system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-09-06 16:56:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

test: check for kernel.apparmor_restrict_unprivileged_userns

Browse source 
Some tests in test-execute are already skipped if we do not have
unprivileged user namespaces. Extend this check to look for an apparmor
specific sysctl indicating that unprivileged userns creation is
restricted.
This commit is contained in:
Nick Rosbrook 2024-03-04 15:43:57 -05:00 committed by Luca Boccassi
parent 7360be92ad
commit 70aece8193
1 changed files with 21 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
src/test/test-execute.c
View file

@ -28,6 +28,7 @@
#include "signal-util.h"
#include "static-destruct.h"
#include "stat-util.h"
#include "sysctl-util.h"
#include "tests.h"
#include "tmpfile-util.h"
#include "unit.h"
@ -218,10 +219,30 @@ static void start_parent_slices(Unit *unit) {
}
}
static bool apparmor_restrict_unprivileged_userns(void) {
_cleanup_free_ char *v = NULL;
int r;
/* If kernel.apparmor_restrict_unprivileged_userns=1, then we cannot
* use unprivileged user namespaces. */
r = sysctl_read("kernel/apparmor_restrict_unprivileged_userns", &v);
if (r < 0) {
if (r != -ENOENT)
log_debug_errno(r, "Failed to read kernel.apparmor_restrict_unprivileged_userns sysctl, ignoring: %m");
return false;
}
return streq(v, "1");
}
static bool have_userns_privileges(void) {
pid_t pid;
int r;
if (apparmor_restrict_unprivileged_userns())
return false;
r = safe_fork("(sd-test-check-userns)",
FORK_RESET_SIGNALS |
FORK_CLOSE_ALL_FDS |