summaryrefslogtreecommitdiff
path: root/src/test/test-namespace.c
Commit message (Collapse)AuthorAgeFilesLines
* tree-wide: hook up image dissection policy logic everywhereLennart Poettering2023-04-051-0/+3
|
* tree-wide: introduce PIPE_EBADF macroYu Watanabe2022-12-201-1/+1
|
* tree-wide: use -EBADF also in pipe initializersZbigniew Jędrzejewski-Szmek2022-12-191-1/+1
| | | | In some places, initialization is dropped when unnecesary.
* tree-wide: use -EBADF for fd initializationZbigniew Jędrzejewski-Szmek2022-12-191-1/+1
| | | | | | | | | | | | | | | | -1 was used everywhere, but -EBADF or -EBADFD started being used in various places. Let's make things consistent in the new style. Note that there are two candidates: EBADF 9 Bad file descriptor EBADFD 77 File descriptor in bad state Since we're initializating the fd, we're just assigning a value that means "no fd yet", so it's just a bad file descriptor, and the first errno fits better. If instead we had a valid file descriptor that became invalid because of some operation or state change, the other errno would fit better. In some places, initialization is dropped if unnecessary.
* basic: rename util.h to logarithm.hZbigniew Jędrzejewski-Szmek2022-11-081-1/+0
| | | | | util.h is now about logarithms only, so we can rename it. Many files included util.h for no apparent reason… Those includes are dropped.
* core: support ExtensionDirectories in user managerLuca Boccassi2022-03-101-0/+1
| | | | | | | Unprivileged overlayfs is supported since Linux 5.11. The only change needed to get ExtensionDirectories to work is to avoid hard-coding the staging directory to the system manager runtime directory, everything else just works (TM).
* test: allow to set NULL to intro or outroYu Watanabe2022-02-021-1/+1
| | | | Addresses https://github.com/systemd/systemd/pull/22338#discussion_r796741033.
* tests: rework test macros to not take code as parametersLennart Poettering2022-02-021-7/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | C macros are nasty. We use them, but we try to be conservative with them. In particular passing literal, complex code blocks as argument is icky, because of "," handling of C, and also because it's quite a challange for most code highlighters and similar. Hence, let's avoid that. Using macros for genreating functions is OK but if so, the parameters should be simple words, not full code blocks. hence, rework DEFINE_CUSTOM_TEST_MAIN() to take a function name instead of code block as argument. As side-effect this also fixes a bunch of cases where we might end up returning a negative value from main(). Some uses of DEFINE_CUSTOM_TEST_MAIN() inserted local variables into the main() functions, these are replaced by static variables, and their destructors by the static destructor logic. This doesn't fix any bugs or so, it's just supposed to make the code easier to work with and improve it easthetically. Or in other words: let's use macros where it really makes sense, but let's not go overboard with it. (And yes, FOREACH_DIRENT() is another one of those macros that take code, and I dislike that too and regret I ever added that.)
* core: add ExtensionDirectories= settingLuca Boccassi2022-01-211-0/+1
| | | | | | | | Add a new setting that follows the same principle and implementation as ExtensionImages, but using directories as sources. It will be used to implement support for extending portable images with directories, since portable services can already use a directory as root.
* test-namespace: Convert to TEST macroJan Janssen2021-11-281-39/+32
|
* core: make DynamicUser=1 and StateDirectory= work with ↵Luca Boccassi2021-10-271-0/+1
| | | | | | | | | | | | | | TemporaryFileSystem=/var/lib The /var/lib/private/foo -> /var/lib/foo symlink for StateDirectory and DynamicUser is set up on the host filesystem, before the mount namespacing is brought up. If an empty /var/lib is used, to ensure the service does not see other services data, the symlink is then not available despite /var/lib/private being set up as expected. Make a list of symlinks that need to be set up, and create them after all the namespaced filesystems have been created, but before any eventual read-only switch is flipped.
* tree-wide: port everything over to new sd-id128 compund literal blissLennart Poettering2021-08-201-7/+5
|
* Merge pull request #19101 from poettering/mount-util-fixesLennart Poettering2021-03-311-1/+0
|\ | | | | Make recursive bind remounting handle failures gracefully
| * test-namespace: drop spurious double new lineLennart Poettering2021-03-261-1/+0
| |
* | execute: drop DissectImageFlags parameter from namespace_setup()Lennart Poettering2021-03-161-1/+0
|/ | | | | | The function already has a ridiculous amount of paramaters, let's drop one that is either not used at all or has a constant value and let's pick it internally.
* Refactor network namespace specific functions in generic helpersXℹ Ruoyao2021-03-041-4/+13
|
* Add ExtensionImages directive to form overlaysLuca Boccassi2021-02-231-0/+2
| | | | | Add support for overlaying images for services on top of their root fs, using a read-only overlay.
* New directives NoExecPaths= ExecPaths=Topi Miettinen2021-01-291-0/+2
| | | | | | | | | | | | | | | Implement directives `NoExecPaths=` and `ExecPaths=` to control `MS_NOEXEC` mount flag for the file system tree. This can be used to implement file system W^X policies, and for example with allow-listing mode (NoExecPaths=/) a compromised service would not be able to execute a shell, if that was not explicitly allowed. Example: [Service] NoExecPaths=/ ExecPaths=/usr/bin/daemon /usr/lib64 /usr/lib Closes: #17942.
* core: make NotifyAccess= in combination with RootDirectory=/RootImage= workLennart Poettering2021-01-201-0/+1
| | | | | | | | | | | | Previously if people enabled RootDirectory=/RootImage= and NotifyAccess= together, things wouldn't work, they'd have to explicitly add BindReadOnlyPaths=/run/systemd/notify too. Let's make this implicit. Since both options are opt-in, if people use them together it would be pointless not also defining the BindReadOnlyPaths= entry, in which case we can just do it automatically. See: #18051
* core: add DBUS method to bind mount new nodes without service restartLuca Boccassi2021-01-181-0/+2
| | | | | | | | | | | | | | Allow to setup new bind mounts for a service at runtime (via either DBUS or a new 'systemctl bind' verb) with a new helper that forks into the unit's mount namespace. Add a new integration test to cover this. Useful for zero-downtime addition to services that are running inside mount namespaces, especially when using RootImage/RootDirectory. If a service runs with a read-only root, a tmpfs is added on /run to ensure we can create the airlock directory for incoming mounts under /run/host/incoming.
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-091-1/+1
|
* tree-wide: coccinelle fixesFrantisek Sumsal2020-10-041-2/+2
|
* core: hide /run/credentials whenever namespacing is requestedLennart Poettering2020-08-251-0/+1
| | | | | | | | | | | | | | | | | | | | | Ideally we would like to hide all other service's credentials for all services. That would imply for us to enable mount namespacing for all services, which is something we cannot do, both due to compatibility with the status quo ante, and because a number of services legitimately should be able to install mounts in the host hierarchy. Hence we do the second best thing, we hide the credentials automatically for all services that opt into mount namespacing otherwise. This is quite different from other mount sandboxing options: usually you have to explicitly opt into each. However, given that the credentials logic is a brand new concept we invented right here and now, and particularly security sensitive it's OK to reverse this, and by default hide credentials whenever we can (i.e. whenever mount namespacing is otherwise opt-ed in to). Long story short: if you want to hide other service's credentials, the most basic options is to just turn on PrivateMounts= and there you go, they should all be gone.
* namespace: move protect_{home|system} into NamespaceInfoLennart Poettering2020-08-241-2/+0
| | | | | | | | | it's not entirely clear what shall be passed via parameter and what via struct, but these two definitely fit well with the other protect_xyz fields, hence let's move them over. We probably should move a lot more more fields into the structure actuall (most? all even?).
* core: new feature MountImagesLuca Boccassi2020-08-051-0/+1
| | | | | | | | | | | | | Follows the same pattern and features as RootImage, but allows an arbitrary mount point under / to be specified by the user, and multiple values - like BindPaths. Original implementation by @topimiettinen at: https://github.com/systemd/systemd/pull/14451 Reworked to use dissect's logic instead of bare libmount() calls and other review comments. Thanks Topi for the initial work to come up with and implement this useful feature.
* service: add new RootImageOptions featureLuca Boccassi2020-07-291-0/+1
| | | | | | | | | | Allows to specify mount options for RootImage. In case of multi-partition images, the partition number can be prefixed followed by colon. Eg: RootImageOptions=1:ro,dev 2:nosuid nodev In absence of a partition number, 0 is assumed.
* pid1: create ro private tmp dirs when /tmp or /var/tmp is read-onlyZbigniew Jędrzejewski-Szmek2020-07-141-21/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Read-only /var/tmp is more likely, because it's backed by a real device. /tmp is (by default) backed by tmpfs, but it doesn't have to be. In both cases the same consideration applies. If we boot with read-only /var/tmp, any unit with PrivateTmp=yes would fail because we cannot create the subdir under /var/tmp to mount the private directory. But many services actually don't require /var/tmp (either because they only use it occasionally, or because they only use /tmp, or even because they don't use the temporary directories at all, and PrivateTmp=yes is used to isolate them from the rest of the system). To handle both cases let's create a read-only directory under /run/systemd and mount it as the private /tmp or /var/tmp. (Read-only to not fool the service into dumping too much data in /run.) $ sudo systemd-run -t -p PrivateTmp=yes bash Running as unit: run-u14.service Press ^] three times within 1s to disconnect TTY. [root@workstation /]# ls -l /tmp/ total 0 [root@workstation /]# ls -l /var/tmp/ total 0 [root@workstation /]# touch /tmp/f [root@workstation /]# touch /var/tmp/f touch: cannot touch '/var/tmp/f': Read-only file system This commit has more changes than I like to put in one commit, but it's touching all the same paths so it's hard to split. exec_runtime_make() was using the wrong cleanup function, so the directory would be left behind on error.
* core: add RootHashSignature service parameterLuca Boccassi2020-06-251-0/+3
| | | | | Allow to explicitly pass root hash signature as a unit option. Takes precedence over implicit checks.
* core: add RootHash and RootVerity service parametersLuca Boccassi2020-06-231-0/+4
| | | | | Allow to explicitly pass root hash (explicitly or as a file) and verity device/file as unit options. Take precedence over implicit checks.
* core: add new LogNamespace= execution settingLennart Poettering2020-01-311-0/+1
|
* test-namespace: Add test for ProtectKernelLogs=Kevin Kuehler2019-11-151-5/+68
|
* headers: remove unneeded includes from util.hZbigniew Jędrzejewski-Szmek2019-03-271-0/+1
| | | | | This means we need to include many more headers in various files that simply included util.h before, but it seems cleaner to do it this way.
* test: skip various tests if namespacing is not availableLennart Poettering2018-10-241-0/+5
| | | | | | | Apparently on Debian LXC/AppArmor doesn't allow namespacing to container payloads. Deal with it. Fixes: #9700
* tests: use a helper function to parse environment and open loggingZbigniew Jędrzejewski-Szmek2018-09-141-2/+1
| | | | | The advantages are that we save a few lines, and that we can override logging using environment variables in more test executables.
* tests: add helper to unify skipping a test and exitingZbigniew Jędrzejewski-Szmek2018-09-141-8/+6
|
* Drop my copyright headersZbigniew Jędrzejewski-Szmek2018-06-141-3/+0
| | | | | | | perl -i -0pe 's/\s*Copyright © .... Zbigniew Jędrzejewski.*?\n/\n/gms' man/*xml git grep -e 'Copyright.*Jędrzejewski' -l | xargs perl -i -0pe 's/(#\n)?# +Copyright © [0-9, -]+ Zbigniew Jędrzejewski.*?\n//gms' git grep -e 'Copyright.*Jędrzejewski' -l | xargs perl -i -0pe 's/\s*\/\*\*\*\s+Copyright © [0-9, -]+ Zbigniew Jędrzejewski[^\n]*?\s*\*\*\*\/\s*/\n\n/gms' git grep -e 'Copyright.*Jędrzejewski' -l | xargs perl -i -0pe 's/\s+Copyright © [0-9, -]+ Zbigniew Jędrzejewski[^\n]*//gms'
* tree-wide: beautify remaining copyright statementsLennart Poettering2018-06-141-1/+1
| | | | | | Let's unify an beautify our remaining copyright statements, with a unicode ©. This means our copyright statements are now always formatted the same way. Yay.
* tree-wide: drop 'This file is part of systemd' blurbLennart Poettering2018-06-141-2/+0
| | | | | | | | | | | | | | | | This part of the copyright blurb stems from the GPL use recommendations: https://www.gnu.org/licenses/gpl-howto.en.html The concept appears to originate in times where version control was per file, instead of per tree, and was a way to glue the files together. Ultimately, we nowadays don't live in that world anymore, and this information is entirely useless anyway, as people are very welcome to copy these files into any projects they like, and they shouldn't have to change bits that are part of our copyright header for that. hence, let's just get rid of this old cruft, and shorten our codebase a bit.
* tree-wide: drop license boilerplateZbigniew Jędrzejewski-Szmek2018-04-061-13/+0
| | | | | | | | | | Files which are installed as-is (any .service and other unit files, .conf files, .policy files, etc), are left as is. My assumption is that SPDX identifiers are not yet that well known, so it's better to retain the extended header to avoid any doubt. I also kept any copyright lines. We can probably remove them, but it'd nice to obtain explicit acks from all involved authors before doing that.
* Add SPDX license identifiers to source files under the LGPLZbigniew Jędrzejewski-Szmek2017-11-191-0/+1
| | | | | This follows what the kernel is doing, c.f. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5fd54ace4721fc5ce2bb5aef6318fcf17f421460.
* tree-wide: drop NULL sentinel from strjoinZbigniew Jędrzejewski-Szmek2016-10-231-4/+4
| | | | | | | | | | | | | This makes strjoin and strjoina more similar and avoids the useless final argument. spatch -I . -I ./src -I ./src/basic -I ./src/basic -I ./src/shared -I ./src/shared -I ./src/network -I ./src/locale -I ./src/login -I ./src/journal -I ./src/journal -I ./src/timedate -I ./src/timesync -I ./src/nspawn -I ./src/resolve -I ./src/resolve -I ./src/systemd -I ./src/core -I ./src/core -I ./src/libudev -I ./src/udev -I ./src/udev/net -I ./src/udev -I ./src/libsystemd/sd-bus -I ./src/libsystemd/sd-event -I ./src/libsystemd/sd-login -I ./src/libsystemd/sd-netlink -I ./src/libsystemd/sd-network -I ./src/libsystemd/sd-hwdb -I ./src/libsystemd/sd-device -I ./src/libsystemd/sd-id128 -I ./src/libsystemd-network --sp-file coccinelle/strjoin.cocci --in-place $(git ls-files src/*.c) git grep -e '\bstrjoin\b.*NULL' -l|xargs sed -i -r 's/strjoin\((.*), NULL\)/strjoin(\1)/' This might have missed a few cases (spatch has a really hard time dealing with _cleanup_ macros), but that's no big issue, they can always be fixed later.
* tests: don't silently skip `test-namespace`Evgeny Vereshchagin2016-04-101-2/+7
|
* tree-wide: remove Emacs lines from all filesDaniel Mack2016-02-101-2/+0
| | | | | This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.
* util-lib: split out allocation calls into alloc-util.[ch]Lennart Poettering2015-10-271-0/+1
|
* util-lib: split out fd-related operations into fd-util.[ch]Lennart Poettering2015-10-251-0/+1
| | | | | There are more than enough to deserve their own .c file, hence move them over.
* util-lib: split our string related calls from util.[ch] into its own file ↵Lennart Poettering2015-10-241-1/+2
| | | | | | | | | | | | | | string-util.[ch] There are more than enough calls doing string manipulations to deserve its own files, hence do something about it. This patch also sorts the #include blocks of all files that needed to be updated, according to the sorting suggestions from CODING_STYLE. Since pretty much every file needs our string manipulation functions this effectively means that most files have sorted #include blocks now. Also touches a few unrelated include files.
* shared: add process-util.[ch]Ronny Chevalier2015-04-101-0/+1
|
* util: rework strappenda(), and rename it strjoina()Lennart Poettering2015-02-031-2/+2
| | | | | | After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
* remove unneeded libgen.h includesCristian Rodríguez2015-01-171-1/+0
|
* util: replace close_pipe() with new safe_close_pair()Lennart Poettering2014-03-241-1/+1
| | | | | | safe_close_pair() is more like safe_close(), except that it handles pairs of fds, and doesn't make and misleading allusion, as it works similarly well for socketpairs() as for pipe()s...
View Lorry Controller Status