systemd/test/test-execute/exec-noexecpaths-simple.service

# SPDX-License-Identifier: LGPL-2.1-or-later
[Unit]
Description=Test for NoExecPaths=

[Service]
Type=oneshot
# This should work, as we explicitly disable the effect of NoExecPaths=
ExecStart=+/bin/sh -c '/bin/cat /dev/null'
# This should also work, as we do not disable the effect of NoExecPaths= but invert the exit code
ExecStart=sh -x -c '! /bin/cat /dev/null'
NoExecPaths=/bin/cat
tests: add spdx license header to test unit/link/network/conf files Those are all consumed by our parser, so they all support comments. I was considering whether they should have a license header at all, but in the end I decided to add it because those files are often created by copying parts of real unit files. And if the real ones have a license, then those might as well. It's easier to add it than to make an exception. 2021-10-17 16:07:22 +00:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
New directives NoExecPaths= ExecPaths= Implement directives `NoExecPaths=` and `ExecPaths=` to control `MS_NOEXEC` mount flag for the file system tree. This can be used to implement file system W^X policies, and for example with allow-listing mode (NoExecPaths=/) a compromised service would not be able to execute a shell, if that was not explicitly allowed. Example: [Service] NoExecPaths=/ ExecPaths=/usr/bin/daemon /usr/lib64 /usr/lib Closes: #17942. 2021-01-16 11:49:32 +00:00			`[Unit]`
			`Description=Test for NoExecPaths=`

			`[Service]`
			`Type=oneshot`
			`# This should work, as we explicitly disable the effect of NoExecPaths=`
			`ExecStart=+/bin/sh -c '/bin/cat /dev/null'`
			`# This should also work, as we do not disable the effect of NoExecPaths= but invert the exit code`
tests: use relative paths in ExecStart= and friends We want to retain some of the full paths in order to test more code paths. But the default should be to use the command name only. This makes the tests less visually cluttered. 2024-01-04 14:24:52 +00:00			`ExecStart=sh -x -c '! /bin/cat /dev/null'`
New directives NoExecPaths= ExecPaths= Implement directives `NoExecPaths=` and `ExecPaths=` to control `MS_NOEXEC` mount flag for the file system tree. This can be used to implement file system W^X policies, and for example with allow-listing mode (NoExecPaths=/) a compromised service would not be able to execute a shell, if that was not explicitly allowed. Example: [Service] NoExecPaths=/ ExecPaths=/usr/bin/daemon /usr/lib64 /usr/lib Closes: #17942. 2021-01-16 11:49:32 +00:00			`NoExecPaths=/bin/cat`