Christian Brauner
5439911f59
Add TEST-90-RESTRICT-FSACCESS with two subtests: config subtest — Tests PID1's RestrictFileSystemAccess= configuration parsing and failure modes via system.conf drop-ins and daemon-reexec: - Default RestrictFileSystemAccess=no produces no log messages - RestrictFileSystemAccess=yes without BPF LSM logs appropriate warning - RestrictFileSystemAccess=yes without require_signatures is correctly rejected by the test helper binary's precondition check enforce subtest — Tests actual BPF LSM enforcement using a test helper binary (test-bpf-restrict-fsaccess) that loads the BPF skeleton with initramfs_s_dev set to the rootfs s_dev, pins BPF links, and exits: - Execution from rootfs continues to work (trusted via initramfs_s_dev) - Execution from tmpfs is blocked with EPERM - Execution from a signed dm-verity device is allowed, driven via systemd-run -p RootImage= against the pre-built signed minimal_0 images that mkosi ships and signs at image build time (no on-the-fly squashfs / verity hash tree / signature build required) - After BPF detach, enforcement is lifted All tests skip gracefully when prerequisites are not met (BPF LSM, BPF framework, dm-verity tools, signing keys). Signed-off-by: Christian Brauner <brauner@kernel.org>
12 lines
203 B
Bash
Executable File
12 lines
203 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
set -eux
|
|
set -o pipefail
|
|
|
|
# shellcheck source=test/units/test-control.sh
|
|
. "$(dirname "$0")"/test-control.sh
|
|
|
|
run_subtests
|
|
|
|
touch /testok
|