summaryrefslogtreecommitdiff
path: root/src/test
Commit message (Collapse)AuthorAgeFilesLines
* core: add DBUS method to bind mount new nodes without service restartLuca Boccassi2021-01-182-0/+4
| | | | | | | | | | | | | | Allow to setup new bind mounts for a service at runtime (via either DBUS or a new 'systemctl bind' verb) with a new helper that forks into the unit's mount namespace. Add a new integration test to cover this. Useful for zero-downtime addition to services that are running inside mount namespaces, especially when using RootImage/RootDirectory. If a service runs with a read-only root, a tmpfs is added on /run to ensure we can create the airlock directory for incoming mounts under /run/host/incoming.
* Add truncate: to StandardOutput= etc.Lucas Werkmeister2021-01-151-0/+5
| | | | | | This adds the ability to specify truncate:PATH for StandardOutput= and StandardError=, similar to the existing append:PATH. The code is mostly copied from the related append: code. Fixes #8983.
* ci: skip test-execute on GH Actions under ASanFrantisek Sumsal2021-01-131-2/+2
| | | | | | | It seems to suffer from the same issue as on Travis CI, where the test randomly fails due to timeouts in its subtests. See: https://github.com/systemd/systemd/issues/10696#issuecomment-758501797
* bpf: do not use structured initialization for bpf_attrLuca Boccassi2021-01-101-5/+5
| | | | | | | It looks like zero'ing the struct is not enough, and with some level of optimizations there is still non-zero padding left over. Switch to member-by-member initialization. Also convert all remaining bpf_attr variables in other files.
* test-xattr-util: don't insist that /usr supports xattrsLennart Poettering2021-01-091-2/+3
| | | | | (apparently overlayfs has issues with xattrs, hence don't require that /usr supports xattrs)
* bpf: zero bpf_attr before initializationLuca Boccassi2021-01-091-10/+0
| | | | | | | | When building with Clang and using structured initialization, the bpf_attr union is not zero-padded, so the kernel misdetects it as an unsupported extension. zero it until Clang's behaviour matches GCC. Do not skip the test on Github Actions anymore.
* test: temporarily skip failing tests on GH ActionsFrantisek Sumsal2021-01-083-2/+17
|
* string-util: imply NULL termination of strextend() argument listLennart Poettering2021-01-061-5/+5
| | | | | The trailing NULL in the argument list is now implied (similar to what we already have in place in strjoin()).
* basic: add make_mount_point_inode helperLuca Boccassi2020-12-211-0/+50
| | | | | Creates a file or a directory depending on the source path, useful for creating mount points.
* tree-wide: fix typoYu Watanabe2020-12-181-3/+3
|
* test: add tpm2 and fido2 libs to dlopen testLennart Poettering2020-12-171-0/+10
|
* homed: move homectl's recovery key generation/modhex code to src/shared/Lennart Poettering2020-12-172-0/+55
| | | | | This allows us to later reuse the code to generate recovery keys for traditional LUKS volumes, too and share the code.
* test: fix fd_is_mount_point() checkLennart Poettering2020-12-172-7/+32
| | | | | | | | | | | | | | | | | | | So the currentl and only fd_is_mount_point() check is actually entirely bogus: it passes "/" as filename argument, but that's not actually a a valid filename, but an absolute path. fd_is_mount_point() is written in a way tha the fd refers to a directory and the specified path is a file directly below it that shall be checked. The test call actually violated that rule, but still expected success. Let's fix this, and check for this explicitly, and refuse it. Let's extend the test and move it to test-mountpoint-util.c where the rest of the tests for related calls are placed. Replaces: #18004 Fixes: #17950
* Merge pull request #17026 from fw-strlen/nft_16Lennart Poettering2020-12-162-9/+27
|\ | | | | add networkd/nspawn nftables backend
| * firewall-util: add nftables backendFlorian Westphal2020-12-161-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Idea is to use a static ruleset, added when the first attempt to add a masquerade or dnat rule is made. The alternative would be to add the ruleset when the init function is called. The disadvantage is that this enables connection tracking and NAT in the kernel (as the ruleset needs this to work), which comes with some overhead that might not be needed (no nspawn usage and no IPMasquerade option set). There is no additional dependency on the 'nft' userspace binary or other libraries. sd-netlinks nfnetlink backend is used to modify the nftables ruleset. The commit message/comments still use nft syntax since that is what users will see when they use the nft tool to list the ruleset. The added initial skeleton (added on first fw_add_masquerade/local_dnat call) looks like this: table ip io.systemd.nat { set masq_saddr { type ipv4_addr flags interval elements = { 192.168.59.160/28 } } map map_port_ipport { type inet_proto . inet_service : ipv4_addr . inet_service elements = { tcp . 2222 : 192.168.59.169 . 22 } } chain prerouting { type nat hook prerouting priority dstnat + 1; policy accept; fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport } chain output { type nat hook output priority -99; policy accept; ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport } chain postrouting { type nat hook postrouting priority srcnat + 1; policy accept; ip saddr @masq_saddr masquerade } } Next calls to fw_add_masquerade/add_local_dnat will then only add/delete the element/mapping to masq_saddr and map_port_ipport, i.e. the ruleset doesn't change -- only the set/map content does. Running test-firewall-util with this backend gives following output on a parallel 'nft monitor': $ nft monitor add table ip io.systemd.nat add chain ip io.systemd.nat prerouting { type nat hook prerouting priority dstnat + 1; policy accept; } add chain ip io.systemd.nat output { type nat hook output priority -99; policy accept; } add chain ip io.systemd.nat postrouting { type nat hook postrouting priority srcnat + 1; policy accept; } add set ip io.systemd.nat masq_saddr { type ipv4_addr; flags interval; } add map ip io.systemd.nat map_port_ipport { type inet_proto . inet_service : ipv4_addr . inet_service; } add rule ip io.systemd.nat prerouting fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport add rule ip io.systemd.nat output ip daddr != 127.0.0.0/8 fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport add rule ip io.systemd.nat postrouting ip saddr @masq_saddr masquerade add element ip io.systemd.nat masq_saddr { 10.1.2.3 } add element ip io.systemd.nat masq_saddr { 10.0.2.0/28 } delete element ip io.systemd.nat masq_saddr { 10.0.2.0/28 } delete element ip io.systemd.nat masq_saddr { 10.1.2.3 } add element ip io.systemd.nat map_port_ipport { tcp . 4711 : 1.2.3.4 . 815 } delete element ip io.systemd.nat map_port_ipport { tcp . 4711 : 1.2.3.4 . 815 } add element ip io.systemd.nat map_port_ipport { tcp . 4711 : 1.2.3.5 . 815 } delete element ip io.systemd.nat map_port_ipport { tcp . 4711 : 1.2.3.5 . 815 } CTRL-C Things not implemented/supported: 1. Change monitoring. The kernel allows userspace to learn about changes made by other clients (using nfnetlink notifications). It would be possible to detect when e.g. someone removes the systemd nat table. This would need more work. Its also not clear on how to react to external changes -- it doesn't seem like a good idea to just auto-undo everthing. 2. 'set masq_saddr' doesn't handle overlaps. Example: fw_add_masquerade(true, AF_INET, "10.0.0.0" , 16); fw_add_masquerade(true, AF_INET, "10.0.0.0" , 8); /* fails */ With the iptables backend the second call works, as it adds an independent iptables rule. With the nftables backend, the range 10.0.0.0-10.255.255.255 clashes with the existing range of 10.0.0.0-10.0.255.255 so 2nd add gets rejected by the kernel. This will generate an error message from networkd ("Could not enable IP masquerading: File exists"). To resolve this it would be needed to either keep track of the added elements and perform range merging when overlaps are detected. However, the add erquests are done using the configured network on a device, so no overlaps should occur in normal setups. IPv6 support is added in a extra changeset. Fixes: #13307
| * firewall-util: introduce context structureFlorian Westphal2020-12-161-10/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | for planned nft backend we have three choices: - open/close a new nfnetlink socket for every operation - keep a nfnetlink socket open internally - expose a opaque fw_ctx and stash all internal data here. Originally I opted for the 2nd option, but during review it was suggested to avoid static storage duration because of perceived problems with threaded applications. This adds fw_ctx and new/free functions, then converts the existing api and nspawn and networkd to use it.
| * firewall-util: reject NULL source or address with prefixlen 0Florian Westphal2020-12-161-2/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure we don't add masquerading rules without a explicitly specified network range we should be masquerading for. The only caller aside from test case is networkd-address.c which never passes a NULL source. As it also passes the network prefix, that should always be > 0 as well. This causes expected test failure: Failed to modify firewall: Invalid argument Failed to modify firewall: Invalid argument Failed to modify firewall: Invalid argument Failed to modify firewall: Protocol not available Failed to modify firewall: Protocol not available Failed to modify firewall: Protocol not available Failed to modify firewall: Protocol not available The failing test cases are amended to expect failure on NULL source or prefix instead of success.
* | shared/hostname-setup: add mode where we check what would be set, without doingZbigniew Jędrzejewski-Szmek2020-12-162-8/+3
| | | | | | | | This allows the 'unsafe' mark to be removed from the test.
* | Move hostname setup logic to new shared/hostname-setup.[ch]Zbigniew Jędrzejewski-Szmek2020-12-164-78/+83
| | | | | | | | | | | | | | | | | | | | No functional change, just moving a bunch of things around. Before we needed a rather complicated setup to test hostname_setup(), because the code was in src/core/. When things are moved to src/shared/ we can just test it as any function. The test is still "unsafe" because hostname_setup() may modify the hostname.
* | Merge pull request #17968 from yuwata/purge-libudevYu Watanabe2020-12-163-98/+98
|\ \ | |/ |/| udev: do not link with libudev
| * meson: do not link with libudevYu Watanabe2020-12-161-9/+9
| |
| * udev: move util_resolve_subsys_kernel() to udev-util.cYu Watanabe2020-12-162-34/+33
| |
| * udev: move util_replace_whitespace() to udev-util.cYu Watanabe2020-12-162-55/+56
| |
* | hostname-util: flagsify hostname_is_valid(), drop machine_name_is_valid()Lennart Poettering2020-12-151-35/+35
|/ | | | | | | | | | | | Let's clean up hostname_is_valid() a bit: let's turn the second boolean argument into a more explanatory flags field, and add a flag that accepts the special name ".host" as valid. This is useful for the container logic, where the special hostname ".host" refers to the "root container", i.e. the host system itself, and can be specified at various places. let's also get rid of machine_name_is_valid(). It was just an alias, which is confusing and even more so now that we have the flags param.
* sd-device: make TAGS= property prefixed and suffixed with ":"Yu Watanabe2020-12-141-20/+47
| | | | | | | | | The commit 6f3ac0d51766b0b9101676cefe5c4ba81feba436 drops the prefix and suffix in TAGS= property. But there exists several rules that have like `TAGS=="*:tag:*"`. So, the property must be always prefixed and suffixed with ":". Fixes #17930.
* udev: introduce new OPTIONS="log_level=" udev ruleYu Watanabe2020-12-101-1/+1
|
* test: add test that dlopen()'s all our weak library deps onceLennart Poettering2020-12-092-0/+44
| | | | | | | | | | This test should ensure we notice if distros update shared libraries that broke so name, and we still use the old soname. (In contrast to what the commit summary says, this currently doesn#t cover really all such deps, specifically xkbcommon and PCRE are missing, since they currently aren't loaded from src/shared/. This is stuff to fix later)
* set: introduce set_strjoin()Yu Watanabe2020-12-081-0/+51
|
* Make support for nscd flushing optionalZbigniew Jędrzejewski-Szmek2020-12-071-11/+14
| | | | | | | | | Fedora will deprecate support for nscd in the upcoming release [1] and plans to drop it in the next one [2]. At that point we might as well build systemd without that support too, since there'll be nothing to talk too. [1] https://fedoraproject.org/wiki/Changes/DeprecateNSCD [2] https://fedoraproject.org/wiki/Changes/RemoveNSCD
* Merge pull request #17079 from keszybz/late-exec-resolutionLennart Poettering2020-12-031-4/+44
|\ | | | | Resolve executable paths before execution, use fexecve()
| * core/execute: fall back to execve() for scriptsZbigniew Jędrzejewski-Szmek2020-11-061-2/+7
| | | | | | | | fexecve() fails with ENOENT and we need a fallback. Add appropriate test.
| * basic/path-util: let find_executable_full() optionally return an fdZbigniew Jędrzejewski-Szmek2020-11-061-4/+39
| |
* | Merge pull request #17812 from poettering/systemctl-version-feature-updateLennart Poettering2020-12-031-1/+1
|\ \ | | | | | | build.h: add a bunch of missing features strings
| * | shared/build: make the version string definition less terribleZbigniew Jędrzejewski-Szmek2020-12-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The BLKID and ELFUTILS strings were present twice. Let's reaarange things so that each times requires definition in exactly one place. Also let's sort things a bit: the "heavy hitters" like PAM/MAC first, then crypto libs, then other libs, alphabetically, compressors, and external compat integrations. I think it's useful for users to group similar concepts together to some extent. For example, when checking what compression is available, it helps a lot to have them listed together. FDISK is renamed to LIBFDISK to make it clear that this is about he library and the executable.
* | | fw_add_masquerade: remove unused function argumentsFlorian Westphal2020-12-031-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | Similar to the previous commit. All callers pass NULL. This will ease initial nftables backend implementation (less features to cover). Add the function parameters as local variables and let compiler remove branches. Followup patch can remove the if (NULL) conditionals.
* | | fw_add_local_dnat: remove unused function argumentsFlorian Westphal2020-12-031-4/+4
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | All users pass a NULL/0 for those, things haven't changed since 2015 when this was added originally, so remove the arguments. THe paramters are re-added as local function variables, initalised to NULL or 0. A followup patch can then manually remove all if (NULL) rather than leaving dead-branch optimization to compiler. Reason for not doing it here is to ease patch review. Not requiring support for this will ease initial nftables backend implementation. In case a use-case comues up later this feature can be re-added.
* | fs-util: add conservative_rename() that suppresses unnecessary renamesLennart Poettering2020-12-021-0/+48
| | | | | | | | | | | | | | | | if the source and destination file match in contents and basic file attributes, don#t rename, but just remove source. This is a simple way to suppress inotify events + mtime changes when atomically updating files.
* | fileio: teach read_full_file_full() to read from offset/with maximum sizeLennart Poettering2020-12-011-2/+47
| |
* | Merge pull request #17478 from yuwata/split-network-internalYu Watanabe2020-11-271-4/+1
|\ \ | | | | | | libsystemd-network: split network-internal.c
| * | meson: drop libsystemd_network from several binariesYu Watanabe2020-10-291-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reduces the size of udevadm: Before: ``` $ ll udevadm -rwxrwxr-x 1 watanabe watanabe 1203800 Oct 29 01:36 udevadm ``` After: ``` $ ll udevadm -rwxrwxr-x 1 watanabe watanabe 1094384 Oct 29 01:38 udevadm ```
* | | shared/seccomp-util: address family filtering is broken on ppcZbigniew Jędrzejewski-Szmek2020-11-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts the gist of da1921a5c396547261c8c7fcd94173346eb3b718 and 0d9fca76bb69e162265b2d25cb79f1890c0da31b (for ppc). Quoting #17559: > libseccomp 2.5 added socket syscall multiplexing on ppc64(el): > https://github.com/seccomp/libseccomp/pull/229 > > Like with i386, s390 and s390x this breaks socket argument filtering, so > RestrictAddressFamilies doesn't work. > > This causes the unit test to fail: > /* test_restrict_address_families */ > Operating on architecture: ppc > Failed to install socket family rules for architecture ppc, skipping: Operation canceled > Operating on architecture: ppc64 > Failed to add socket() rule for architecture ppc64, skipping: Invalid argument > Operating on architecture: ppc64-le > Failed to add socket() rule for architecture ppc64-le, skipping: Invalid argument > Assertion 'fd < 0' failed at src/test/test-seccomp.c:424, function test_restrict_address_families(). Aborting. > > The socket filters can't be added so `socket(AF_UNIX, SOCK_DGRAM, 0);` still > works, triggering the assertion. Fixes #17559.
* | | test: use cap_last_cap() for max supported cap number, not ↵Dan Streetman2020-11-261-29/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | capability_list_length() This test assumes capability_list_length() is an invalid cap number, but that isn't true if the running kernel supports more caps than we were compiled with, which results in the test failing. Instead use cap_last_cap() + 1. If cap_last_cap() is 63, there are no more 'invalid' cap numbers to test with, so the invalid cap number test part is skipped.
* | | Merge pull request #17709 from yuwata/test-seccomp-skipYu Watanabe2020-11-261-0/+45
|\ \ \ | | | | | | | | test: skip several tests in test-seccomp when running under valgrind or ASAN
| * | | test: skip several tests in test-seccomp when running on asanYu Watanabe2020-11-251-0/+15
| | | |
| * | | test: skip several tests in test-seccomp when running on valgrindYu Watanabe2020-11-251-0/+30
| | | |
* | | | specifiers: introduce common macros for generating specifier tablesLennart Poettering2020-11-252-26/+5
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In many cases the tables are largely the same, hence define a common set of macros to generate the common parts. This adds in a couple of missing specifiers here and there, so is more thant just refactoring: it actually fixes accidental omissions. Note that some entries that look like they could be unified under these macros can't really be unified, since they are slightly different. For example in the DNSSD service logic we want to use the DNSSD hostname for %H rather than the unmodified kernel one.
* | | test: bump timeout for test-libcrypt-utilMichael Biebl2020-11-161-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Apparently this test is prone to time out on slower architectures, so bump it from 30s to 120s. See https://buildd.debian.org/status/fetch.php?pkg=systemd&arch=mipsel&ver=247%7Erc2-2&stamp=1605303506&raw=0 https://buildd.debian.org/status/fetch.php?pkg=systemd&arch=sparc64&ver=247%7Erc2-2&stamp=1605294845&raw=0
* | | tree-wide: unsetenv cannot failZbigniew Jędrzejewski-Szmek2020-11-103-8/+8
| | | | | | | | | | | | | | | | | | ... when called with a valid environment variable name. This means that any time we call it with a fixed string, it is guaranteed to return 0. (Also when the variable is not present in the environment block.)
* | | basic/env-util: add little helper to call setenv or unsetenvZbigniew Jędrzejewski-Szmek2020-11-101-4/+1
| | |
* | | license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-09160-160/+160
| | |
View Lorry Controller Status