systemd/test/test-execute/exec-protectkernelmodules-no-capabilities.service

# SPDX-License-Identifier: LGPL-2.1-or-later
[Unit]
Description=Test CAP_SYS_MODULE ProtectKernelModules=no

[Service]
ProtectKernelModules=no
# sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output
ExecStart=sh -x -c 'capsh --print | sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' | grep cap_sys_module'
Type=oneshot
tests: add spdx license header to test unit/link/network/conf files Those are all consumed by our parser, so they all support comments. I was considering whether they should have a license header at all, but in the end I decided to add it because those files are often created by copying parts of real unit files. And if the real ones have a license, then those might as well. It's easier to add it than to make an exception. 2021-10-17 16:07:22 +00:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
test: add capability tests for ProtectKernelModules= This just adds capabilities test. 2016-10-07 17:17:34 +00:00			`[Unit]`
			`Description=Test CAP_SYS_MODULE ProtectKernelModules=no`

			`[Service]`
			`ProtectKernelModules=no`
test: ignore IAB capabilities in `test-execute` libcap v2.33 introduces a new capability set called IAB[0] which is shown in the output of `capsh --print` and interferes with the test checks. Let's drop the IAB set from the output, for now, to mitigate this. This could be (and probably should be) replaced in the future by the newly introduced testing options[1][2] in libcap v2.32, namely: --has-p=xxx --has-i=xxx --has-a=xxx but this needs to wait until the respective libcap version gets a wider adoption. Until then, let's stick with the relatively ugly sed. Fixes: #15046 [0] https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=943b011b5e53624eb9cab4e96c1985326e077cdd [1] https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=588d0439cb6495b03f0ab9f213f0b6b339e7d4b7 [2] https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=e7709bbc1c4712f2ddfc6e6f42892928a8a03782 2020-03-09 10:00:58 +00:00			`# sed: remove dropped (cap_xxx-[epi]) and IAB capabilities from the output`
tests: use relative paths in ExecStart= and friends We want to retain some of the full paths in order to test more code paths. But the default should be to use the command name only. This makes the tests less visually cluttered. 2024-01-04 14:24:52 +00:00			`ExecStart=sh -x -c 'capsh --print \| sed -re "s/[^ ]+?\-[epi]+//g" -e '/IAB/d' \| grep cap_sys_module'`
test: add capability tests for ProtectKernelModules= This just adds capabilities test. 2016-10-07 17:17:34 +00:00			`Type=oneshot`