summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRonny Chevalier <chevalier.ronny@gmail.com>2014-02-14 17:21:41 +0100
committerZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>2014-02-14 19:00:32 -0500
commitf928d3263d788da8dec64f06c792988b6076e600 (patch)
treef8b7f989cc2315259b02a9556da7db08d381e931
parent8f9c6fe5ff1d59001aecbf3fbf9ca0ed7ff28ba7 (diff)
test: add basic seccomp tests
l---------test/TEST-04-SECCOMP/Makefile1
-rwxr-xr-xtest/TEST-04-SECCOMP/test-seccomp.sh13
-rwxr-xr-xtest/TEST-04-SECCOMP/test.sh79
-rw-r--r--test/TEST-04-SECCOMP/will-fail.service8
-rw-r--r--test/TEST-04-SECCOMP/will-fail2.service6
-rw-r--r--test/TEST-04-SECCOMP/will-not-fail.service9
-rw-r--r--test/TEST-04-SECCOMP/will-not-fail2.service6
7 files changed, 122 insertions, 0 deletions
diff --git a/test/TEST-04-SECCOMP/Makefile b/test/TEST-04-SECCOMP/Makefile
new file mode 120000
index 0000000000..e9f93b1104
--- /dev/null
+++ b/test/TEST-04-SECCOMP/Makefile
@@ -0,0 +1 @@
+../TEST-01-BASIC/Makefile \ No newline at end of file
diff --git a/test/TEST-04-SECCOMP/test-seccomp.sh b/test/TEST-04-SECCOMP/test-seccomp.sh
new file mode 100755
index 0000000000..2496190445
--- /dev/null
+++ b/test/TEST-04-SECCOMP/test-seccomp.sh
@@ -0,0 +1,13 @@
+#!/bin/bash -x
+
+systemctl start will-fail.service
+systemctl start will-fail2.service
+systemctl start will-not-fail.service
+systemctl start will-not-fail2.service
+systemctl is-failed will-fail.service || exit 1
+systemctl is-failed will-fail2.service || exit 1
+systemctl is-failed will-not-fail.service && exit 1
+systemctl is-failed will-not-fail2.service && exit 1
+
+touch /testok
+exit 0
diff --git a/test/TEST-04-SECCOMP/test.sh b/test/TEST-04-SECCOMP/test.sh
new file mode 100755
index 0000000000..a85b50cca2
--- /dev/null
+++ b/test/TEST-04-SECCOMP/test.sh
@@ -0,0 +1,79 @@
+#!/bin/bash
+# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
+# ex: ts=8 sw=4 sts=4 et filetype=sh
+TEST_DESCRIPTION="seccomp tests"
+
+. $TEST_BASE_DIR/test-functions
+
+check_result_qemu() {
+ ret=1
+ mkdir -p $TESTDIR/root
+ mount ${LOOPDEV}p1 $TESTDIR/root
+ [[ -e $TESTDIR/root/testok ]] && ret=0
+ [[ -f $TESTDIR/root/failed ]] && cp -a $TESTDIR/root/failed $TESTDIR
+ cp -a $TESTDIR/root/var/log/journal $TESTDIR
+ umount $TESTDIR/root
+ [[ -f $TESTDIR/failed ]] && cat $TESTDIR/failed
+ ls -l $TESTDIR/journal/*/*.journal
+ test -s $TESTDIR/failed && ret=$(($ret+1))
+ return $ret
+}
+
+test_run() {
+ if run_qemu; then
+ check_result_qemu || return 1
+ else
+ dwarn "can't run QEMU, skipping"
+ fi
+ if check_nspawn; then
+ run_nspawn
+ check_result_nspawn || return 1
+ else
+ dwarn "can't run systemd-nspawn, skipping"
+ fi
+ return 0
+}
+
+test_setup() {
+ create_empty_image
+ mkdir -p $TESTDIR/root
+ mount ${LOOPDEV}p1 $TESTDIR/root
+
+ # Create what will eventually be our root filesystem onto an overlay
+ (
+ LOG_LEVEL=5
+ eval $(udevadm info --export --query=env --name=${LOOPDEV}p2)
+
+ setup_basic_environment
+
+ # setup the testsuite service
+ cat >$initdir/etc/systemd/system/testsuite.service <<EOF
+[Unit]
+Description=Testsuite service
+After=multi-user.target
+
+[Service]
+ExecStart=/test-seccomp.sh
+Type=oneshot
+EOF
+
+ # copy the units used by this test
+ cp {will-fail,will-fail2,will-not-fail,will-not-fail2}.service \
+ $initdir/etc/systemd/system
+ cp test-seccomp.sh $initdir/
+
+ setup_testsuite
+ )
+ setup_nspawn_root
+
+ ddebug "umount $TESTDIR/root"
+ umount $TESTDIR/root
+}
+
+test_cleanup() {
+ umount $TESTDIR/root 2>/dev/null
+ [[ $LOOPDEV ]] && losetup -d $LOOPDEV
+ return 0
+}
+
+do_test "$@"
diff --git a/test/TEST-04-SECCOMP/will-fail.service b/test/TEST-04-SECCOMP/will-fail.service
new file mode 100644
index 0000000000..c4e0be90f2
--- /dev/null
+++ b/test/TEST-04-SECCOMP/will-fail.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=Will fail
+
+[Service]
+ExecStart=/bin/echo "This should not be seen"
+SystemCallFilter=ioperm
+SystemCallFilter=~ioperm
+SystemCallFilter=ioperm
diff --git a/test/TEST-04-SECCOMP/will-fail2.service b/test/TEST-04-SECCOMP/will-fail2.service
new file mode 100644
index 0000000000..f7f1ae9077
--- /dev/null
+++ b/test/TEST-04-SECCOMP/will-fail2.service
@@ -0,0 +1,6 @@
+[Unit]
+Description=Will fail 2
+
+[Service]
+ExecStart=/bin/echo "This should not be seen"
+SystemCallFilter=~write open execve exit_group close mmap munmap fstat DONOTEXIST
diff --git a/test/TEST-04-SECCOMP/will-not-fail.service b/test/TEST-04-SECCOMP/will-not-fail.service
new file mode 100644
index 0000000000..5c1b59456e
--- /dev/null
+++ b/test/TEST-04-SECCOMP/will-not-fail.service
@@ -0,0 +1,9 @@
+[Unit]
+Description=Will not fail
+
+[Service]
+ExecStart=/bin/echo "Foo bar"
+SystemCallFilter=~read write open execve ioperm
+SystemCallFilter=ioctl
+SystemCallFilter=read write open execve
+SystemCallFilter=~ioperm
diff --git a/test/TEST-04-SECCOMP/will-not-fail2.service b/test/TEST-04-SECCOMP/will-not-fail2.service
new file mode 100644
index 0000000000..2df05e33e8
--- /dev/null
+++ b/test/TEST-04-SECCOMP/will-not-fail2.service
@@ -0,0 +1,6 @@
+[Unit]
+Description=Reset SystemCallFilter
+
+[Service]
+ExecStart=/bin/echo "Foo bar"
+SystemCallFilter=