2020-08-11 15:08:41 +00:00
|
|
|
#!/usr/bin/env bash
|
2021-10-17 16:13:06 +00:00
|
|
|
# SPDX-License-Identifier: LGPL-2.1-or-later
|
2021-04-09 17:39:41 +00:00
|
|
|
# shellcheck disable=SC2016
|
|
|
|
set -eux
|
2020-08-11 15:08:41 +00:00
|
|
|
|
|
|
|
systemd-analyze log-level debug
|
|
|
|
|
|
|
|
# Verify that the creds are properly loaded and we can read them from the service's unpriv user
|
|
|
|
systemd-run -p LoadCredential=passwd:/etc/passwd \
|
|
|
|
-p LoadCredential=shadow:/etc/shadow \
|
|
|
|
-p SetCredential=dog:wuff \
|
|
|
|
-p DynamicUser=1 \
|
|
|
|
--wait \
|
|
|
|
--pipe \
|
2021-04-07 22:09:55 +00:00
|
|
|
cat '${CREDENTIALS_DIRECTORY}/passwd' '${CREDENTIALS_DIRECTORY}/shadow' '${CREDENTIALS_DIRECTORY}/dog' >/tmp/ts54-concat
|
2020-08-11 15:08:41 +00:00
|
|
|
( cat /etc/passwd /etc/shadow && echo -n wuff ) | cmp /tmp/ts54-concat
|
|
|
|
rm /tmp/ts54-concat
|
|
|
|
|
|
|
|
# Verify that the creds are immutable
|
2021-04-07 23:27:33 +00:00
|
|
|
systemd-run -p LoadCredential=passwd:/etc/passwd \
|
2020-08-11 15:08:41 +00:00
|
|
|
-p DynamicUser=1 \
|
|
|
|
--wait \
|
2021-04-07 23:27:33 +00:00
|
|
|
touch '${CREDENTIALS_DIRECTORY}/passwd' \
|
|
|
|
&& { echo 'unexpected success'; exit 1; }
|
|
|
|
systemd-run -p LoadCredential=passwd:/etc/passwd \
|
2020-08-11 15:08:41 +00:00
|
|
|
-p DynamicUser=1 \
|
|
|
|
--wait \
|
2021-04-07 23:27:33 +00:00
|
|
|
rm '${CREDENTIALS_DIRECTORY}/passwd' \
|
|
|
|
&& { echo 'unexpected success'; exit 1; }
|
2020-08-11 15:08:41 +00:00
|
|
|
|
2021-07-24 16:38:22 +00:00
|
|
|
# Check directory-based loading
|
|
|
|
mkdir -p /tmp/ts54-creds/sub
|
|
|
|
echo -n a >/tmp/ts54-creds/foo
|
|
|
|
echo -n b >/tmp/ts54-creds/bar
|
|
|
|
echo -n c >/tmp/ts54-creds/baz
|
|
|
|
echo -n d >/tmp/ts54-creds/sub/qux
|
|
|
|
systemd-run -p LoadCredential=cred:/tmp/ts54-creds \
|
|
|
|
-p DynamicUser=1 \
|
|
|
|
--wait \
|
|
|
|
--pipe \
|
|
|
|
cat '${CREDENTIALS_DIRECTORY}/cred_foo' \
|
|
|
|
'${CREDENTIALS_DIRECTORY}/cred_bar' \
|
|
|
|
'${CREDENTIALS_DIRECTORY}/cred_baz' \
|
|
|
|
'${CREDENTIALS_DIRECTORY}/cred_sub_qux' >/tmp/ts54-concat
|
|
|
|
( echo -n abcd ) | cmp /tmp/ts54-concat
|
|
|
|
rm /tmp/ts54-concat
|
|
|
|
rm -rf /tmp/ts54-creds
|
2021-06-24 08:28:28 +00:00
|
|
|
|
2021-07-24 16:38:22 +00:00
|
|
|
# Now test encrypted credentials (only supported when built with OpenSSL though)
|
2021-06-24 08:28:28 +00:00
|
|
|
if systemctl --version | grep -q -- +OPENSSL ; then
|
|
|
|
echo -n $RANDOM >/tmp/test-54-plaintext
|
|
|
|
systemd-creds encrypt --name=test-54 /tmp/test-54-plaintext /tmp/test-54-ciphertext
|
|
|
|
systemd-creds decrypt --name=test-54 /tmp/test-54-ciphertext | cmp /tmp/test-54-plaintext
|
|
|
|
|
|
|
|
systemd-run -p LoadCredentialEncrypted=test-54:/tmp/test-54-ciphertext \
|
|
|
|
--wait \
|
|
|
|
--pipe \
|
|
|
|
cat '${CREDENTIALS_DIRECTORY}/test-54' | cmp /tmp/test-54-plaintext
|
|
|
|
|
|
|
|
echo -n $RANDOM >/tmp/test-54-plaintext
|
|
|
|
systemd-creds encrypt --name=test-54 /tmp/test-54-plaintext /tmp/test-54-ciphertext
|
|
|
|
systemd-creds decrypt --name=test-54 /tmp/test-54-ciphertext | cmp /tmp/test-54-plaintext
|
|
|
|
|
2021-09-29 18:30:08 +00:00
|
|
|
systemd-run -p SetCredentialEncrypted=test-54:"$(cat /tmp/test-54-ciphertext)" \
|
2021-06-24 08:28:28 +00:00
|
|
|
--wait \
|
|
|
|
--pipe \
|
|
|
|
cat '${CREDENTIALS_DIRECTORY}/test-54' | cmp /tmp/test-54-plaintext
|
|
|
|
|
|
|
|
rm /tmp/test-54-plaintext /tmp/test-54-ciphertext
|
|
|
|
fi
|
|
|
|
|
2020-08-11 15:08:41 +00:00
|
|
|
systemd-analyze log-level info
|
|
|
|
|
2021-04-07 22:09:55 +00:00
|
|
|
echo OK >/testok
|
2020-08-11 15:08:41 +00:00
|
|
|
|
|
|
|
exit 0
|