systemd/test/test-execute/exec-systemcallfilter-nonewprivileges-bounding2.service

# SPDX-License-Identifier: LGPL-2.1-or-later
[Unit]
Description=Test bounding set is right with SystemCallFilter and non-root user

[Service]
ExecStart=sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_setpcap,cap_net_bind_service,cap_sys_admin"'
Type=oneshot
User=1
SystemCallFilter=@system-service
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_SETPCAP CAP_NET_BIND_SERVICE
test-execute: add no_new_privs tests for SystemCallFilter When starting a service with a non-root user and a SystemCallFilter and other settings (like ProtectClock), the no_new_privs flag should not be set. Also, test that CapabilityBoundingSet behaves correctly, since we need to preserve some capabilities to do the seccomp filter and restore the ones set by the service before executing. 2023-09-20 09:40:47 +00:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
			`[Unit]`
			`Description=Test bounding set is right with SystemCallFilter and non-root user`

			`[Service]`
tests: use relative paths in ExecStart= and friends We want to retain some of the full paths in order to test more code paths. But the default should be to use the command name only. This makes the tests less visually cluttered. 2024-01-04 14:24:52 +00:00			`ExecStart=sh -x -c 'c=$$(capsh --print \| grep "Bounding set "); test "$$c" = "Bounding set =cap_setpcap,cap_net_bind_service,cap_sys_admin"'`
test-execute: add no_new_privs tests for SystemCallFilter When starting a service with a non-root user and a SystemCallFilter and other settings (like ProtectClock), the no_new_privs flag should not be set. Also, test that CapabilityBoundingSet behaves correctly, since we need to preserve some capabilities to do the seccomp filter and restore the ones set by the service before executing. 2023-09-20 09:40:47 +00:00			`Type=oneshot`
			`User=1`
			`SystemCallFilter=@system-service`
			`CapabilityBoundingSet=CAP_SYS_ADMIN CAP_SETPCAP CAP_NET_BIND_SERVICE`