systemd/test/test-execute/exec-systemcallfilter-system-user.service

# SPDX-License-Identifier: LGPL-2.1-or-later
[Unit]
Description=Test for SystemCallFilter in system mode with User set (daemon)

[Service]
ExecStart=/bin/sh -c 'echo "Foo bar"'
Type=oneshot
User=daemon
SystemCallFilter=~read write open execve ioperm
SystemCallFilter=ioctl
SystemCallFilter=read write open execve
SystemCallFilter=~ioperm
tests: add spdx license header to test unit/link/network/conf files Those are all consumed by our parser, so they all support comments. I was considering whether they should have a license header at all, but in the end I decided to add it because those files are often created by copying parts of real unit files. And if the real ones have a license, then those might as well. It's easier to add it than to make an exception. 2021-10-17 16:07:22 +00:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
core: set NoNewPrivileges for seccomp if we don't have CAP_SYS_ADMIN The manpage of seccomp specify that using seccomp with SECCOMP_SET_MODE_FILTER will return EACCES if the caller do not have CAP_SYS_ADMIN set, or if the no_new_privileges bit is not set. Hence, without NoNewPrivilege set, it is impossible to use a SystemCall* directive with a User directive set in system mode. Now, NoNewPrivileges is set if we are in user mode, or if we are in system mode and we don't have CAP_SYS_ADMIN, and SystemCall* directives are used. 2016-01-30 16:26:39 +00:00			`[Unit]`
test-execute: add tests with user/group daemon The nobody user/group may not synthesized by systemd. To run tests the functionalities in such situation, this adds tests by user/group by daemon, as it is expected to exists all environments. 2018-03-02 06:55:02 +00:00			`Description=Test for SystemCallFilter in system mode with User set (daemon)`
core: set NoNewPrivileges for seccomp if we don't have CAP_SYS_ADMIN The manpage of seccomp specify that using seccomp with SECCOMP_SET_MODE_FILTER will return EACCES if the caller do not have CAP_SYS_ADMIN set, or if the no_new_privileges bit is not set. Hence, without NoNewPrivilege set, it is impossible to use a SystemCall* directive with a User directive set in system mode. Now, NoNewPrivileges is set if we are in user mode, or if we are in system mode and we don't have CAP_SYS_ADMIN, and SystemCall* directives are used. 2016-01-30 16:26:39 +00:00
			`[Service]`
test-execute: always use /bin/sh 2017-10-12 04:26:39 +00:00			`ExecStart=/bin/sh -c 'echo "Foo bar"'`
core: set NoNewPrivileges for seccomp if we don't have CAP_SYS_ADMIN The manpage of seccomp specify that using seccomp with SECCOMP_SET_MODE_FILTER will return EACCES if the caller do not have CAP_SYS_ADMIN set, or if the no_new_privileges bit is not set. Hence, without NoNewPrivilege set, it is impossible to use a SystemCall* directive with a User directive set in system mode. Now, NoNewPrivileges is set if we are in user mode, or if we are in system mode and we don't have CAP_SYS_ADMIN, and SystemCall* directives are used. 2016-01-30 16:26:39 +00:00			`Type=oneshot`
test-execute: add tests with user/group daemon The nobody user/group may not synthesized by systemd. To run tests the functionalities in such situation, this adds tests by user/group by daemon, as it is expected to exists all environments. 2018-03-02 06:55:02 +00:00			`User=daemon`
core: set NoNewPrivileges for seccomp if we don't have CAP_SYS_ADMIN The manpage of seccomp specify that using seccomp with SECCOMP_SET_MODE_FILTER will return EACCES if the caller do not have CAP_SYS_ADMIN set, or if the no_new_privileges bit is not set. Hence, without NoNewPrivilege set, it is impossible to use a SystemCall* directive with a User directive set in system mode. Now, NoNewPrivileges is set if we are in user mode, or if we are in system mode and we don't have CAP_SYS_ADMIN, and SystemCall* directives are used. 2016-01-30 16:26:39 +00:00			`SystemCallFilter=~read write open execve ioperm`
			`SystemCallFilter=ioctl`
			`SystemCallFilter=read write open execve`
			`SystemCallFilter=~ioperm`