diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-05-06 02:25:50 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-05-06 02:25:50 +0000 |
commit | 19f4f86bfed21c5326ed2acebe1163f3a83e832b (patch) | |
tree | d59b9989ce55ed23693e80974d94c856f1c2c8b1 /src/test/test-ns.c | |
parent | Initial commit. (diff) | |
download | systemd-upstream.tar.xz systemd-upstream.zip |
Adding upstream version 241.upstream/241upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'src/test/test-ns.c')
-rw-r--r-- | src/test/test-ns.c | 93 |
1 files changed, 93 insertions, 0 deletions
diff --git a/src/test/test-ns.c b/src/test/test-ns.c new file mode 100644 index 0000000..d3dbb54 --- /dev/null +++ b/src/test/test-ns.c @@ -0,0 +1,93 @@ +/* SPDX-License-Identifier: LGPL-2.1+ */ + +#include <errno.h> +#include <stdlib.h> +#include <unistd.h> + +#include "log.h" +#include "namespace.h" +#include "tests.h" + +int main(int argc, char *argv[]) { + const char * const writable[] = { + "/home", + "-/home/lennart/projects/foobar", /* this should be masked automatically */ + NULL + }; + + const char * const readonly[] = { + /* "/", */ + /* "/usr", */ + "/boot", + "/lib", + "/usr/lib", + "-/lib64", + "-/usr/lib64", + NULL + }; + + const char *inaccessible[] = { + "/home/lennart/projects", + NULL + }; + + static const NamespaceInfo ns_info = { + .private_dev = true, + .protect_control_groups = true, + .protect_kernel_tunables = true, + .protect_kernel_modules = true, + }; + + char *root_directory; + char *projects_directory; + int r; + char tmp_dir[] = "/tmp/systemd-private-XXXXXX", + var_tmp_dir[] = "/var/tmp/systemd-private-XXXXXX"; + + test_setup_logging(LOG_DEBUG); + + assert_se(mkdtemp(tmp_dir)); + assert_se(mkdtemp(var_tmp_dir)); + + root_directory = getenv("TEST_NS_CHROOT"); + projects_directory = getenv("TEST_NS_PROJECTS"); + + if (projects_directory) + inaccessible[0] = projects_directory; + + log_info("Inaccessible directory: '%s'", inaccessible[0]); + if (root_directory) + log_info("Chroot: '%s'", root_directory); + else + log_info("Not chrooted"); + + r = setup_namespace(root_directory, + NULL, + &ns_info, + (char **) writable, + (char **) readonly, + (char **) inaccessible, + NULL, + &(BindMount) { .source = (char*) "/usr/bin", .destination = (char*) "/etc/systemd", .read_only = true }, 1, + &(TemporaryFileSystem) { .path = (char*) "/var", .options = (char*) "ro" }, 1, + tmp_dir, + var_tmp_dir, + PROTECT_HOME_NO, + PROTECT_SYSTEM_NO, + 0, + 0); + if (r < 0) { + log_error_errno(r, "Failed to setup namespace: %m"); + + log_info("Usage:\n" + " sudo TEST_NS_PROJECTS=/home/lennart/projects ./test-ns\n" + " sudo TEST_NS_CHROOT=/home/alban/debian-tree TEST_NS_PROJECTS=/home/alban/debian-tree/home/alban/Documents ./test-ns"); + + return 1; + } + + execl("/bin/sh", "/bin/sh", NULL); + log_error_errno(errno, "execl(): %m"); + + return 1; +} |