c b/src/test/test-execute.c index 788249e885..645e0b3d47 100644 --- a/src/test/test-execute.c +++ b/src/test/test-execute.c @@ -559,7 +559,7 @@ static void test_exec_ambientcapabilities(Manager *m) { return; } - if (have_effective_cap(CAP_NET_ADMIN) <= 0 || + if (have_effective_cap(CAP_CHOWN) <= 0 || have_effective_cap(CAP_NET_RAW) <= 0) { log_notice("Skipping %s, this process does not have enough capabilities", __func__); return; diff --git a/test/test-execute/exec-ambientcapabilities-merge-nfsnobody.service b/test/test-execute/exec-ambientcapabilities-merge-nfsnobody.service index 00bec581b5..d2cadebde4 100644 --- a/test/test-execute/exec-ambientcapabilities-merge-nfsnobody.service +++ b/test/test-execute/exec-ambientcapabilities-merge-nfsnobody.service @@ -2,8 +2,8 @@ Description=Test for AmbientCapabilities [Service] -ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb: 0000000000003000"' +ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb: 0000000000002001"' Type=oneshot User=nfsnobody -AmbientCapabilities=CAP_NET_ADMIN +AmbientCapabilities=CAP_CHOWN AmbientCapabilities=CAP_NET_RAW diff --git a/test/test-execute/exec-ambientcapabilities-merge-nobody.service b/test/test-execute/exec-ambientcapabilities-merge-nobody.service index 64964380e2..545081d629 100644 --- a/test/test-execute/exec-ambientcapabilities-merge-nobody.service +++ b/test/test-execute/exec-ambientcapabilities-merge-nobody.service @@ -2,8 +2,8 @@ Description=Test for AmbientCapabilities [Service] -ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb: 0000000000003000"' +ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb: 0000000000002001"' Type=oneshot User=nobody -AmbientCapabilities=CAP_NET_ADMIN +AmbientCapabilities=CAP_CHOWN AmbientCapabilities=CAP_NET_RAW diff --git a/test/test-execute/exec-ambientcapabilities-merge.service b/test/test-execute/exec-ambientcapabilities-merge.service index 22b4c6d49e..2e3fe59124 100644 --- a/test/test-execute/exec-ambientcapabilities-merge.service +++ b/test/test-execute/exec-ambientcapabilities-merge.service @@ -2,8 +2,8 @@ Description=Test for AmbientCapabilities (daemon) [Service] -ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb: 0000000000003000"' +ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb: 0000000000002001"' Type=oneshot User=daemon -AmbientCapabilities=CAP_NET_ADMIN +AmbientCapabilities=CAP_CHOWN AmbientCapabilities=CAP_NET_RAW diff --git a/test/test-execute/exec-ambientcapabilities-nfsnobody.service b/test/test-execute/exec-ambientcapabilities-nfsnobody.service index 614cfdd584..9377ee16b2 100644 --- a/test/test-execute/exec-ambientcapabilities-nfsnobody.service +++ b/test/test-execute/exec-ambientcapabilities-nfsnobody.service @@ -2,7 +2,7 @@ Description=Test for AmbientCapabilities [Service] -ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb: 0000000000003000"' +ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb: 0000000000002001"' Type=oneshot User=nfsnobody -AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW +AmbientCapabilities=CAP_CHOWN CAP_NET_RAW diff --git a/test/test-execute/exec-ambientcapabilities-nobody.service b/test/test-execute/exec-ambientcapabilities-nobody.service index d63f884ef8..07a6c7511d 100644 --- a/test/test-execute/exec-ambientcapabilities-nobody.service +++ b/test/test-execute/exec-ambientcapabilities-nobody.service @@ -2,7 +2,7 @@ Description=Test for AmbientCapabilities [Service] -ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb: 0000000000003000"' +ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb: 0000000000002001"' Type=oneshot User=nobody -AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW +AmbientCapabilities=CAP_CHOWN CAP_NET_RAW diff --git a/test/test-execute/exec-ambientcapabilities.service b/test/test-execute/exec-ambientcapabilities.service index 0a3cfa4bf6..d91cc09a48 100644 --- a/test/test-execute/exec-ambientcapabilities.service +++ b/test/test-execute/exec-ambientcapabilities.service @@ -2,7 +2,7 @@ Description=Test for AmbientCapabilities (daemon) [Service] -ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb: 0000000000003000"' +ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb: 0000000000002001"' Type=oneshot User=daemon -AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW +AmbientCapabilities=CAP_CHOWN CAP_NET_RAW