test/units/TEST-34-DYNAMICUSERMIGRATE.sh

   1 #!/usr/bin/env bash
   2 # SPDX-License-Identifier: LGPL-2.1-or-later
   3 set -eux
   4 set -o pipefail
   5
   6 systemd-analyze log-level debug
   7
   8 test_directory() {
   9     local directory="$1"
  10     local path="$2"
  11
  12     # cleanup for previous invocation
  13     for i in xxx xxx2 yyy zzz x:yz x:yz2; do
  14         rm -rf "${path:?}/${i}" "${path:?}/private/${i}"
  15     done
  16
  17     # Set everything up without DynamicUser=1
  18
  19     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz touch "${path}"/zzz/test
  20     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz test -f "${path}"/zzz/test
  21     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz -p TemporaryFileSystem="${path}" test -f "${path}"/zzz/test
  22     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz:yyy test -f "${path}"/yyy/test
  23     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}=zzz:xxx zzz:xxx2" -p TemporaryFileSystem="${path}" bash -c "test -f ${path}/xxx/test && test -f ${path}/xxx2/test"
  24     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz:xxx -p TemporaryFileSystem="${path}":ro test -f "${path}"/xxx/test
  25     (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing)
  26     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" test -d "${path}"/www
  27     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" test -L "${path}"/ro
  28     (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" sh -c "echo foo > ${path}/www/test-missing")
  29
  30     test -d "${path}"/zzz
  31     test ! -L "${path}"/zzz
  32     test ! -e "${path}"/private/zzz
  33
  34     test ! -e "${path}"/xxx
  35     test ! -e "${path}"/private/xxx
  36     test ! -e "${path}"/xxx2
  37     test ! -e "${path}"/private/xxx2
  38     test -L "${path}"/yyy
  39     test ! -e "${path}"/private/yyy
  40
  41     test -f "${path}"/zzz/test
  42     test ! -e "${path}"/zzz/test-missing
  43
  44     # Convert to DynamicUser=1
  45
  46     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"=zzz test -f "${path}"/zzz/test
  47     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"=zzz -p TemporaryFileSystem="${path}" test -f "${path}"/zzz/test
  48     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"=zzz:yyy test -f "${path}"/yyy/test
  49     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}=zzz:xxx zzz:xxx2" \
  50                 -p TemporaryFileSystem="${path}" -p EnvironmentFile=-/usr/lib/systemd/systemd-asan-env bash -c "test -f ${path}/xxx/test && test -f ${path}/xxx2/test"
  51     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"=zzz:xxx -p TemporaryFileSystem="${path}":ro test -f "${path}"/xxx/test
  52     (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing)
  53     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"="www::ro www:ro:ro" test -d "${path}"/www
  54     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"="www::ro www:ro:ro" test -L "${path}"/ro
  55     (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=1 -p "${directory}"="www::ro www:ro:ro" sh -c "echo foo > ${path}/www/test-missing")
  56
  57     test -L "${path}"/zzz
  58     test -d "${path}"/private/zzz
  59
  60     test ! -e "${path}"/xxx
  61     test ! -e "${path}"/private/xxx
  62     test ! -e "${path}"/xxx2
  63     test ! -e "${path}"/private/xxx2
  64     test -L "${path}"/yyy # previous symlink is not removed
  65     test ! -e "${path}"/private/yyy
  66
  67     test -f "${path}"/zzz/test
  68     test ! -e "${path}"/zzz/test-missing
  69
  70     # Convert back
  71
  72     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz test -f "${path}"/zzz/test
  73     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz -p TemporaryFileSystem="${path}" test -f "${path}"/zzz/test
  74     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz:yyy test -f "${path}"/yyy/test
  75     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz:xxx -p TemporaryFileSystem="${path}" test -f "${path}"/xxx/test
  76     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}=zzz:xxx zzz:xxx2" -p TemporaryFileSystem="${path}" bash -c "test -f ${path}/xxx/test && test -f ${path}/xxx2/test"
  77     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz:xxx -p TemporaryFileSystem="${path}":ro test -f "${path}"/xxx/test
  78     (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"=zzz test -f "${path}"/zzz/test-missing)
  79     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" test -d "${path}"/www
  80     systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" test -L "${path}"/ro
  81     (! systemd-run --wait -p RuntimeDirectoryPreserve=yes -p DynamicUser=0 -p "${directory}"="www::ro www:ro:ro" sh -c "echo foo > ${path}/www/test-missing")
  82
  83     test -d "${path}"/zzz
  84     test ! -L "${path}"/zzz
  85     test ! -e "${path}"/private/zzz
  86
  87     test ! -e "${path}"/xxx
  88     test ! -e "${path}"/private/xxx
  89     test ! -e "${path}"/xxx2
  90     test ! -e "${path}"/private/xxx2
  91     test -L "${path}"/yyy
  92     test ! -e "${path}"/private/yyy
  93
  94     test -f "${path}"/zzz/test
  95     test ! -e "${path}"/zzz/test-missing
  96     test -d "${path}"/www
  97     test ! -e "${path}"/www/test-missing
  98
  99     # Exercise the unit parsing paths too
 100     cat >/run/systemd/system/testservice-34.service <<EOF
 101 [Service]
 102 Type=oneshot
 103 TemporaryFileSystem=${path}
 104 RuntimeDirectoryPreserve=yes
 105 ${directory}=zzz:x\:yz zzz:x\:yz2 www::ro www:ro:ro
 106 ExecStart=test -f ${path}/x:yz2/test
 107 ExecStart=test -f ${path}/x:yz/test
 108 ExecStart=test -f ${path}/zzz/test
 109 ExecStart=test -d ${path}/www
 110 ExecStart=test -L ${path}/ro
 111 ExecStart=sh -c "! test -w ${path}/www"
 112 EOF
 113     systemctl daemon-reload
 114     systemctl start --wait testservice-34.service
 115
 116     test -d "${path}"/zzz
 117     test ! -L "${path}"/zzz
 118     test ! -e "${path}"/private/zzz
 119
 120     test ! -L "${path}"/x:yz
 121     test ! -L "${path}"/x:yz2
 122 }
 123
 124 test_check_writable() {
 125     # cleanup for previous invocation
 126     for i in aaa quux waldo xxx; do
 127         rm -rf "/var/lib/$i" "/var/lib/private/$i"
 128     done
 129
 130     cat >/run/systemd/system/testservice-34-check-writable.service <<\EOF
 131 [Unit]
 132 Description=Check writable directories when DynamicUser= with StateDirectory=
 133
 134 [Service]
 135 # Relevant only for sanitizer runs
 136 EnvironmentFile=-/usr/lib/systemd/systemd-asan-env
 137
 138 Type=oneshot
 139 DynamicUser=yes
 140 StateDirectory=waldo quux/pief aaa/bbb aaa aaa/ccc xxx/yyy:aaa/111 xxx:aaa/222 xxx/zzz:aaa/333
 141
 142 # Make sure that the state directories are really the only writable directory besides the obvious candidates
 143 ExecStart=bash -c ' \
 144     set -eux; \
 145     set -o pipefail; \
 146     declare -a writable_dirs; \
 147     readarray -t writable_dirs < <(find / \( -path /var/tmp -o -path /tmp -o -path /proc -o -path /dev/mqueue -o -path /dev/shm -o \
 148                                               -path /sys/fs/bpf -o -path /dev/.lxc -o -path /sys/devices/system/cpu \) \
 149                                    -prune -o -type d -writable -print 2>/dev/null | sort -u); \
 150     [[ "$${#writable_dirs[@]}" == "8" ]]; \
 151     [[ "$${writable_dirs[0]}" == "/var/lib/private/aaa" ]]; \
 152     [[ "$${writable_dirs[1]}" == "/var/lib/private/aaa/bbb" ]]; \
 153     [[ "$${writable_dirs[2]}" == "/var/lib/private/aaa/ccc" ]]; \
 154     [[ "$${writable_dirs[3]}" == "/var/lib/private/quux/pief" ]]; \
 155     [[ "$${writable_dirs[4]}" == "/var/lib/private/waldo" ]]; \
 156     [[ "$${writable_dirs[5]}" == "/var/lib/private/xxx" ]]; \
 157     [[ "$${writable_dirs[6]}" == "/var/lib/private/xxx/yyy" ]]; \
 158     [[ "$${writable_dirs[7]}" == "/var/lib/private/xxx/zzz" ]]; \
 159 '
 160 EOF
 161     systemctl daemon-reload
 162     systemctl start testservice-34-check-writable.service
 163 }
 164
 165 test_check_idmapped_mounts() {
 166     rm -rf /var/lib/testidmapped /var/lib/private/testidmapped
 167
 168     cat >/run/systemd/system/testservice-34-check-idmapped.service <<\EOF
 169 [Unit]
 170 Description=Check id-mapped directories when DynamicUser=yes with StateDirectory
 171
 172 [Service]
 173 # Relevant only for sanitizer runs
 174 EnvironmentFile=-/usr/lib/systemd/systemd-asan-env
 175 Type=oneshot
 176
 177 MountAPIVFS=yes
 178 DynamicUser=yes
 179 PrivateUsers=yes
 180 TemporaryFileSystem=/run /var/opt /var/lib /vol
 181 UMask=0000
 182 StateDirectory=testidmapped:sampleservice
 183 ExecStart=/bin/bash -c ' \
 184     set -eux; \
 185     set -o pipefail; \
 186     touch /var/lib/sampleservice/testfile; \
 187     [[ $(awk "NR==2 {print \$1}" /proc/self/uid_map) == $(stat -c "%%u" /var/lib/private/testidmapped/testfile) ]]; \
 188 '
 189 EOF
 190
 191     systemctl daemon-reload
 192     systemctl start testservice-34-check-idmapped.service
 193
 194     [[ $(stat -c "%u" /var/lib/private/testidmapped/testfile) == 65534 ]]
 195 }
 196
 197 test_check_idmapped_mounts_root() {
 198     rm -rf /var/lib/testidmapped /var/lib/private/testidmapped
 199
 200     cat >/run/systemd/system/testservice-34-check-idmapped.service <<\EOF
 201 [Unit]
 202 Description=Check id-mapped directories when DynamicUser=no with StateDirectory
 203
 204 [Service]
 205 # Relevant only for sanitizer runs
 206 EnvironmentFile=-/usr/lib/systemd/systemd-asan-env
 207 Type=oneshot
 208
 209 MountAPIVFS=yes
 210 User=root
 211 DynamicUser=no
 212 PrivateUsers=no
 213 TemporaryFileSystem=/run /var/opt /var/lib /vol
 214 UMask=0000
 215 StateDirectory=testidmapped:sampleservice
 216 ExecStart=/bin/bash -c ' \
 217     set -eux; \
 218     set -o pipefail; \
 219     touch /var/lib/sampleservice/testfile; \
 220     [[ 0 == $(stat -c "%%u" /var/lib/testidmapped/testfile) ]]; \
 221 '
 222 EOF
 223
 224     systemctl daemon-reload
 225     systemctl start testservice-34-check-idmapped.service
 226
 227     [[ $(stat -c "%u" /var/lib/testidmapped/testfile) == 0 ]]
 228 }
 229
 230 test_directory "StateDirectory" "/var/lib"
 231 test_directory "RuntimeDirectory" "/run"
 232 test_directory "CacheDirectory" "/var/cache"
 233 test_directory "LogsDirectory" "/var/log"
 234
 235 test_check_writable
 236
 237 if systemd-analyze compare-versions "$(uname -r)" ge 5.12; then
 238     test_check_idmapped_mounts
 239     test_check_idmapped_mounts_root
 240 fi
 241
 242 systemd-analyze log-level info
 243
 244 touch /testok