SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
66,847 Commits 2 Branches 1 Tag
fbaf3b23ae4aa79110ebd37aada70ce6a044c692
Commit Graph
30 Commits
Author SHA1 Message Date
Frantisek Sumsal 07268394d6 test: unify /testok & /failed handling 
And drop it where not necessary.
 2023-07-12 16:03:40 +02:00
Lennart Poettering f70c90f5ca analyze: add new "pcrs" verb 
It shows the PCRs we know about along with their name strings and
current values.
 2023-06-28 16:50:50 +02:00
Luca Boccassi d936595672 manager: restrict Dump*() to privileged callers or ratelimit 
Dump*() methods can take quite some time due to the amount of data to
serialize, so they can potentially stall the manager. Make them
privileged, as they are debugging tools anyway. Use a new 'dump'
capability for polkit, and the 'reload' capability for SELinux, as
that's also non-destructive but slow.

If the caller is not privileged, allow it but rate limited to 10 calls
every 10 minutes.
 2023-05-19 15:18:23 +01:00
Frantisek Sumsal cb153b4fe9 test: rename assert.sh to util.sh 
So we can extend it with additional utility functions without making it
confusing.

No functional change.
 2023-05-16 22:43:52 +02:00
Zbigniew Jędrzejewski-Szmek 128db0aa00 test: drop uses of "&& { echo 'unexpected success'; exit 1; }" 
Brief is sweet.
 2023-04-24 21:58:35 +02:00
Frantisek Sumsal f7f5657ece test: add a couple of basic sanity tests for the security verb 2023-04-16 09:21:13 +02:00
Lennart Poettering 3af48a86d9 Merge pull request #25608 from poettering/dissect-moar 
dissect: add dissection policies
 2023-04-12 13:46:08 +02:00
Yu Watanabe 1538136911 test: systemd-analyze blame should succeed now 2023-04-10 05:34:30 +09:00
Lennart Poettering a62e12dad1 analyze: add 'image-policy' tool for analyzing image dissection policies 2023-04-05 20:51:31 +02:00
Luca Boccassi f50535afad analyze: add 'malloc' verb to dump malloc_info() 
Gets the memory state of the manager:

root@image:~# systemd-analyze malloc
<malloc version=1>
<heap nr=0>
<sizes>
  <size from=33 to=33 total=396 count=12/>
  <unsorted from=20385 to=20385 total=20385 count=1/>
</sizes>
<total type=fast count=0 size=0/>
<total type=rest count=14 size=36589/>
<system type=current size=1691648/>
<system type=max size=1839104/>
<aspace type=total size=1691648/>
<aspace type=mprotect size=1691648/>
</heap>
<total type=fast count=0 size=0/>
<total type=rest count=14 size=36589/>
<total type=mmap count=0 size=0/>
<system type=current size=1691648/>
<system type=max size=1839104/>
<aspace type=total size=1691648/>
<aspace type=mprotect size=1691648/>
</malloc>
 2023-02-23 18:59:06 +00:00
joshuazivkovic a23be57de3 systemd-analyze: Add --json=, --table and -no-legend tests for plot 2023-01-18 14:33:08 +00:00
Zbigniew Jędrzejewski-Szmek a7eed3eca3 TEST-65: check cat-config operation in chroot 
This verifies the fix in 2075b6dd39.
 2022-12-07 12:38:10 +01:00
Frantisek Sumsal 8b1879bcd0 test: cover a couple of previously missed analyze code paths 2022-11-03 11:33:13 +01:00
Frantisek Sumsal 926d95cd4c test: cover legacy/deprecated systemd-analyze verbs 
They're no longer documented since 26e1e97345 but still work.
 2022-11-03 11:26:08 +01:00
Frantisek Sumsal 6c83054c01 test: add a sanity coverage for systemd-analyze verbs 2022-11-03 06:25:51 +09:00
Yu Watanabe cf906beaef test: add syscall filter tests for analyze security 2022-06-17 12:45:45 +09:00
Luca Boccassi 6a59dfa108 analyze security: print DeviceAllow list 
Many sandboxing options add implicit DeviceAllow rules, which might be confusing
for users running systemd-analyze security and not expecting it.
Print the list.

Fixes https://github.com/systemd/systemd/issues/23185
 2022-05-01 13:43:01 +09:00
Luca Boccassi 444d9abd06 analyze: fix crash with online security check 
1449b0f8a9 fixed seccomp arch check for the offline case,
but broke it for the normal case, as when coming from D-Bus the
list of seccomp architectures is already converted to string.

Fixes https://github.com/systemd/systemd/issues/23224
 2022-05-01 11:47:44 +09:00
Luca Boccassi 1449b0f8a9 analyze: fix offline check for 'native' syscall architecture 
Enum values are stored in the set, not strings
 2022-04-01 10:42:48 +01:00
Zbigniew Jędrzejewski-Szmek ec1574cd8e Merge pull request #21454 from bluca/inspect_elf 
analyze: add inspect-elf verb to parse package metadata
 2021-12-06 12:45:25 +01:00
Luca Boccassi cb94244406 test: run commands with debug level logs in TEST-65-ANALYZE 2021-12-01 12:06:36 +00:00
Luca Boccassi 917e655457 analyze: add inspect-elf verb to parse package metadata 
Parses and prints package metadata from executables, libraries and core files

$ systemd-analyze inspect-elf /tmp/core ../fsverity-utils/fsverityb /bin/bash --json=off --no-pager
__________________________
           path: /tmp/core
        elfType: coredump
elfArchitecture: AMD x86-64

    module name: /tmp/crash
           type: deb
           name: hello
        version: 1.0
   architecture: amd64
             os: debian
      osVersion: 11
        buildId: b33541096a09c29a0ba4ec5c69364a2711b7c269

    module name: /usr/lib/x86_64-linux-gnu/libc-2.31.so
           type: deb
           name: hello
        version: 1.0
   architecture: amd64
             os: debian
      osVersion: 11
        buildId: 54eef5ce96cf37cb175b0d93186836ca1caf470c

    module name: /usr/lib/x86_64-linux-gnu/ld-2.31.so
           type: deb
           name: hello
        version: 1.0
   architecture: amd64
             os: debian
      osVersion: 11
        buildId: 32438eb3b034da54caf58c7a65446639f7cfe274
__________________________________________________________________
           path: /home/luca/git/systemd/../fsverity-utils/fsverity
        elfType: executable
elfArchitecture: AMD x86-64

           type: deb
           name: fsverity-utils
        version: 1.3-1
   architecture: amd64
             os: debian
   debugInfoUrl: https://debuginfod.debian.net
        buildId: 05b899e6ee0d3653e20458719b202ed3ca8d566f
_________________________
           path: /bin/bash
        elfType: executable
elfArchitecture: AMD x86-64

        buildId: 4fef260f60e257d2dbd4126bf8add83837aea190
$
$ systemd-analyze inspect-elf /tmp/core ../fsverity-utils/fsverity /bin/bash /tmp/core.test-condition.1000.f9b9a84a9fd1482c9702d6afa6f6934b.37640.1637083078000000 --json=pretty --no-pager
{
	"elfType" : "coredump",
	"elfArchitecture" : "AMD x86-64",
	"/home/bluca/git/fsverity-utils/fsverity" : {
		"type" : "deb",
		"name" : "fsverity-utils",
		"version" : "1.3-1",
		"buildId" : "7c895ecd2a271f93e96268f479fdc3c64a2ec4ee"
	},
	"/home/bluca/git/fsverity-utils/libfsverity.so.0" : {
		"type" : "deb",
		"name" : "fsverity-utils",
		"version" : "1.3-1",
		"buildId" : "b5e428254abf14237b0ae70ed85fffbb98a78f88"
	}
}
{
	"elfType" : "executable",
	"elfArchitecture" : "AMD x86-64",
	"/home/bluca/git/systemd/../fsverity-utils/fsverity" : {
		"type" : "deb",
		"name" : "fsverity-utils",
		"version" : "1.3-1",
		"buildId" : "7c895ecd2a271f93e96268f479fdc3c64a2ec4ee"
	}
}
{
	"elfType" : "executable",
	"elfArchitecture" : "AMD x86-64",
	"/bin/bash" : {
		"buildId" : "3313b4cb119dcce16927a9b6cc61dcd97dfc4d59"
	}
}
{
	"elfType" : "coredump",
	"elfArchitecture" : "AMD x86-64"
}
 2021-11-30 23:14:07 +00:00
Luca Boccassi 0446921131 analyze: add --profile switch to security verb 
Allows to pass a portable profile when doing offline analysis of
units. Especially useful for analyzing portable images, since a
lot of the security-relevant settings in those cases come from
the profiles, but they are not shipped in the portable images.
 2021-11-26 18:17:26 +00:00
Albert Brox da845dabf5 implement aliasing for systemd-analyze verify 2021-11-08 12:08:23 +00:00
Luca Boccassi 82100ef486 analyze: allow a custom policy to skip a check with weight=0 
In some cases an offline analysis should ignore some fields, for example
a portable service in an image will never list RootImage/RootDirectory, as
they are added at runtime, and thus can be skipped.
 2021-11-05 22:37:34 +00:00
Luca Boccassi d54017e8f7 analyze: fix typos in test policy 2021-11-04 19:22:28 +00:00
Dimitri Papadopoulos ba669952b2 Typos found by codespell 2021-10-20 22:20:18 +09:00
Zbigniew Jędrzejewski-Szmek 7b3cec95db tests: add spdx headers to scripts and Makefiles 2021-10-18 09:04:45 +02:00
Anita Zhang 14bb729534 basic/unit-file: don't filter out names starting with dot 
Fixes #20859
Reverts 3796bdc55d
 2021-09-29 14:42:13 +02:00
Luca Boccassi 7728f6aa81 test: rename TEST-63-ANALYZE to solve conflict 
Two PRs adding TEST-63-* were merged more or less at the
same time, and we missed the conflict.
 2021-09-08 10:12:03 +09:00