system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-10-15 04:24:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

test: add capability tests for ProtectKernelModules=

Browse source 
This just adds capabilities test.
This commit is contained in:
Djalal Harouni 2016-10-07 19:17:34 +02:00
parent 502d704e5e
commit 3ae33295f0
4 changed files with 27 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Makefile.am
View file

@ -1639,6 +1639,8 @@ EXTRA_DIST += \
test/test-execute/exec-privatedevices-yes.service \
test/test-execute/exec-privatedevices-no-capability-mknod.service \
test/test-execute/exec-privatedevices-yes-capability-mknod.service \
test/test-execute/exec-protectkernelmodules-no-capabilities.service \
test/test-execute/exec-protectkernelmodules-yes-capabilities.service \
test/test-execute/exec-privatetmp-no.service \
test/test-execute/exec-privatetmp-yes.service \
test/test-execute/exec-readonlypaths.service \

11
src/test/test-execute.c
View file

@ -142,6 +142,16 @@ static void test_exec_privatedevices_capabilities(Manager *m) {
test(m, "exec-privatedevices-no-capability-mknod.service", 0, CLD_EXITED);
}
static void test_exec_protectkernelmodules_capabilities(Manager *m) {
if (detect_container() > 0) {
log_notice("testing in container, skipping protectkernelmodules tests");
return;
}
test(m, "exec-protectkernelmodules-no-capabilities.service", 0, CLD_EXITED);
test(m, "exec-protectkernelmodules-yes-capabilities.service", 0, CLD_EXITED);
}
static void test_exec_readonlypaths(Manager *m) {
test(m, "exec-readonlypaths.service", 0, CLD_EXITED);
test(m, "exec-readonlypaths-mount-propagation.service", 0, CLD_EXITED);
@ -368,6 +378,7 @@ int main(int argc, char *argv[]) {
test_exec_privatetmp,
test_exec_privatedevices,
test_exec_privatedevices_capabilities,
test_exec_protectkernelmodules_capabilities,
test_exec_readonlypaths,
test_exec_readwritepaths,
test_exec_inaccessiblepaths,

7
test/test-execute/exec-protectkernelmodules-no-capabilities.service Normal file
View file

@ -0,0 +1,7 @@
[Unit]
Description=Test CAP_SYS_MODULE ProtectKernelModules=no
[Service]
ProtectKernelModules=no
ExecStart=/bin/sh -x -c 'capsh --print | grep cap_sys_module'
Type=oneshot

7
test/test-execute/exec-protectkernelmodules-yes-capabilities.service Normal file
View file

@ -0,0 +1,7 @@
[Unit]
Description=Test CAP_SYS_MODULE for ProtectKernelModules=yes
[Service]
ProtectKernelModules=yes
ExecStart=/bin/sh -x -c '! capsh --print | grep cap_sys_module'
Type=oneshot