90 lines
3.8 KiB
Diff
90 lines
3.8 KiB
Diff
From 4a43c2b3a1066247f26d8a6e52ebfc40852a5f7e Mon Sep 17 00:00:00 2001
|
|
From: Frantisek Sumsal <frantisek@sumsal.cz>
|
|
Date: Fri, 24 Nov 2023 16:00:15 +0100
|
|
Subject: [PATCH 3/3] test: add a couple of tests for RestrictFileSystems=
|
|
|
|
---
|
|
test/units/testsuite-07.exec-context.sh | 31 +++++++++++++++++++++++++
|
|
test/units/util.sh | 19 +++++++++++++++
|
|
2 files changed, 50 insertions(+)
|
|
|
|
diff --git a/test/units/testsuite-07.exec-context.sh b/test/units/testsuite-07.exec-context.sh
|
|
index b4118d2fe8..10b425359d 100755
|
|
--- a/test/units/testsuite-07.exec-context.sh
|
|
+++ b/test/units/testsuite-07.exec-context.sh
|
|
@@ -4,6 +4,9 @@
|
|
set -eux
|
|
set -o pipefail
|
|
|
|
+# shellcheck source=test/units/util.sh
|
|
+. "$(dirname "$0")"/util.sh
|
|
+
|
|
# Make sure the unit's exec context matches its configuration
|
|
# See: https://github.com/systemd/systemd/pull/29552
|
|
|
|
@@ -284,6 +287,34 @@ systemd-run --wait --pipe "${ARGUMENTS[@]}" \
|
|
ulimit -R || exit 0;
|
|
: RTTIME; [[ $(ulimit -SR) -eq 666666 ]]; [[ $(ulimit -HR) -eq 666666 ]];'
|
|
|
|
+# RestrictFileSystems=
|
|
+#
|
|
+# Note: running instrumented binaries requires at least /proc to be accessible, so let's
|
|
+# skip the test when we're running under sanitizers
|
|
+if [[ ! -v ASAN_OPTIONS ]] && systemctl --version | grep "+BPF_FRAMEWORK" && kernel_supports_lsm bpf; then
|
|
+ ROOTFS="$(df --output=fstype /usr/bin | sed --quiet 2p)"
|
|
+ systemd-run --wait --pipe -p RestrictFileSystems="" ls /
|
|
+ systemd-run --wait --pipe -p RestrictFileSystems="$ROOTFS foo bar" ls /
|
|
+ (! systemd-run --wait --pipe -p RestrictFileSystems="$ROOTFS" ls /proc)
|
|
+ (! systemd-run --wait --pipe -p RestrictFileSystems="foo" ls /)
|
|
+ systemd-run --wait --pipe -p RestrictFileSystems="$ROOTFS foo bar baz proc" ls /proc
|
|
+ systemd-run --wait --pipe -p RestrictFileSystems="$ROOTFS @foo @basic-api" ls /proc
|
|
+ systemd-run --wait --pipe -p RestrictFileSystems="$ROOTFS @foo @basic-api" ls /sys/fs/cgroup
|
|
+
|
|
+ systemd-run --wait --pipe -p RestrictFileSystems="~" ls /
|
|
+ systemd-run --wait --pipe -p RestrictFileSystems="~proc" ls /
|
|
+ systemd-run --wait --pipe -p RestrictFileSystems="~@basic-api" ls /
|
|
+ (! systemd-run --wait --pipe -p RestrictFileSystems="~$ROOTFS" ls /)
|
|
+ (! systemd-run --wait --pipe -p RestrictFileSystems="~proc" ls /proc)
|
|
+ (! systemd-run --wait --pipe -p RestrictFileSystems="~@basic-api" ls /proc)
|
|
+ (! systemd-run --wait --pipe -p RestrictFileSystems="~proc foo @bar @basic-api" ls /proc)
|
|
+ (! systemd-run --wait --pipe -p RestrictFileSystems="~proc foo @bar @basic-api" ls /sys)
|
|
+ systemd-run --wait --pipe -p RestrictFileSystems="~proc devtmpfs sysfs" ls /
|
|
+ (! systemd-run --wait --pipe -p RestrictFileSystems="~proc devtmpfs sysfs" ls /proc)
|
|
+ (! systemd-run --wait --pipe -p RestrictFileSystems="~proc devtmpfs sysfs" ls /dev)
|
|
+ (! systemd-run --wait --pipe -p RestrictFileSystems="~proc devtmpfs sysfs" ls /sys)
|
|
+fi
|
|
+
|
|
# Ensure that clean-up codepaths work correctly if activation ultimately fails
|
|
touch /run/not-a-directory
|
|
mkdir /tmp/root
|
|
diff --git a/test/units/util.sh b/test/units/util.sh
|
|
index fdfb91f8c6..b5ed73237c 100755
|
|
--- a/test/units/util.sh
|
|
+++ b/test/units/util.sh
|
|
@@ -197,3 +197,22 @@ openssl_supports_kdf() {
|
|
# but let's do that when/if the need arises
|
|
openssl kdf -keylen 16 -kdfopt digest:SHA2-256 -kdfopt key:foo -out /dev/null "$kdf"
|
|
}
|
|
+
|
|
+kernel_supports_lsm() {
|
|
+ local lsm="${1:?}"
|
|
+ local items item
|
|
+
|
|
+ if [[ ! -e /sys/kernel/security/lsm ]]; then
|
|
+ echo "/sys/kernel/security/lsm doesn't exist, assuming $lsm is not supported"
|
|
+ return 1
|
|
+ fi
|
|
+
|
|
+ mapfile -t -d, items </sys/kernel/security/lsm
|
|
+ for item in "${items[@]}"; do
|
|
+ if [[ "$item" == "$lsm" ]]; then
|
|
+ return 0
|
|
+ fi
|
|
+ done
|
|
+
|
|
+ return 1
|
|
+}
|
|
--
|
|
2.43.0
|
|
|