test: add a couple of tests for machinectl

5 files changed, 582 insertions, 367 deletions

diff --git a/test/TEST-13-NSPAWN-SMOKE/test.sh b/test/TEST-13-NSPAWN-SMOKE/test.sh
index 8352541b17..f607c2733b 100755
--- a/test/TEST-13-NSPAWN-SMOKE/test.sh
+++ b/test/TEST-13-NSPAWN-SMOKE/test.sh
@@ -5,6 +5,11 @@ set -e
 TEST_DESCRIPTION="systemd-nspawn smoke test"
 IMAGE_NAME="nspawn"
 TEST_NO_NSPAWN=1
+# The test containers are missing the $BUILD_DIR with the necessary note files
+# which generates lots of errors regarding missing coverage. Since fixing this
+# would make the test code unnecessarily messy, let's just ignore them, at least
+# for now.
+IGNORE_MISSING_COVERAGE=yes
 
 # shellcheck source=test/test-functions
 . "${TEST_BASE_DIR:?}/test-functions"
diff --git a/test/test-functions b/test/test-functions
index d59ac29382..6063c5d5e2 100644
--- a/test/test-functions
+++ b/test/test-functions
@@ -193,6 +193,7 @@ BASICTOOLS=(
     loadkeys
     login
     losetup
+    lsattr
     lz4cat
     mkfifo
     mknod
diff --git a/test/units/testsuite-13.machinectl.sh b/test/units/testsuite-13.machinectl.sh
new file mode 100755
index 0000000000..9ca6f5f02b
--- /dev/null
+++ b/test/units/testsuite-13.machinectl.sh
@@ -0,0 +1,197 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# shellcheck disable=SC2016
+set -eux
+set -o pipefail
+
+export PAGER=
+
+CREATE_BB_CONTAINER="/usr/lib/systemd/tests/testdata/create-busybox-container"
+
+at_exit() {
+    set +e
+
+    machinectl status long-running >/dev/null && machinectl kill --signal=KILL long-running
+    mountpoint -q /var/lib/machines && timeout 10 sh -c "while ! umount /var/lib/machines; do sleep .5; done"
+}
+
+trap at_exit EXIT
+
+# Mount tmpfs over /var/lib/machines to not pollute the image
+mkdir -p /var/lib/machines
+mount -t tmpfs tmpfs /var/lib/machines
+
+# Create a couple of containers we can refer to in tests
+for i in {0..4}; do
+    "$CREATE_BB_CONTAINER" "/var/lib/machines/container$i"
+    machinectl start "container$i"
+done
+# Create one "long running" container with some basic signal handling
+"$CREATE_BB_CONTAINER" /var/lib/machines/long-running
+cat >/var/lib/machines/long-running/sbin/init <<\EOF
+#!/bin/sh -x
+#
+PID=0
+
+# sh doesn't recognize RTMIN+4, so we have to use the signal number directly
+trap "touch /poweroff" 38
+trap "touch /reboot" INT
+trap "touch /trap" TRAP
+trap 'kill $PID' EXIT
+
+# We need to wait for the sleep process asynchronously in order to allow
+# bash to process signals
+sleep infinity &
+PID=$!
+while :; do
+    wait || :
+done
+EOF
+machinectl start long-running
+
+machinectl
+machinectl --no-pager --help
+machinectl --version
+machinectl list
+machinectl list --no-legend --no-ask-password
+
+machinectl status long-running long-running long-running
+machinectl status --full long-running
+machinectl status --quiet --lines=1 long-running
+machinectl status --lines=0 --max-addresses=0 long-running
+machinectl status --machine=testuser@.host long-running
+machinectl status --output=help long-running
+while read -r output; do
+    machinectl status --output="$output" long-running
+done < <(machinectl --output=help)
+
+machinectl show
+machinectl show --all
+machinectl show --all --machine=root@
+machinectl show --all --machine=testuser@
+[[ "$(machinectl show --property=PoolPath --value)" == "/var/lib/machines" ]]
+machinectl show long-running
+machinectl show long-running long-running long-running --all
+[[ "$(machinectl show --property=RootDirectory --value long-running)" == "/var/lib/machines/long-running" ]]
+
+machinectl enable long-running
+test -L /etc/systemd/system/machines.target.wants/systemd-nspawn@long-running.service
+machinectl enable long-running long-running long-running container1
+machinectl disable long-running
+test ! -L /etc/systemd/system/machines.target.wants/systemd-nspawn@long-running.service
+machinectl disable long-running long-running long-running container1
+
+[[ "$(machinectl shell testuser@ /bin/sh -c 'echo -ne $FOO')" == "" ]]
+[[ "$(machinectl shell --setenv=FOO=bar testuser@ /bin/sh -c 'echo -ne $FOO')" == "bar" ]]
+
+[[ "$(machinectl show --property=State --value long-running)" == "running" ]]
+# Equivalent to machinectl kill --signal=SIGRTMIN+4 --kill-whom=leader
+rm -f /var/lib/machines/long-running/poweroff
+machinectl poweroff long-running
+test -e /var/lib/machines/long-running/poweroff
+machinectl poweroff long-running long-running long-running
+# Equivalent to machinectl kill --signal=SIGINT --kill-whom=leader
+rm -f /var/lib/machines/long-running/reboot
+machinectl reboot long-running
+test -e /var/lib/machines/long-running/reboot
+machinectl reboot long-running long-running long-running
+# Skip machinectl terminate for now, as it doesn't play well with our "init"
+rm -f /var/lib/machines/long-running/trap
+machinectl kill --signal=SIGTRAP --kill-whom=leader long-running
+test -e /var/lib/machines/long-running/trap
+machinectl kill --signal=SIGTRAP --kill-whom=leader long-running long-running long-running
+# All used signals should've been caught by a handler
+[[ "$(machinectl show --property=State --value long-running)" == "running" ]]
+
+cp /etc/machine-id /tmp/foo
+machinectl copy-to long-running /tmp/foo /root/foo
+test -f /var/lib/machines/long-running/root/foo
+machinectl copy-from long-running /root/foo /tmp/bar
+diff /tmp/foo /tmp/bar
+rm -f /tmp/{foo,bar}
+
+# machinectl bind is covered by testcase_check_machinectl_bind() in nspawn tests
+
+machinectl list-images
+machinectl list-images --no-legend
+machinectl image-status
+machinectl image-status container1
+machinectl image-status container1 container1 container{0..4}
+machinectl show-image
+machinectl show-image container1
+machinectl show-image container1 container1 container{0..4}
+
+machinectl clone container1 clone1
+machinectl show-image clone1
+machinectl rename clone1 clone2
+(! machinectl show-image clone1)
+machinectl show-image clone2
+if lsattr -d /var/lib/machines >/dev/null; then
+    [[ "$(machinectl show-image --property=ReadOnly --value clone2)" == no ]]
+    machinectl read-only clone2 yes
+    [[ "$(machinectl show-image --property=ReadOnly --value clone2)" == yes ]]
+    machinectl read-only clone2 no
+    [[ "$(machinectl show-image --property=ReadOnly --value clone2)" == no ]]
+fi
+machinectl remove clone2
+for i in {0..4}; do
+    machinectl clone container1 "clone$i"
+done
+machinectl remove clone{0..4}
+for i in {0..4}; do
+    machinectl clone container1 ".hidden$i"
+done
+machinectl list-images --all
+test -d /var/lib/machines/.hidden1
+machinectl clean
+test ! -d /var/lib/machines/.hidden1
+
+# Prepare a simple raw container
+mkdir -p /tmp/mnt
+dd if=/dev/zero of=/tmp/container.raw bs=1M count=32
+mkfs.ext4 /tmp/container.raw
+mount -o loop /tmp/container.raw /tmp/mnt
+cp -r /var/lib/machines/container1/* /tmp/mnt
+umount /tmp/mnt
+# Try to import it, run it, export it, and re-import it
+machinectl import-raw /tmp/container.raw container-raw
+[[ "$(machinectl show-image --property=Type --value container-raw)" == "raw" ]]
+machinectl start container-raw
+machinectl export-raw container-raw /tmp/container-export.raw
+machinectl import-raw /tmp/container-export.raw container-raw-reimport
+[[ "$(machinectl show-image --property=Type --value container-raw-reimport)" == "raw" ]]
+rm -f /tmp/container{,-export}.raw
+
+# Prepare a simple tar.gz container
+tar -pczf /tmp/container.tar.gz -C /var/lib/machines/container1 .
+# Try to import it, run it, export it, and re-import it
+machinectl import-tar /tmp/container.tar.gz container-tar
+[[ "$(machinectl show-image --property=Type --value container-tar)" == "directory" ]]
+machinectl start container-tar
+machinectl export-tar container-tar /tmp/container-export.tar.gz
+machinectl import-tar /tmp/container-export.tar.gz container-tar-reimport
+[[ "$(machinectl show-image --property=Type --value container-tar-reimport)" == "directory" ]]
+rm -f /tmp/container{,-export}.tar.gz
+
+# Try to import a container directory & run it
+cp -r /var/lib/machines/container1 /tmp/container.dir
+machinectl import-fs /tmp/container.dir container-dir
+[[ "$(machinectl show-image --property=Type --value container-dir)" == "directory" ]]
+machinectl start container-dir
+rm -fr /tmp/container.dir
+
+timeout 10 sh -c "while ! machinectl clean --all; do sleep .5; done"
+
+for opt in format lines machine max-addresses output setenv verify; do
+    (! machinectl status "--$opt=" long-running)
+    (! machinectl status "--$opt=-1" long-running)
+    (! machinectl status "--$opt=''" long-running)
+done
+(! machinectl show "")
+(! machinectl enable)
+(! machinectl enable "")
+(! machinectl disable)
+(! machinectl disable "")
+(! machinectl read-only container1 "")
+(! machinectl read-only container1 foo)
+(! machinectl read-only container1 -- -1)
diff --git a/test/units/testsuite-13.nspawn.sh b/test/units/testsuite-13.nspawn.sh
new file mode 100755
index 0000000000..c234887d05
--- /dev/null
+++ b/test/units/testsuite-13.nspawn.sh
@@ -0,0 +1,374 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# shellcheck disable=SC2016
+set -eux
+set -o pipefail
+
+export SYSTEMD_LOG_LEVEL=debug
+export SYSTEMD_LOG_TARGET=journal
+CREATE_BB_CONTAINER="/usr/lib/systemd/tests/testdata/create-busybox-container"
+
+at_exit() {
+    set +e
+
+    mountpoint -q /var/lib/machines && umount /var/lib/machines
+}
+
+trap at_exit EXIT
+
+# check cgroup-v2
+IS_CGROUPSV2_SUPPORTED=no
+mkdir -p /tmp/cgroup2
+if mount -t cgroup2 cgroup2 /tmp/cgroup2; then
+    IS_CGROUPSV2_SUPPORTED=yes
+    umount /tmp/cgroup2
+fi
+rmdir /tmp/cgroup2
+
+# check cgroup namespaces
+IS_CGNS_SUPPORTED=no
+if [[ -f /proc/1/ns/cgroup ]]; then
+    IS_CGNS_SUPPORTED=yes
+fi
+
+IS_USERNS_SUPPORTED=no
+# On some systems (e.g. CentOS 7) the default limit for user namespaces
+# is set to 0, which causes the following unshare syscall to fail, even
+# with enabled user namespaces support. By setting this value explicitly
+# we can ensure the user namespaces support to be detected correctly.
+sysctl -w user.max_user_namespaces=10000
+if unshare -U sh -c :; then
+    IS_USERNS_SUPPORTED=yes
+fi
+
+# Mount tmpfs over /var/lib/machines to not pollute the image
+mkdir -p /var/lib/machines
+mount -t tmpfs tmpfs /var/lib/machines
+
+testcase_check_bind_tmp_path() {
+    # https://github.com/systemd/systemd/issues/4789
+    local root
+
+    root="$(mktemp -d /var/lib/machines/testsuite-13.bind-tmp-path.XXX)"
+    "$CREATE_BB_CONTAINER" "$root"
+    : >/tmp/bind
+    systemd-nspawn --register=no \
+                   --directory="$root" \
+                   --bind=/tmp/bind \
+                   /bin/sh -c 'test -e /tmp/bind'
+
+    rm -fr "$root" /tmp/bind
+}
+
+testcase_check_norbind() {
+    # https://github.com/systemd/systemd/issues/13170
+    local root
+
+    root="$(mktemp -d /var/lib/machines/testsuite-13.norbind-path.XXX)"
+    mkdir -p /tmp/binddir/subdir
+    echo -n "outer" >/tmp/binddir/subdir/file
+    mount -t tmpfs tmpfs /tmp/binddir/subdir
+    echo -n "inner" >/tmp/binddir/subdir/file
+    "$CREATE_BB_CONTAINER" "$root"
+
+    systemd-nspawn --register=no \
+                   --directory="$root" \
+                   --bind=/tmp/binddir:/mnt:norbind \
+                   /bin/sh -c 'CONTENT=$(cat /mnt/subdir/file); if [[ $CONTENT != "outer" ]]; then echo "*** unexpected content: $CONTENT"; return 1; fi'
+
+    umount /tmp/binddir/subdir
+    rm -fr "$root" /tmp/binddir/
+}
+
+check_rootidmap_cleanup() {
+    local dir="${1:?}"
+
+    mountpoint -q "$dir/bind" && umount "$dir/bind"
+    rm -fr "$dir"
+}
+
+testcase_check_rootidmap() {
+    local root cmd permissions
+    local owner=1000
+
+    root="$(mktemp -d /var/lib/machines/testsuite-13.rootidmap-path.XXX)"
+    # Create ext4 image, as ext4 supports idmapped-mounts.
+    mkdir -p /tmp/rootidmap/bind
+    dd if=/dev/zero of=/tmp/rootidmap/ext4.img bs=4k count=2048
+    mkfs.ext4 /tmp/rootidmap/ext4.img
+    mount /tmp/rootidmap/ext4.img /tmp/rootidmap/bind
+    trap "check_rootidmap_cleanup /tmp/rootidmap/" RETURN
+
+    touch /tmp/rootidmap/bind/file
+    chown -R "$owner:$owner" /tmp/rootidmap/bind
+
+    "$CREATE_BB_CONTAINER" "$root"
+    cmd='PERMISSIONS=$(stat -c "%u:%g" /mnt/file); if [[ $PERMISSIONS != "0:0" ]]; then echo "*** wrong permissions: $PERMISSIONS"; return 1; fi; touch /mnt/other_file'
+    if ! SYSTEMD_LOG_TARGET=console \
+            systemd-nspawn --register=no \
+                           --directory="$root" \
+                           --bind=/tmp/rootidmap/bind:/mnt:rootidmap \
+                           /bin/sh -c "$cmd" |& tee nspawn.out; then
+        if grep -q "Failed to map ids for bind mount.*: Function not implemented" nspawn.out; then
+            echo "idmapped mounts are not supported, skipping the test..."
+            return 0
+        fi
+
+        return 1
+    fi
+
+    permissions=$(stat -c "%u:%g" /tmp/rootidmap/bind/other_file)
+    if [[ $permissions != "$owner:$owner" ]]; then
+        echo "*** wrong permissions: $permissions"
+        [[ "$IS_USERNS_SUPPORTED" == "yes" ]] && return 1
+    fi
+}
+
+testcase_check_notification_socket() {
+    # https://github.com/systemd/systemd/issues/4944
+    local cmd='echo a | $(busybox which nc) -U -u -w 1 /run/host/notify'
+
+    # /testsuite-13.nc-container is prepared by test.sh
+    systemd-nspawn --register=no --directory=/testsuite-13.nc-container /bin/sh -x -c "$cmd"
+    systemd-nspawn --register=no --directory=/testsuite-13.nc-container -U /bin/sh -x -c "$cmd"
+}
+
+testcase_check_os_release() {
+    local root entrypoint os_release_source
+
+    root="$(mktemp -d /var/lib/machines/testsuite-13.check-os-release.XXX)"
+    "$CREATE_BB_CONTAINER" "$root"
+    entrypoint="$root/entrypoint.sh"
+    cat >"$entrypoint" <<\EOF
+#!/bin/sh -ex
+
+. /tmp/os-release
+[[ -n "${ID:-}" && "$ID" != "$container_host_id" ]] && exit 1
+[[ -n "${VERSION_ID:-}" && "$VERSION_ID" != "$container_host_version_id" ]] && exit 1
+[[ -n "${BUILD_ID:-}" && "$BUILD_ID" != "$container_host_build_id" ]] && exit 1
+[[ -n "${VARIANT_ID:-}" && "$VARIANT_ID" != "$container_host_variant_id" ]] && exit 1
+
+cd /tmp
+(cd /run/host && md5sum os-release) | md5sum -c
+EOF
+    chmod +x "$entrypoint"
+
+    os_release_source="/etc/os-release"
+    if [[ ! -r "$os_release_source" ]]; then
+        os_release_source="/usr/lib/os-release"
+    elif [[ -L "$os_release_source" ]]; then
+        # Ensure that /etc always wins if available
+        cp --remove-destination -fv /usr/lib/os-release /etc/os-release
+        echo MARKER=1 >>/etc/os-release
+    fi
+
+    systemd-nspawn --register=no \
+                   --directory="$root" \
+                   --bind="$os_release_source:/tmp/os-release" \
+                   "${entrypoint##"$root"}"
+
+    if grep -q MARKER /etc/os-release; then
+        ln -svrf /usr/lib/os-release /etc/os-release
+    fi
+
+    rm -fr "$root"
+}
+
+testcase_check_machinectl_bind() {
+    local service_path service_name root container_name ec
+    local cmd='for i in $(seq 1 20); do if test -f /tmp/marker; then exit 0; fi; usleep 500000; done; exit 1;'
+
+    root="$(mktemp -d /var/lib/machines/testsuite-13.check-machinectl-bind.XXX)"
+    "$CREATE_BB_CONTAINER" "$root"
+    container_name="${root##*/}"
+
+    service_path="$(mktemp /run/systemd/system/nspawn-machinectl-bind-XXX.service)"
+    service_name="${service_path##*/}"
+    cat >"$service_path" <<EOF
+[Service]
+Type=notify
+ExecStart=systemd-nspawn --directory="$root" --notify-ready=no /bin/sh -xec "$cmd"
+EOF
+
+    systemctl daemon-reload
+    systemctl start "$service_name"
+    touch /tmp/marker
+    machinectl bind --mkdir "$container_name" /tmp/marker
+
+    timeout 10 bash -c "while [[ '\$(systemctl show -P SubState $service_name)' == running ]]; do sleep .2; done"
+    ec="$(systemctl show -P ExecMainStatus "$service_name")"
+
+    rm -fr "$root" "$service_path"
+
+    return "$ec"
+}
+
+testcase_check_selinux() {
+    # Basic test coverage to avoid issues like https://github.com/systemd/systemd/issues/19976
+    if ! command -v selinuxenabled >/dev/null || ! selinuxenabled; then
+        echo >&2 "SELinux is not enabled, skipping SELinux-related tests"
+        return 0
+    fi
+
+    local root
+
+    root="$(mktemp -d /var/lib/machines/testsuite-13.check-selinux.XXX)"
+    "$CREATE_BB_CONTAINER" "$root"
+    chcon -R -t container_t "$root"
+
+    systemd-nspawn --register=no \
+                   --boot \
+                   --directory="$root" \
+                   --selinux-apifs-context=system_u:object_r:container_file_t:s0:c0,c1 \
+                   --selinux-context=system_u:system_r:container_t:s0:c0,c1
+
+    rm -fr "$root"
+}
+
+testcase_check_ephemeral_config() {
+    # https://github.com/systemd/systemd/issues/13297
+    local root container_name
+
+    root="$(mktemp -d /var/lib/machines/testsuite-13.check-ephemeral-config.XXX)"
+    "$CREATE_BB_CONTAINER" "$root"
+    container_name="${root##*/}"
+
+    mkdir -p /run/systemd/nspawn/
+    cat >"/run/systemd/nspawn/$container_name.nspawn" <<EOF
+[Files]
+BindReadOnly=/tmp/ephemeral-config
+EOF
+    touch /tmp/ephemeral-config
+
+    systemd-nspawn --register=no \
+                   --directory="$root" \
+                   --ephemeral \
+                   /bin/sh -x -c "test -f /tmp/ephemeral-config"
+
+    systemd-nspawn --register=no \
+                   --directory="$root" \
+                   --ephemeral \
+                   --machine=foobar \
+                   /bin/sh -x -c "! test -f /tmp/ephemeral-config"
+
+    rm -fr "$root" "/run/systemd/nspawn/$container_name"
+}
+
+matrix_run_one() {
+    local cgroupsv2="${1:?}"
+    local use_cgns="${2:?}"
+    local api_vfs_writable="${3:?}"
+    local root
+
+    if [[ "$cgroupsv2" == "yes" && "$IS_CGROUPSV2_SUPPORTED" == "no" ]]; then
+        echo >&2 "Unified cgroup hierarchy is not supported, skipping..."
+        return 0
+    fi
+
+    if [[ "$use_cgns" == "yes" && "$IS_CGNS_SUPPORTED" == "no" ]];  then
+        echo >&2 "CGroup namespaces are not supported, skipping..."
+        return 0
+    fi
+
+    root="$(mktemp -d "/var/lib/machines/testsuite-13.unified-$1-cgns-$2-api-vfs-writable-$3.XXX")"
+    "$CREATE_BB_CONTAINER" "$root"
+
+    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
+        systemd-nspawn --register=no \
+                       --directory="$root" \
+                       --boot
+
+    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
+        systemd-nspawn --register=no \
+                       --directory="$root" \
+                       --private-network \
+                       --boot
+
+    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
+        systemd-nspawn --register=no \
+                       --directory="$root" \
+                       --private-users=pick \
+                       --boot; then
+        [[ "$IS_USERNS_SUPPORTED" == "yes" && "$api_vfs_writable" == "network" ]] && return 1
+    else
+        [[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" = "network" ]] && return 1
+    fi
+
+    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
+        systemd-nspawn --register=no \
+                       --directory="$root" \
+                       --private-network \
+                       --private-users=pick \
+                       --boot; then
+        [[ "$IS_USERNS_SUPPORTED" == "yes" && "$api_vfs_writable" == "yes" ]] && return 1
+    else
+        [[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" = "yes" ]] && return 1
+    fi
+
+    local netns_opt="--network-namespace-path=/proc/self/ns/net"
+    local net_opt
+    local net_opts=(
+        "--network-bridge=lo"
+        "--network-interface=lo"
+        "--network-ipvlan=lo"
+        "--network-macvlan=lo"
+        "--network-veth"
+        "--network-veth-extra=lo"
+        "--network-zone=zone"
+    )
+
+    # --network-namespace-path and network-related options cannot be used together
+    for net_opt in "${net_opts[@]}"; do
+        echo "$netns_opt in combination with $net_opt should fail"
+        if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
+            systemd-nspawn --register=no \
+                           --directory="$root" \
+                           --boot \
+                           "$netns_opt" \
+                           "$net_opt"; then
+            echo >&2 "unexpected pass"
+            return 1
+        fi
+    done
+
+    # allow combination of --network-namespace-path and --private-network
+    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
+        systemd-nspawn --register=no \
+                       --directory="$root" \
+                       --boot \
+                       --private-network \
+                       "$netns_opt"
+
+    # test --network-namespace-path works with a network namespace created by "ip netns"
+    ip netns add nspawn_test
+    netns_opt="--network-namespace-path=/run/netns/nspawn_test"
+    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
+        systemd-nspawn --register=no \
+                       --directory="$root" \
+                       --network-namespace-path=/run/netns/nspawn_test \
+                       /bin/ip a | grep -v -E '^1: lo.*UP'
+    ip netns del nspawn_test
+
+    rm -fr "$root"
+
+    return 0
+}
+
+# Create a list of all functions prefixed with testcase_
+mapfile -t TESTCASES < <(declare -F | awk '$3 ~ /^testcase_/ {print $3;}')
+
+if [[ "${#TESTCASES[@]}" -eq 0 ]]; then
+    echo >&2 "No test cases found, this is most likely an error"
+    exit 1
+fi
+
+for testcase in "${TESTCASES[@]}"; do
+    "$testcase"
+done
+
+for api_vfs_writable in yes no network; do
+    matrix_run_one no  no  $api_vfs_writable
+    matrix_run_one yes no  $api_vfs_writable
+    matrix_run_one no  yes $api_vfs_writable
+    matrix_run_one yes yes $api_vfs_writable
+done
diff --git a/test/units/testsuite-13.sh b/test/units/testsuite-13.sh
index 0a4b102f03..5a07e7b78c 100755
--- a/test/units/testsuite-13.sh
+++ b/test/units/testsuite-13.sh
@@ -1,376 +1,14 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: LGPL-2.1-or-later
-# shellcheck disable=SC2016
 set -eux
 set -o pipefail
 
-export SYSTEMD_LOG_LEVEL=debug
-export SYSTEMD_LOG_TARGET=journal
-CREATE_BB_CONTAINER="/usr/lib/systemd/tests/testdata/create-busybox-container"
+# shellcheck source=test/units/test-control.sh
+. "$(dirname "$0")"/test-control.sh
 
-at_exit() {
-    set +e
+: >/failed
 
-    mountpoint -q /var/lib/machines && umount /var/lib/machines
-}
-
-trap at_exit EXIT
-
-# check cgroup-v2
-IS_CGROUPSV2_SUPPORTED=no
-mkdir -p /tmp/cgroup2
-if mount -t cgroup2 cgroup2 /tmp/cgroup2; then
-    IS_CGROUPSV2_SUPPORTED=yes
-    umount /tmp/cgroup2
-fi
-rmdir /tmp/cgroup2
-
-# check cgroup namespaces
-IS_CGNS_SUPPORTED=no
-if [[ -f /proc/1/ns/cgroup ]]; then
-    IS_CGNS_SUPPORTED=yes
-fi
-
-IS_USERNS_SUPPORTED=no
-# On some systems (e.g. CentOS 7) the default limit for user namespaces
-# is set to 0, which causes the following unshare syscall to fail, even
-# with enabled user namespaces support. By setting this value explicitly
-# we can ensure the user namespaces support to be detected correctly.
-sysctl -w user.max_user_namespaces=10000
-if unshare -U sh -c :; then
-    IS_USERNS_SUPPORTED=yes
-fi
-
-# Mount tmpfs over /var/lib/machines to not pollute the image
-mkdir -p /var/lib/machines
-mount -t tmpfs tmpfs /var/lib/machines
-
-testcase_check_bind_tmp_path() {
-    # https://github.com/systemd/systemd/issues/4789
-    local root
-
-    root="$(mktemp -d /var/lib/machines/testsuite-13.bind-tmp-path.XXX)"
-    "$CREATE_BB_CONTAINER" "$root"
-    : >/tmp/bind
-    systemd-nspawn --register=no \
-                   --directory="$root" \
-                   --bind=/tmp/bind \
-                   /bin/sh -c 'test -e /tmp/bind'
-
-    rm -fr "$root" /tmp/bind
-}
-
-testcase_check_norbind() {
-    # https://github.com/systemd/systemd/issues/13170
-    local root
-
-    root="$(mktemp -d /var/lib/machines/testsuite-13.norbind-path.XXX)"
-    mkdir -p /tmp/binddir/subdir
-    echo -n "outer" >/tmp/binddir/subdir/file
-    mount -t tmpfs tmpfs /tmp/binddir/subdir
-    echo -n "inner" >/tmp/binddir/subdir/file
-    "$CREATE_BB_CONTAINER" "$root"
-
-    systemd-nspawn --register=no \
-                   --directory="$root" \
-                   --bind=/tmp/binddir:/mnt:norbind \
-                   /bin/sh -c 'CONTENT=$(cat /mnt/subdir/file); if [[ $CONTENT != "outer" ]]; then echo "*** unexpected content: $CONTENT"; return 1; fi'
-
-    umount /tmp/binddir/subdir
-    rm -fr "$root" /tmp/binddir/
-}
-
-check_rootidmap_cleanup() {
-    local dir="${1:?}"
-
-    mountpoint -q "$dir/bind" && umount "$dir/bind"
-    rm -fr "$dir"
-}
-
-testcase_check_rootidmap() {
-    local root cmd permissions
-    local owner=1000
-
-    root="$(mktemp -d /var/lib/machines/testsuite-13.rootidmap-path.XXX)"
-    # Create ext4 image, as ext4 supports idmapped-mounts.
-    mkdir -p /tmp/rootidmap/bind
-    dd if=/dev/zero of=/tmp/rootidmap/ext4.img bs=4k count=2048
-    mkfs.ext4 /tmp/rootidmap/ext4.img
-    mount /tmp/rootidmap/ext4.img /tmp/rootidmap/bind
-    trap "check_rootidmap_cleanup /tmp/rootidmap/" RETURN
-
-    touch /tmp/rootidmap/bind/file
-    chown -R "$owner:$owner" /tmp/rootidmap/bind
-
-    "$CREATE_BB_CONTAINER" "$root"
-    cmd='PERMISSIONS=$(stat -c "%u:%g" /mnt/file); if [[ $PERMISSIONS != "0:0" ]]; then echo "*** wrong permissions: $PERMISSIONS"; return 1; fi; touch /mnt/other_file'
-    if ! SYSTEMD_LOG_TARGET=console \
-            systemd-nspawn --register=no \
-                           --directory="$root" \
-                           --bind=/tmp/rootidmap/bind:/mnt:rootidmap \
-                           /bin/sh -c "$cmd" |& tee nspawn.out; then
-        if grep -q "Failed to map ids for bind mount.*: Function not implemented" nspawn.out; then
-            echo "idmapped mounts are not supported, skipping the test..."
-            return 0
-        fi
-
-        return 1
-    fi
-
-    permissions=$(stat -c "%u:%g" /tmp/rootidmap/bind/other_file)
-    if [[ $permissions != "$owner:$owner" ]]; then
-        echo "*** wrong permissions: $permissions"
-        [[ "$IS_USERNS_SUPPORTED" == "yes" ]] && return 1
-    fi
-}
-
-testcase_check_notification_socket() {
-    # https://github.com/systemd/systemd/issues/4944
-    local cmd='echo a | $(busybox which nc) -U -u -w 1 /run/host/notify'
-
-    # /testsuite-13.nc-container is prepared by test.sh
-    systemd-nspawn --register=no --directory=/testsuite-13.nc-container /bin/sh -x -c "$cmd"
-    systemd-nspawn --register=no --directory=/testsuite-13.nc-container -U /bin/sh -x -c "$cmd"
-}
-
-testcase_check_os_release() {
-    local root entrypoint os_release_source
-
-    root="$(mktemp -d /var/lib/machines/testsuite-13.check-os-release.XXX)"
-    "$CREATE_BB_CONTAINER" "$root"
-    entrypoint="$root/entrypoint.sh"
-    cat >"$entrypoint" <<\EOF
-#!/bin/sh -ex
-
-. /tmp/os-release
-[[ -n "${ID:-}" && "$ID" != "$container_host_id" ]] && exit 1
-[[ -n "${VERSION_ID:-}" && "$VERSION_ID" != "$container_host_version_id" ]] && exit 1
-[[ -n "${BUILD_ID:-}" && "$BUILD_ID" != "$container_host_build_id" ]] && exit 1
-[[ -n "${VARIANT_ID:-}" && "$VARIANT_ID" != "$container_host_variant_id" ]] && exit 1
-
-cd /tmp
-(cd /run/host && md5sum os-release) | md5sum -c
-EOF
-    chmod +x "$entrypoint"
-
-    os_release_source="/etc/os-release"
-    if [[ ! -r "$os_release_source" ]]; then
-        os_release_source="/usr/lib/os-release"
-    elif [[ -L "$os_release_source" ]]; then
-        # Ensure that /etc always wins if available
-        cp --remove-destination -fv /usr/lib/os-release /etc/os-release
-        echo MARKER=1 >>/etc/os-release
-    fi
-
-    systemd-nspawn --register=no \
-                   --directory="$root" \
-                   --bind="$os_release_source:/tmp/os-release" \
-                   "${entrypoint##"$root"}"
-
-    if grep -q MARKER /etc/os-release; then
-        ln -svrf /usr/lib/os-release /etc/os-release
-    fi
-
-    rm -fr "$root"
-}
-
-testcase_check_machinectl_bind() {
-    local service_path service_name root container_name ec
-    local cmd='for i in $(seq 1 20); do if test -f /tmp/marker; then exit 0; fi; usleep 500000; done; exit 1;'
-
-    root="$(mktemp -d /var/lib/machines/testsuite-13.check-machinectl-bind.XXX)"
-    "$CREATE_BB_CONTAINER" "$root"
-    container_name="${root##*/}"
-
-    service_path="$(mktemp /run/systemd/system/nspawn-machinectl-bind-XXX.service)"
-    service_name="${service_path##*/}"
-    cat >"$service_path" <<EOF
-[Service]
-Type=notify
-ExecStart=systemd-nspawn --directory="$root" --notify-ready=no /bin/sh -xec "$cmd"
-EOF
-
-    systemctl daemon-reload
-    systemctl start "$service_name"
-    touch /tmp/marker
-    machinectl bind --mkdir "$container_name" /tmp/marker
-
-    timeout 10 bash -c "while [[ '\$(systemctl show -P SubState $service_name)' == running ]]; do sleep .2; done"
-    ec="$(systemctl show -P ExecMainStatus "$service_name")"
-
-    rm -fr "$root" "$service_path"
-
-    return "$ec"
-}
-
-testcase_check_selinux() {
-    # Basic test coverage to avoid issues like https://github.com/systemd/systemd/issues/19976
-    if ! command -v selinuxenabled >/dev/null || ! selinuxenabled; then
-        echo >&2 "SELinux is not enabled, skipping SELinux-related tests"
-        return 0
-    fi
-
-    local root
-
-    root="$(mktemp -d /var/lib/machines/testsuite-13.check-selinux.XXX)"
-    "$CREATE_BB_CONTAINER" "$root"
-    chcon -R -t container_t "$root"
-
-    systemd-nspawn --register=no \
-                   --boot \
-                   --directory="$root" \
-                   --selinux-apifs-context=system_u:object_r:container_file_t:s0:c0,c1 \
-                   --selinux-context=system_u:system_r:container_t:s0:c0,c1
-
-    rm -fr "$root"
-}
-
-testcase_check_ephemeral_config() {
-    # https://github.com/systemd/systemd/issues/13297
-    local root container_name
-
-    root="$(mktemp -d /var/lib/machines/testsuite-13.check-ephemeral-config.XXX)"
-    "$CREATE_BB_CONTAINER" "$root"
-    container_name="${root##*/}"
-
-    mkdir -p /run/systemd/nspawn/
-    cat >"/run/systemd/nspawn/$container_name.nspawn" <<EOF
-[Files]
-BindReadOnly=/tmp/ephemeral-config
-EOF
-    touch /tmp/ephemeral-config
-
-    systemd-nspawn --register=no \
-                   --directory="$root" \
-                   --ephemeral \
-                   /bin/sh -x -c "test -f /tmp/ephemeral-config"
-
-    systemd-nspawn --register=no \
-                   --directory="$root" \
-                   --ephemeral \
-                   --machine=foobar \
-                   /bin/sh -x -c "! test -f /tmp/ephemeral-config"
-
-    rm -fr "$root" "/run/systemd/nspawn/$container_name"
-}
-
-matrix_run_one() {
-    local cgroupsv2="${1:?}"
-    local use_cgns="${2:?}"
-    local api_vfs_writable="${3:?}"
-    local root
-
-    if [[ "$cgroupsv2" == "yes" && "$IS_CGROUPSV2_SUPPORTED" == "no" ]]; then
-        echo >&2 "Unified cgroup hierarchy is not supported, skipping..."
-        return 0
-    fi
-
-    if [[ "$use_cgns" == "yes" && "$IS_CGNS_SUPPORTED" == "no" ]];  then
-        echo >&2 "CGroup namespaces are not supported, skipping..."
-        return 0
-    fi
-
-    root="$(mktemp -d "/var/lib/machines/testsuite-13.unified-$1-cgns-$2-api-vfs-writable-$3.XXX")"
-    "$CREATE_BB_CONTAINER" "$root"
-
-    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
-        systemd-nspawn --register=no \
-                       --directory="$root" \
-                       --boot
-
-    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
-        systemd-nspawn --register=no \
-                       --directory="$root" \
-                       --private-network \
-                       --boot
-
-    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
-        systemd-nspawn --register=no \
-                       --directory="$root" \
-                       --private-users=pick \
-                       --boot; then
-        [[ "$IS_USERNS_SUPPORTED" == "yes" && "$api_vfs_writable" == "network" ]] && return 1
-    else
-        [[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" = "network" ]] && return 1
-    fi
-
-    if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
-        systemd-nspawn --register=no \
-                       --directory="$root" \
-                       --private-network \
-                       --private-users=pick \
-                       --boot; then
-        [[ "$IS_USERNS_SUPPORTED" == "yes" && "$api_vfs_writable" == "yes" ]] && return 1
-    else
-        [[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" = "yes" ]] && return 1
-    fi
-
-    local netns_opt="--network-namespace-path=/proc/self/ns/net"
-    local net_opt
-    local net_opts=(
-        "--network-bridge=lo"
-        "--network-interface=lo"
-        "--network-ipvlan=lo"
-        "--network-macvlan=lo"
-        "--network-veth"
-        "--network-veth-extra=lo"
-        "--network-zone=zone"
-    )
-
-    # --network-namespace-path and network-related options cannot be used together
-    for net_opt in "${net_opts[@]}"; do
-        echo "$netns_opt in combination with $net_opt should fail"
-        if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
-            systemd-nspawn --register=no \
-                           --directory="$root" \
-                           --boot \
-                           "$netns_opt" \
-                           "$net_opt"; then
-            echo >&2 "unexpected pass"
-            return 1
-        fi
-    done
-
-    # allow combination of --network-namespace-path and --private-network
-    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
-        systemd-nspawn --register=no \
-                       --directory="$root" \
-                       --boot \
-                       --private-network \
-                       "$netns_opt"
-
-    # test --network-namespace-path works with a network namespace created by "ip netns"
-    ip netns add nspawn_test
-    netns_opt="--network-namespace-path=/run/netns/nspawn_test"
-    SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
-        systemd-nspawn --register=no \
-                       --directory="$root" \
-                       --network-namespace-path=/run/netns/nspawn_test \
-                       /bin/ip a | grep -v -E '^1: lo.*UP'
-    ip netns del nspawn_test
-
-    rm -fr "$root"
-
-    return 0
-}
-
-# Create a list of all functions prefixed with testcase_
-mapfile -t TESTCASES < <(declare -F | awk '$3 ~ /^testcase_/ {print $3;}')
-
-if [[ "${#TESTCASES[@]}" -eq 0 ]]; then
-    echo >&2 "No test cases found, this is most likely an error"
-    exit 1
-fi
-
-for testcase in "${TESTCASES[@]}"; do
-    "$testcase"
-done
-
-for api_vfs_writable in yes no network; do
-    matrix_run_one no  no  $api_vfs_writable
-    matrix_run_one yes no  $api_vfs_writable
-    matrix_run_one no  yes $api_vfs_writable
-    matrix_run_one yes yes $api_vfs_writable
-done
+run_subtests
 
 touch /testok
+rm /failed