diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-06-12 03:50:40 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-06-12 03:50:40 +0000 |
commit | fc53809803cd2bc2434e312b19a18fa36776da12 (patch) | |
tree | b4b43bd6538f51965ce32856e9c053d0f90919c8 /src/test/test-bpf-lsm.c | |
parent | Adding upstream version 255.5. (diff) | |
download | systemd-fc53809803cd2bc2434e312b19a18fa36776da12.tar.xz systemd-fc53809803cd2bc2434e312b19a18fa36776da12.zip |
Adding upstream version 256.upstream/256
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'src/test/test-bpf-lsm.c')
-rw-r--r-- | src/test/test-bpf-lsm.c | 102 |
1 files changed, 0 insertions, 102 deletions
diff --git a/src/test/test-bpf-lsm.c b/src/test/test-bpf-lsm.c deleted file mode 100644 index 42ea64c..0000000 --- a/src/test/test-bpf-lsm.c +++ /dev/null @@ -1,102 +0,0 @@ -/* SPDX-License-Identifier: LGPL-2.1-or-later */ - -#include "bpf-lsm.h" -#include "load-fragment.h" -#include "manager.h" -#include "process-util.h" -#include "rlimit-util.h" -#include "rm-rf.h" -#include "service.h" -#include "strv.h" -#include "tests.h" -#include "unit.h" -#include "virt.h" - -static int test_restrict_filesystems(Manager *m, const char *unit_name, const char *file_path, char **allowed_filesystems) { - _cleanup_free_ char *exec_start = NULL; - _cleanup_(unit_freep) Unit *u = NULL; - ExecContext *ec = NULL; - int cld_code, r; - - assert_se(u = unit_new(m, sizeof(Service))); - assert_se(unit_add_name(u, unit_name) == 0); - assert_se(ec = unit_get_exec_context(u)); - - STRV_FOREACH(allow_filesystem, allowed_filesystems) { - r = config_parse_restrict_filesystems( - u->id, "filename", 1, "Service", 1, "RestrictFileSystems", 0, - *allow_filesystem, ec, u); - if (r < 0) - return log_unit_error_errno(u, r, "Failed to parse RestrictFileSystems: %m"); - } - - assert_se(exec_start = strjoin("cat ", file_path)); - r = config_parse_exec(u->id, "filename", 1, "Service", 1, "ExecStart", - SERVICE_EXEC_START, exec_start, SERVICE(u)->exec_command, u); - if (r < 0) - return log_error_errno(r, "Failed to parse ExecStart"); - - SERVICE(u)->type = SERVICE_ONESHOT; - u->load_state = UNIT_LOADED; - - r = unit_start(u, NULL); - if (r < 0) - return log_error_errno(r, "Unit start failed %m"); - - while (!IN_SET(SERVICE(u)->state, SERVICE_DEAD, SERVICE_FAILED)) { - r = sd_event_run(m->event, UINT64_MAX); - if (r < 0) - return log_error_errno(errno, "Event run failed %m"); - } - - cld_code = SERVICE(u)->exec_command[SERVICE_EXEC_START]->exec_status.code; - if (cld_code != CLD_EXITED) - return log_error_errno(-SYNTHETIC_ERRNO(EBUSY), "ExecStart didn't exited, code='%s'", sigchld_code_to_string(cld_code)); - - if (SERVICE(u)->state != SERVICE_DEAD) - return log_error_errno(-SYNTHETIC_ERRNO(EBUSY), "Service is not dead"); - - return 0; -} - -int main(int argc, char *argv[]) { - _cleanup_(rm_rf_physical_and_freep) char *runtime_dir = NULL; - _cleanup_(manager_freep) Manager *m = NULL; - _cleanup_free_ char *unit_dir = NULL; - struct rlimit rl; - int r; - - test_setup_logging(LOG_DEBUG); - - assert_se(getrlimit(RLIMIT_MEMLOCK, &rl) >= 0); - rl.rlim_cur = rl.rlim_max = MAX(rl.rlim_max, CAN_MEMLOCK_SIZE); - (void) setrlimit_closest(RLIMIT_MEMLOCK, &rl); - - if (!can_memlock()) - return log_tests_skipped("Can't use mlock()"); - - if (!lsm_bpf_supported(/* initialize = */ true)) - return log_tests_skipped("LSM BPF hooks are not supported"); - - r = enter_cgroup_subroot(NULL); - if (r == -ENOMEDIUM) - return log_tests_skipped("cgroupfs not available"); - - assert_se(get_testdata_dir("units", &unit_dir) >= 0); - assert_se(set_unit_path(unit_dir) >= 0); - assert_se(runtime_dir = setup_fake_runtime_dir()); - - assert_se(manager_new(RUNTIME_SCOPE_SYSTEM, MANAGER_TEST_RUN_BASIC, &m) >= 0); - assert_se(manager_startup(m, NULL, NULL, NULL) >= 0); - - /* We need to enable access to the filesystem where the binary is so we - * add @common-block */ - assert_se(test_restrict_filesystems(m, "restrict_filesystems_test.service", "/sys/kernel/tracing/printk_formats", STRV_MAKE("@common-block")) < 0); - assert_se(test_restrict_filesystems(m, "restrict_filesystems_test.service", "/sys/kernel/tracing/printk_formats", STRV_MAKE("tracefs", "@common-block")) >= 0); - assert_se(test_restrict_filesystems(m, "restrict_filesystems_test.service", "/sys/kernel/tracing/printk_formats", STRV_MAKE("tracefs", "@common-block", "~tracefs")) < 0); - assert_se(test_restrict_filesystems(m, "restrict_filesystems_test.service", "/sys/kernel/debug/sleep_time", STRV_MAKE("@common-block")) < 0); - assert_se(test_restrict_filesystems(m, "restrict_filesystems_test.service", "/sys/kernel/debug/sleep_time", STRV_MAKE("debugfs", "@common-block")) >= 0); - assert_se(test_restrict_filesystems(m, "restrict_filesystems_test.service", "/sys/kernel/debug/sleep_time", STRV_MAKE("~debugfs")) < 0); - - return 0; -} |