test/units/TEST-46-HOMED.sh

   1 #!/usr/bin/env bash
   2 # SPDX-License-Identifier: LGPL-2.1-or-later
   3 set -eux
   4 set -o pipefail
   5
   6 # Check if homectl is installed, and if it isn't bail out early instead of failing
   7 if ! test -x /usr/bin/homectl ; then
   8         echo "no homed" >/skipped
   9         exit 77
  10 fi
  11
  12 inspect() {
  13     # As updating disk-size-related attributes can take some time on some
  14     # filesystems, let's drop these fields before comparing the outputs to
  15     # avoid unexpected fails. To see the full outputs of both homectl &
  16     # userdbctl (for debugging purposes) drop the fields just before the
  17     # comparison.
  18     local USERNAME="${1:?}"
  19     homectl inspect "$USERNAME" | tee /tmp/a
  20     userdbctl user "$USERNAME" | tee /tmp/b
  21
  22     # diff uses the grep BREs for pattern matching
  23     diff -I '^\s*Disk \(Size\|Free\|Floor\|Ceiling\|Usage\):' /tmp/{a,b}
  24     rm /tmp/{a,b}
  25
  26     homectl inspect --json=pretty "$USERNAME"
  27 }
  28
  29 wait_for_state() {
  30     for i in {1..10}; do
  31         (( i > 1 )) && sleep 0.5
  32         homectl inspect "$1" | grep -qF "State: $2" && break
  33     done
  34 }
  35
  36 FSTYPE="$(stat --file-system --format "%T" /)"
  37
  38 systemctl start systemd-homed.service systemd-userdbd.socket
  39
  40 systemd-analyze log-level debug
  41 systemctl service-log-level systemd-homed debug
  42
  43 # Create a tmpfs to use as backing store for the home dir. That way we can enforce a size limit nicely.
  44 mkdir -p /home
  45 mount -t tmpfs tmpfs /home -o size=290M
  46
  47 TMP_SKEL=$(mktemp -d)
  48 echo hogehoge >"$TMP_SKEL"/hoge
  49
  50 # we enable --luks-discard= since we run our tests in a tight VM, hence don't
  51 # needlessly pressure for storage. We also set the cheapest KDF, since we don't
  52 # want to waste CI CPU cycles on it. We also effectively disable rate-limiting on
  53 # the user by allowing 1000 logins per second
  54 NEWPASSWORD=xEhErW0ndafV4s homectl create test-user \
  55            --disk-size=min \
  56            --luks-discard=yes \
  57            --image-path=/home/test-user.home \
  58            --luks-pbkdf-type=pbkdf2 \
  59            --luks-pbkdf-time-cost=1ms \
  60            --rate-limit-interval=1s \
  61            --rate-limit-burst=1000 \
  62            --skel="$TMP_SKEL"
  63 inspect test-user
  64
  65 PASSWORD=xEhErW0ndafV4s homectl authenticate test-user
  66
  67 PASSWORD=xEhErW0ndafV4s homectl activate test-user
  68 inspect test-user
  69
  70 PASSWORD=xEhErW0ndafV4s homectl update test-user --real-name="Inline test"
  71 inspect test-user
  72
  73 homectl deactivate test-user
  74 inspect test-user
  75
  76 PASSWORD=xEhErW0ndafV4s NEWPASSWORD=yPN4N0fYNKUkOq homectl passwd test-user
  77 inspect test-user
  78
  79 PASSWORD=yPN4N0fYNKUkOq homectl activate test-user
  80 inspect test-user
  81
  82 SYSTEMD_LOG_LEVEL=debug PASSWORD=yPN4N0fYNKUkOq NEWPASSWORD=xEhErW0ndafV4s homectl passwd test-user
  83 inspect test-user
  84
  85 homectl deactivate test-user
  86 inspect test-user
  87
  88 homectl update test-user --real-name "Offline test" --offline
  89 inspect test-user
  90
  91 PASSWORD=xEhErW0ndafV4s homectl activate test-user
  92 inspect test-user
  93
  94 # Ensure that the offline changes were propagated in
  95 grep "Offline test" /home/test-user/.identity
  96
  97 homectl deactivate test-user
  98 inspect test-user
  99
 100 PASSWORD=xEhErW0ndafV4s homectl update test-user --real-name="Inactive test"
 101 inspect test-user
 102
 103 PASSWORD=xEhErW0ndafV4s homectl activate test-user
 104 inspect test-user
 105
 106 homectl deactivate test-user
 107 inspect test-user
 108
 109 # Do some keyring tests, but only on real kernels, since keyring access inside of containers will fail
 110 # (See: https://github.com/systemd/systemd/issues/17606)
 111 if ! systemd-detect-virt -cq ; then
 112         PASSWORD=xEhErW0ndafV4s homectl activate test-user
 113         inspect test-user
 114
 115         # Key should now be in the keyring
 116         homectl update test-user --real-name "Keyring Test"
 117         inspect test-user
 118
 119         # These commands shouldn't use the keyring
 120         (! timeout 5s homectl authenticate test-user )
 121         (! NEWPASSWORD="foobar" timeout 5s homectl passwd test-user )
 122
 123         homectl lock test-user
 124         inspect test-user
 125
 126         # Key should be gone from keyring
 127         (! timeout 5s homectl update test-user --real-name "Keyring Test 2" )
 128
 129         PASSWORD=xEhErW0ndafV4s homectl unlock test-user
 130         inspect test-user
 131
 132         # Key should have been re-instantiated into the keyring
 133         homectl update test-user --real-name "Keyring Test 3"
 134         inspect test-user
 135
 136         homectl deactivate test-user
 137         inspect test-user
 138 fi
 139
 140 # Do some resize tests, but only if we run on real kernels and are on btrfs, as quota inside of containers
 141 # will fail and minimizing while active only works on btrfs.
 142 if ! systemd-detect-virt -cq && [[ "$FSTYPE" == "btrfs" ]]; then
 143     # grow while inactive
 144     PASSWORD=xEhErW0ndafV4s homectl resize test-user 300M
 145     inspect test-user
 146
 147     # minimize while inactive
 148     PASSWORD=xEhErW0ndafV4s homectl resize test-user min
 149     inspect test-user
 150
 151     PASSWORD=xEhErW0ndafV4s homectl activate test-user
 152     inspect test-user
 153
 154     # grow while active
 155     PASSWORD=xEhErW0ndafV4s homectl resize test-user max
 156     inspect test-user
 157
 158     # minimize while active
 159     PASSWORD=xEhErW0ndafV4s homectl resize test-user 0
 160     inspect test-user
 161
 162     # grow while active
 163     PASSWORD=xEhErW0ndafV4s homectl resize test-user 300M
 164     inspect test-user
 165
 166     # shrink to original size while active
 167     PASSWORD=xEhErW0ndafV4s homectl resize test-user 256M
 168     inspect test-user
 169
 170     # minimize again
 171     PASSWORD=xEhErW0ndafV4s homectl resize test-user min
 172     inspect test-user
 173
 174     # Increase space, so that we can reasonably rebalance free space between to home dirs
 175     mount /home -o remount,size=800M
 176
 177     # create second user
 178     NEWPASSWORD=uuXoo8ei homectl create test-user2 \
 179            --disk-size=min \
 180            --luks-discard=yes \
 181            --image-path=/home/test-user2.home \
 182            --luks-pbkdf-type=pbkdf2 \
 183            --luks-pbkdf-time-cost=1ms \
 184            --rate-limit-interval=1s \
 185            --rate-limit-burst=1000
 186     inspect test-user2
 187
 188     # activate second user
 189     PASSWORD=uuXoo8ei homectl activate test-user2
 190     inspect test-user2
 191
 192     # set second user's rebalance weight to 100
 193     PASSWORD=uuXoo8ei homectl update test-user2 --rebalance-weight=100
 194     inspect test-user2
 195
 196     # set first user's rebalance weight to quarter of that of the second
 197     PASSWORD=xEhErW0ndafV4s homectl update test-user --rebalance-weight=25
 198     inspect test-user
 199
 200     # synchronously rebalance
 201     homectl rebalance
 202     inspect test-user
 203     inspect test-user2
 204
 205     wait_for_state test-user2 active
 206     homectl deactivate test-user2
 207     wait_for_state test-user2 inactive
 208     homectl remove test-user2
 209 fi
 210
 211 PASSWORD=xEhErW0ndafV4s homectl with test-user -- test ! -f /home/test-user/xyz
 212 (! PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz)
 213 PASSWORD=xEhErW0ndafV4s homectl with test-user -- touch /home/test-user/xyz
 214 PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz
 215 PASSWORD=xEhErW0ndafV4s homectl with test-user -- rm /home/test-user/xyz
 216 PASSWORD=xEhErW0ndafV4s homectl with test-user -- test ! -f /home/test-user/xyz
 217 (! PASSWORD=xEhErW0ndafV4s homectl with test-user -- test -f /home/test-user/xyz)
 218 [[ $(PASSWORD=xEhErW0ndafV4s homectl with test-user -- stat -c %U /home/test-user/hoge) == "test-user" ]]
 219 [[ $(PASSWORD=xEhErW0ndafV4s homectl with test-user -- cat /home/test-user/hoge) == "$(cat "$TMP_SKEL"/hoge)" ]]
 220
 221 # Regression tests
 222 wait_for_state test-user inactive
 223 /usr/lib/systemd/tests/unit-tests/manual/test-homed-regression-31896 test-user
 224
 225 wait_for_state test-user inactive
 226 homectl remove test-user
 227
 228 # blob directory tests
 229 # See docs/USER_RECORD_BLOB_DIRS.md
 230 checkblob() {
 231         test -f "/var/cache/systemd/home/blob-user/$1"
 232         stat -c "%u %#a" "/var/cache/systemd/home/blob-user/$1" | grep "^0 0644"
 233         test -f "/home/blob-user/.identity-blob/$1"
 234         stat -c "%u %#a" "/home/blob-user/.identity-blob/$1" | grep "^12345 0644"
 235
 236         diff "/var/cache/systemd/home/blob-user/$1" "$2"
 237         diff "/var/cache/systemd/home/blob-user/$1" "/home/blob-user/.identity-blob/$1"
 238 }
 239
 240 mkdir /tmp/blob1 /tmp/blob2
 241 echo data1 blob1 >/tmp/blob1/test1
 242 echo data1 blob2 >/tmp/blob2/test1
 243 echo data2 blob1 >/tmp/blob1/test2
 244 echo data2 blob2 >/tmp/blob2/test2
 245 echo invalid filename >/tmp/blob1/файл
 246 echo data3 >/tmp/external-test3
 247 echo avatardata >/tmp/external-avatar
 248 ln -s /tmp/external-avatar /tmp/external-avatar-lnk
 249 dd if=/dev/urandom of=/tmp/external-barely-fits bs=1M count=64
 250 dd if=/dev/urandom of=/tmp/external-toobig bs=1M count=65
 251
 252 # create w/ prepopulated blob dir
 253 NEWPASSWORD=EMJuc3zQaMibJo homectl create blob-user \
 254            --disk-size=min --luks-discard=yes \
 255            --luks-pbkdf-type=pbkdf2 --luks-pbkdf-time-cost=1ms \
 256            --rate-limit-interval=1s --rate-limit-burst=1000 \
 257            --uid=12345 \
 258            --blob=/tmp/blob1
 259 inspect blob-user
 260 PASSWORD=EMJuc3zQaMibJo homectl activate blob-user
 261 inspect blob-user
 262
 263 test -d /var/cache/systemd/home/blob-user
 264 stat -c "%u %#a" /var/cache/systemd/home/blob-user | grep "^0 0755"
 265 test -d /home/blob-user/.identity-blob
 266 stat -c "%u %#a" /home/blob-user/.identity-blob | grep "^12345 0700"
 267
 268 checkblob test1 /tmp/blob1/test1
 269 (! checkblob test1 /tmp/blob2/test1 )
 270 checkblob test2 /tmp/blob1/test2
 271 (! checkblob test2 /tmp/blob2/test2 )
 272 (! checkblob фаил /tmp/blob1/фаил )
 273 (! checkblob test3 /tmp/external-test3 )
 274 (! checkblob avatar /tmp/external-avatar )
 275
 276 # append files to existing blob, both well-known and other
 277 PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
 278         -b test3=/tmp/external-test3 --avatar=/tmp/external-avatar
 279 inspect blob-user
 280 checkblob test1 /tmp/blob1/test1
 281 (! checkblob test1 /tmp/blob2/test1 )
 282 checkblob test2 /tmp/blob1/test2
 283 (! checkblob test2 /tmp/blob2/test2 )
 284 (! checkblob фаил /tmp/blob1/фаил )
 285 checkblob test3 /tmp/external-test3
 286 checkblob avatar /tmp/external-avatar
 287
 288 # delete files from existing blob, both well-known and other
 289 PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
 290         -b test3= --avatar=
 291 inspect blob-user
 292 checkblob test1 /tmp/blob1/test1
 293 (! checkblob test1 /tmp/blob2/test1 )
 294 checkblob test2 /tmp/blob1/test2
 295 (! checkblob test2 /tmp/blob2/test2 )
 296 (! checkblob фаил /tmp/blob1/фаил )
 297 (! checkblob test3 /tmp/external-test3 )
 298 (! checkblob avatar /tmp/external-avatar )
 299
 300 # swap entire blob directory
 301 PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
 302         -b /tmp/blob2
 303 inspect blob-user
 304 (! checkblob test1 /tmp/blob1/test1 )
 305 checkblob test1 /tmp/blob2/test1
 306 (! checkblob test2 /tmp/blob1/test2 )
 307 checkblob test2 /tmp/blob2/test2
 308 (! checkblob фаил /tmp/blob1/фаил )
 309 (! checkblob test3 /tmp/external-test3 )
 310 (! checkblob avatar /tmp/external-avatar )
 311
 312 # create and delete files while swapping blob directory. Also symlinks.
 313 PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
 314         -b /tmp/blob1 -b test2= -b test3=/tmp/external-test3 --avatar=/tmp/external-avatar-lnk
 315 inspect blob-user
 316 checkblob test1 /tmp/blob1/test1
 317 (! checkblob test1 /tmp/blob2/test1 )
 318 (! checkblob test2 /tmp/blob1/test2 )
 319 (! checkblob test2 /tmp/blob2/test2 )
 320 (! checkblob фаил /tmp/blob1/фаил )
 321 checkblob test3 /tmp/external-test3
 322 checkblob avatar /tmp/external-avatar # target of the link
 323
 324 # clear the blob directory
 325 PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
 326         -b /tmp/blob2 -b test3=/tmp/external-test3 --blob=
 327 inspect blob-user
 328 (! checkblob test1 /tmp/blob1/test1 )
 329 (! checkblob test1 /tmp/blob2/test1 )
 330 (! checkblob test2 /tmp/blob1/test2 )
 331 (! checkblob test2 /tmp/blob2/test2 )
 332 (! checkblob фаил /tmp/blob1/фаил )
 333 (! checkblob test3 /tmp/external-test3 )
 334 (! checkblob avatar /tmp/external-avatar )
 335
 336 # file that's exactly 64M still fits
 337 # FIXME: Figure out why this fails on ext4.
 338 if [[ "$FSTYPE" != "ext2/ext3" ]]; then
 339     PASSWORD=EMJuc3zQaMibJo homectl update blob-user \
 340             -b barely-fits=/tmp/external-barely-fits
 341     (! checkblob test1 /tmp/blob1/test1 )
 342     (! checkblob test1 /tmp/blob2/test1 )
 343     (! checkblob test2 /tmp/blob1/test2 )
 344     (! checkblob test2 /tmp/blob2/test2 )
 345     (! checkblob фаил /tmp/blob1/фаил )
 346     (! checkblob test3 /tmp/external-test3 )
 347     (! checkblob avatar /tmp/external-avatar )
 348     checkblob barely-fits /tmp/external-barely-fits
 349 fi
 350
 351 # error out if the file is too big
 352 (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b huge=/tmp/external-toobig )
 353
 354 # error out if filenames are invalid
 355 (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b .hidden=/tmp/external-test3 )
 356 (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b "with spaces=/tmp/external-test3" )
 357 (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b with=equals=/tmp/external-test3 )
 358 (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b файл=/tmp/external-test3 )
 359 (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b special@chars=/tmp/external-test3 )
 360
 361 # Make sure offline updates to blobs get propagated in
 362 homectl deactivate blob-user
 363 inspect blob-user
 364 homectl update blob-user --offline -b barely-fits= -b propagated=/tmp/external-test3
 365 inspect blob-user
 366 PASSWORD=EMJuc3zQaMibJo homectl activate blob-user
 367 inspect blob-user
 368 (! checkblob barely-fits /tmp/external-barely-fits )
 369 checkblob propagated /tmp/external-test3
 370
 371 homectl deactivate blob-user
 372 wait_for_state blob-user inactive
 373 homectl remove blob-user
 374
 375 # userdbctl tests
 376 export PAGER=
 377
 378 # Create a couple of user/group records to test io.systemd.DropIn
 379 # See docs/USER_RECORD.md and docs/GROUP_RECORD.md
 380 mkdir -p /run/userdb/
 381 cat >"/run/userdb/dropingroup.group" <<\EOF
 382 {
 383     "groupName" : "dropingroup",
 384     "gid"       : 1000000
 385 }
 386 EOF
 387 cat >"/run/userdb/dropinuser.user" <<\EOF
 388 {
 389     "userName" : "dropinuser",
 390     "uid"      : 2000000,
 391     "realName" : "🐱",
 392     "memberOf" : [
 393         "dropingroup"
 394     ]
 395 }
 396 EOF
 397 cat >"/run/userdb/dropinuser.user-privileged" <<\EOF
 398 {
 399     "privileged" : {
 400         "hashedPassword" : [
 401             "$6$WHBKvAFFT9jKPA4k$OPY4D4TczKN/jOnJzy54DDuOOagCcvxxybrwMbe1SVdm.Bbr.zOmBdATp.QrwZmvqyr8/SafbbQu.QZ2rRvDs/"
 402         ],
 403         "sshAuthorizedKeys" : [
 404             "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA//dxI2xLg4MgxIKKZv1nqwTEIlE/fdakii2Fb75pG+ foo@bar.tld",
 405             "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMlaqG2rTMje5CQnfjXJKmoSpEVJ2gWtx4jBvsQbmee2XbU/Qdq5+SRisssR9zVuxgg5NA5fv08MgjwJQMm+csc= hello@world.tld"
 406         ]
 407     }
 408 }
 409 EOF
 410 # Set permissions and create necessary symlinks as described in nss-systemd(8)
 411 chmod 0600 "/run/userdb/dropinuser.user-privileged"
 412 ln -svrf "/run/userdb/dropingroup.group" "/run/userdb/1000000.group"
 413 ln -svrf "/run/userdb/dropinuser.user" "/run/userdb/2000000.user"
 414 ln -svrf "/run/userdb/dropinuser.user-privileged" "/run/userdb/2000000.user-privileged"
 415
 416 userdbctl
 417 userdbctl --version
 418 userdbctl --help --no-pager
 419 userdbctl --no-legend
 420 userdbctl --output=classic
 421 userdbctl --output=friendly
 422 userdbctl --output=table
 423 userdbctl --output=json | jq
 424 userdbctl -j --json=pretty | jq
 425 userdbctl -j --json=short | jq
 426 userdbctl --with-varlink=no
 427
 428 userdbctl user
 429 userdbctl user -S
 430 userdbctl user -IS
 431 userdbctl user -R
 432 userdbctl user --disposition=regular --disposition=intrinsic
 433 userdbctl user kkkk -z
 434 userdbctl user --uid-min=100 --uid-max=100
 435 userdbctl user -B
 436 userdbctl user testuser
 437 userdbctl user root
 438 userdbctl user testuser root
 439 userdbctl user -j testuser root | jq
 440 # Check only UID for the nobody user, since the name is build-configurable
 441 userdbctl user --with-nss=no --synthesize=yes
 442 userdbctl user --with-nss=no --synthesize=yes 0 root 65534
 443 userdbctl user dropinuser
 444 userdbctl user 2000000
 445 userdbctl user --with-nss=no --with-varlink=no --synthesize=no --multiplexer=no dropinuser
 446 userdbctl user --with-nss=no 2000000
 447 (! userdbctl user '')
 448 (! userdbctl user 🐱)
 449 (! userdbctl user 🐱 '' bar)
 450 (! userdbctl user i-do-not-exist)
 451 (! userdbctl user root i-do-not-exist testuser)
 452 (! userdbctl user --with-nss=no --synthesize=no 0 root 65534)
 453 (! userdbctl user -N root nobody)
 454 (! userdbctl user --with-dropin=no dropinuser)
 455 (! userdbctl user --with-dropin=no 2000000)
 456
 457 userdbctl group
 458 userdbctl group -S
 459 userdbctl group -IS
 460 userdbctl group -R
 461 userdbctl group --disposition=regular --disposition=intrinsic
 462 userdbctl group kkkk -z
 463 userdbctl group --uid-min=100 --uid-max=100
 464 userdbctl group -B
 465 userdbctl group testuser
 466 userdbctl group root
 467 userdbctl group testuser root
 468 userdbctl group -j testuser root | jq
 469 # Check only GID for the nobody group, since the name is build-configurable
 470 userdbctl group --with-nss=no --synthesize=yes
 471 userdbctl group --with-nss=no --synthesize=yes 0 root 65534
 472 userdbctl group dropingroup
 473 userdbctl group 1000000
 474 userdbctl group --with-nss=no --with-varlink=no --synthesize=no --multiplexer=no dropingroup
 475 userdbctl group --with-nss=no 1000000
 476 (! userdbctl group '')
 477 (! userdbctl group 🐱)
 478 (! userdbctl group 🐱 '' bar)
 479 (! userdbctl group i-do-not-exist)
 480 (! userdbctl group root i-do-not-exist testuser)
 481 (! userdbctl group --with-nss=no --synthesize=no 0 root 65534)
 482 (! userdbctl group --with-dropin=no dropingroup)
 483 (! userdbctl group --with-dropin=no 1000000)
 484
 485 userdbctl users-in-group
 486 userdbctl users-in-group testuser
 487 userdbctl users-in-group testuser root
 488 userdbctl users-in-group -j testuser root | jq
 489 userdbctl users-in-group 🐱
 490 (! userdbctl users-in-group '')
 491 (! userdbctl users-in-group foo '' bar)
 492
 493 userdbctl groups-of-user
 494 userdbctl groups-of-user testuser
 495 userdbctl groups-of-user testuser root
 496 userdbctl groups-of-user -j testuser root | jq
 497 userdbctl groups-of-user 🐱
 498 (! userdbctl groups-of-user '')
 499 (! userdbctl groups-of-user foo '' bar)
 500
 501 userdbctl services
 502 userdbctl services -j | jq
 503
 504 varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"testuser","service":"io.systemd.Multiplexer"}'
 505 varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"root","service":"io.systemd.Multiplexer"}'
 506 varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"dropinuser","service":"io.systemd.Multiplexer"}'
 507 varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"uid":2000000,"service":"io.systemd.Multiplexer"}'
 508 (! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"","service":"io.systemd.Multiplexer"}')
 509 (! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"🐱","service":"io.systemd.Multiplexer"}')
 510 (! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"i-do-not-exist","service":"io.systemd.Multiplexer"}')
 511
 512 userdbctl ssh-authorized-keys dropinuser | tee /tmp/authorized-keys
 513 grep "ssh-ed25519" /tmp/authorized-keys
 514 grep "ecdsa-sha2-nistp256" /tmp/authorized-keys
 515 echo "my-top-secret-key 🐱" >/tmp/my-top-secret-key
 516 userdbctl ssh-authorized-keys dropinuser --chain /bin/cat /tmp/my-top-secret-key | tee /tmp/authorized-keys
 517 grep "ssh-ed25519" /tmp/authorized-keys
 518 grep "ecdsa-sha2-nistp256" /tmp/authorized-keys
 519 grep "my-top-secret-key 🐱" /tmp/authorized-keys
 520 (! userdbctl ssh-authorized-keys 🐱)
 521 (! userdbctl ssh-authorized-keys dropin-user --chain)
 522 (! userdbctl ssh-authorized-keys dropin-user --chain '')
 523 (! SYSTEMD_LOG_LEVEL=debug userdbctl ssh-authorized-keys dropin-user --chain /bin/false)
 524
 525 (! userdbctl '')
 526 for opt in json multiplexer output synthesize with-dropin with-nss with-varlink; do
 527     (! userdbctl "--$opt=''")
 528     (! userdbctl "--$opt='🐱'")
 529     (! userdbctl "--$opt=foo")
 530     (! userdbctl "--$opt=foo" "--$opt=''" "--$opt=🐱")
 531 done
 532
 533 # FIXME: sshd seems to crash inside asan currently, skip the actual ssh test hence
 534 if command -v ssh &>/dev/null && command -v sshd &>/dev/null && ! [[ -v ASAN_OPTIONS ]]; then
 535     at_exit() {
 536         set +e
 537
 538         systemctl is-active -q mysshserver.socket && systemctl stop mysshserver.socket
 539         rm -f /tmp/homed.id_ecdsa /run/systemd/system/mysshserver{@.service,.socket}
 540         systemctl daemon-reload
 541         homectl remove homedsshtest
 542         for dir in /etc /usr/lib; do
 543             if [[ -f "$dir/pam.d/sshd.bak" ]]; then
 544                 mv "$dir/pam.d/sshd.bak" "$dir/pam.d/sshd"
 545             fi
 546         done
 547     }
 548
 549     trap at_exit EXIT
 550
 551     # Test that SSH logins work with delayed unlocking
 552     ssh-keygen -N '' -C '' -t ecdsa -f /tmp/homed.id_ecdsa
 553     NEWPASSWORD=hunter4711 homectl create \
 554                        --disk-size=min \
 555                        --luks-discard=yes \
 556                        --luks-pbkdf-type=pbkdf2 \
 557                        --luks-pbkdf-time-cost=1ms \
 558                        --rate-limit-interval=1s \
 559                        --rate-limit-burst=1000 \
 560                        --enforce-password-policy=no \
 561                        --ssh-authorized-keys=@/tmp/homed.id_ecdsa.pub \
 562                        --stop-delay=0 \
 563                        homedsshtest
 564     homectl inspect homedsshtest
 565
 566     mkdir -p /etc/ssh
 567     test -f /etc/ssh/ssh_host_ecdsa_key || ssh-keygen -t ecdsa -C '' -N '' -f /etc/ssh/ssh_host_ecdsa_key
 568
 569     # ssh wants this dir around, but distros cannot agree on a common name for it, let's just create all that
 570     # are aware of distros use
 571     mkdir -p /usr/share/empty.sshd /var/empty /var/empty/sshd /run/sshd
 572
 573     for dir in /etc /usr/lib; do
 574         if [[ -f "$dir/pam.d/sshd" ]]; then
 575             mv "$dir/pam.d/sshd" "$dir/pam.d/sshd.bak"
 576             cat >"$dir/pam.d/sshd" <<EOF
 577 auth    sufficient pam_unix.so nullok
 578 auth    sufficient pam_systemd_home.so debug
 579 auth    required   pam_deny.so
 580 account sufficient pam_systemd_home.so debug
 581 account sufficient pam_unix.so
 582 account required   pam_permit.so
 583 session optional   pam_systemd_home.so debug
 584 session optional   pam_systemd.so
 585 session required   pam_unix.so
 586 EOF
 587             break
 588         fi
 589     done
 590
 591     mkdir -p /etc/sshd/
 592     cat >/etc/ssh/sshd_config <<EOF
 593 AuthorizedKeysCommand /usr/bin/userdbctl ssh-authorized-keys %u
 594 AuthorizedKeysCommandUser root
 595 UsePAM yes
 596 AcceptEnv PASSWORD
 597 LogLevel DEBUG3
 598 EOF
 599
 600     cat >/run/systemd/system/mysshserver.socket <<EOF
 601 [Socket]
 602 ListenStream=4711
 603 Accept=yes
 604 EOF
 605
 606     cat >/run/systemd/system/mysshserver@.service <<EOF
 607 [Service]
 608 ExecStart=-/usr/sbin/sshd -i -d -e
 609 StandardInput=socket
 610 StandardOutput=socket
 611 StandardError=journal
 612 EOF
 613
 614     systemctl daemon-reload
 615     systemctl start mysshserver.socket
 616
 617     userdbctl user -j homedsshtest
 618
 619     ssh -t -t -4 -p 4711 -i /tmp/homed.id_ecdsa \
 620         -o "SetEnv PASSWORD=hunter4711" -o "StrictHostKeyChecking no" \
 621         homedsshtest@localhost echo zzz | tr -d '\r' | tee /tmp/homedsshtest.out
 622     grep -E "^zzz$" /tmp/homedsshtest.out
 623     rm /tmp/homedsshtest.out
 624
 625     ssh -t -t -4 -p 4711 -i /tmp/homed.id_ecdsa \
 626         -o "SetEnv PASSWORD=hunter4711" -o "StrictHostKeyChecking no" \
 627         homedsshtest@localhost env
 628
 629     wait_for_state homedsshtest inactive
 630 fi
 631
 632 NEWPASSWORD=hunter4711 homectl create aliastest --storage=directory --alias=aliastest2 --alias=aliastest3 --realm=myrealm
 633
 634 homectl inspect aliastest
 635 homectl inspect aliastest2
 636 homectl inspect aliastest3
 637 homectl inspect aliastest@myrealm
 638 homectl inspect aliastest2@myrealm
 639 homectl inspect aliastest3@myrealm
 640
 641 userdbctl user aliastest
 642 userdbctl user aliastest2
 643 userdbctl user aliastest3
 644 userdbctl user aliastest@myrealm
 645 userdbctl user aliastest2@myrealm
 646 userdbctl user aliastest3@myrealm
 647
 648 getent passwd aliastest
 649 getent passwd aliastest2
 650 getent passwd aliastest3
 651 getent passwd aliastest@myrealm
 652 getent passwd aliastest2@myrealm
 653 getent passwd aliastest3@myrealm
 654
 655 if findmnt -n -o options /tmp | grep -q usrquota ; then
 656
 657     NEWPASSWORD=quux homectl create tmpfsquota --storage=subvolume --dev-shm-limit=50K -P
 658
 659     run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/urandom of=/dev/shm/quotatestfile1 bs=1024 count=30
 660     (! run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/urandom of=/dev/shm/quotatestfile2 bs=1024 count=30)
 661     run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota rm /dev/shm/quotatestfile1 /dev/shm/quotatestfile2
 662     run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota dd if=/dev/urandom of=/dev/shm/quotatestfile1 bs=1024 count=30
 663     run0 --property=SetCredential=pam.authtok.systemd-run0:quux -u tmpfsquota rm /dev/shm/quotatestfile1
 664
 665     systemctl stop user@"$(id -u tmpfsquota)".service
 666
 667     wait_for_state tmpfsquota inactive
 668     homectl remove tmpfsquota
 669 fi
 670
 671 systemd-analyze log-level info
 672
 673 touch /testok