1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3 #include <stdio.h>
4 #include <sys/types.h>
5 #include <sys/utsname.h>
6 #include <unistd.h>
7
8 #include "sd-id128.h"
9
10 #include "alloc-util.h"
11 #include "apparmor-util.h"
12 #include "architecture.h"
13 #include "audit-util.h"
14 #include "cgroup-util.h"
15 #include "condition.h"
16 #include "cpu-set-util.h"
17 #include "efi-loader.h"
18 #include "errno-util.h"
19 #include "hostname-util.h"
20 #include "id128-util.h"
21 #include "ima-util.h"
22 #include "limits-util.h"
23 #include "log.h"
24 #include "macro.h"
25 #include "nulstr-util.h"
26 #include "os-util.h"
27 #include "process-util.h"
28 #include "psi-util.h"
29 #include "selinux-util.h"
30 #include "set.h"
31 #include "smack-util.h"
32 #include "string-util.h"
33 #include "strv.h"
34 #include "tests.h"
35 #include "tomoyo-util.h"
36 #include "udev-util.h"
37 #include "uid-alloc-range.h"
38 #include "user-util.h"
39 #include "virt.h"
40
TEST(condition_test_path)41 TEST(condition_test_path) {
42 Condition *condition;
43
44 condition = condition_new(CONDITION_PATH_EXISTS, "/bin/sh", false, false);
45 assert_se(condition);
46 assert_se(condition_test(condition, environ));
47 condition_free(condition);
48
49 condition = condition_new(CONDITION_PATH_EXISTS, "/bin/s?", false, false);
50 assert_se(condition);
51 assert_se(condition_test(condition, environ) == 0);
52 condition_free(condition);
53
54 condition = condition_new(CONDITION_PATH_EXISTS_GLOB, "/bin/s?", false, false);
55 assert_se(condition);
56 assert_se(condition_test(condition, environ) > 0);
57 condition_free(condition);
58
59 condition = condition_new(CONDITION_PATH_EXISTS_GLOB, "/bin/s?", false, true);
60 assert_se(condition);
61 assert_se(condition_test(condition, environ) == 0);
62 condition_free(condition);
63
64 condition = condition_new(CONDITION_PATH_EXISTS, "/thiscertainlywontexist", false, false);
65 assert_se(condition);
66 assert_se(condition_test(condition, environ) == 0);
67 condition_free(condition);
68
69 condition = condition_new(CONDITION_PATH_EXISTS, "/thiscertainlywontexist", false, true);
70 assert_se(condition);
71 assert_se(condition_test(condition, environ) > 0);
72 condition_free(condition);
73
74 condition = condition_new(CONDITION_PATH_IS_DIRECTORY, "/bin", false, false);
75 assert_se(condition);
76 assert_se(condition_test(condition, environ) > 0);
77 condition_free(condition);
78
79 condition = condition_new(CONDITION_DIRECTORY_NOT_EMPTY, "/bin", false, false);
80 assert_se(condition);
81 assert_se(condition_test(condition, environ) > 0);
82 condition_free(condition);
83
84 condition = condition_new(CONDITION_FILE_NOT_EMPTY, "/bin/sh", false, false);
85 assert_se(condition);
86 assert_se(condition_test(condition, environ) > 0);
87 condition_free(condition);
88
89 condition = condition_new(CONDITION_FILE_IS_EXECUTABLE, "/bin/sh", false, false);
90 assert_se(condition);
91 assert_se(condition_test(condition, environ) > 0);
92 condition_free(condition);
93
94 condition = condition_new(CONDITION_FILE_IS_EXECUTABLE, "/etc/passwd", false, false);
95 assert_se(condition);
96 assert_se(condition_test(condition, environ) == 0);
97 condition_free(condition);
98
99 condition = condition_new(CONDITION_PATH_IS_MOUNT_POINT, "/proc", false, false);
100 assert_se(condition);
101 assert_se(condition_test(condition, environ) > 0);
102 condition_free(condition);
103
104 condition = condition_new(CONDITION_PATH_IS_MOUNT_POINT, "/", false, false);
105 assert_se(condition);
106 assert_se(condition_test(condition, environ) > 0);
107 condition_free(condition);
108
109 condition = condition_new(CONDITION_PATH_IS_MOUNT_POINT, "/bin", false, false);
110 assert_se(condition);
111 assert_se(condition_test(condition, environ) == 0);
112 condition_free(condition);
113
114 condition = condition_new(CONDITION_PATH_IS_READ_WRITE, "/tmp", false, false);
115 assert_se(condition);
116 assert_se(condition_test(condition, environ) > 0);
117 condition_free(condition);
118
119 condition = condition_new(CONDITION_PATH_IS_ENCRYPTED, "/sys", false, false);
120 assert_se(condition);
121 assert_se(condition_test(condition, environ) == 0);
122 condition_free(condition);
123
124 condition = condition_new(CONDITION_PATH_IS_SYMBOLIC_LINK, "/dev/stdout", false, false);
125 assert_se(condition);
126 assert_se(condition_test(condition, environ) > 0);
127 condition_free(condition);
128 }
129
TEST(condition_test_control_group_hierarchy)130 TEST(condition_test_control_group_hierarchy) {
131 Condition *condition;
132 int r;
133
134 r = cg_unified();
135 if (r == -ENOMEDIUM) {
136 log_tests_skipped("cgroup not mounted");
137 return;
138 }
139 assert_se(r >= 0);
140
141 condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, "v1", false, false);
142 assert_se(condition);
143 assert_se(condition_test(condition, environ) == (r < CGROUP_UNIFIED_ALL));
144 condition_free(condition);
145
146 condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, "v2", false, false);
147 assert_se(condition);
148 assert_se(condition_test(condition, environ) == (r >= CGROUP_UNIFIED_ALL));
149 condition_free(condition);
150 }
151
TEST(condition_test_control_group_controller)152 TEST(condition_test_control_group_controller) {
153 Condition *condition;
154 CGroupMask system_mask;
155 _cleanup_free_ char *controller_name = NULL;
156 int r;
157
158 r = cg_unified();
159 if (r == -ENOMEDIUM) {
160 log_tests_skipped("cgroup not mounted");
161 return;
162 }
163 assert_se(r >= 0);
164
165 /* Invalid controllers are ignored */
166 condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, "thisisnotarealcontroller", false, false);
167 assert_se(condition);
168 assert_se(condition_test(condition, environ) > 0);
169 condition_free(condition);
170
171 condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, "thisisnotarealcontroller", false, true);
172 assert_se(condition);
173 assert_se(condition_test(condition, environ) == 0);
174 condition_free(condition);
175
176 assert_se(cg_mask_supported(&system_mask) >= 0);
177
178 /* Individual valid controllers one by one */
179 for (CGroupController controller = 0; controller < _CGROUP_CONTROLLER_MAX; controller++) {
180 const char *local_controller_name = cgroup_controller_to_string(controller);
181 log_info("chosen controller is '%s'", local_controller_name);
182 if (system_mask & CGROUP_CONTROLLER_TO_MASK(controller)) {
183 log_info("this controller is available");
184 condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, false);
185 assert_se(condition);
186 assert_se(condition_test(condition, environ) > 0);
187 condition_free(condition);
188
189 condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, true);
190 assert_se(condition);
191 assert_se(condition_test(condition, environ) == 0);
192 condition_free(condition);
193 } else {
194 log_info("this controller is unavailable");
195 condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, false);
196 assert_se(condition);
197 assert_se(condition_test(condition, environ) == 0);
198 condition_free(condition);
199
200 condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, local_controller_name, false, true);
201 assert_se(condition);
202 assert_se(condition_test(condition, environ) > 0);
203 condition_free(condition);
204 }
205 }
206
207 /* Multiple valid controllers at the same time */
208 assert_se(cg_mask_to_string(system_mask, &controller_name) >= 0);
209
210 condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, strempty(controller_name), false, false);
211 assert_se(condition);
212 assert_se(condition_test(condition, environ) > 0);
213 condition_free(condition);
214
215 condition = condition_new(CONDITION_CONTROL_GROUP_CONTROLLER, strempty(controller_name), false, true);
216 assert_se(condition);
217 assert_se(condition_test(condition, environ) == 0);
218 condition_free(condition);
219 }
220
TEST(condition_test_ac_power)221 TEST(condition_test_ac_power) {
222 Condition *condition;
223
224 condition = condition_new(CONDITION_AC_POWER, "true", false, false);
225 assert_se(condition);
226 assert_se(condition_test(condition, environ) == on_ac_power());
227 condition_free(condition);
228
229 condition = condition_new(CONDITION_AC_POWER, "false", false, false);
230 assert_se(condition);
231 assert_se(condition_test(condition, environ) != on_ac_power());
232 condition_free(condition);
233
234 condition = condition_new(CONDITION_AC_POWER, "false", false, true);
235 assert_se(condition);
236 assert_se(condition_test(condition, environ) == on_ac_power());
237 condition_free(condition);
238 }
239
TEST(condition_test_host)240 TEST(condition_test_host) {
241 _cleanup_free_ char *hostname = NULL;
242 Condition *condition;
243 sd_id128_t id;
244
245 assert_se(sd_id128_get_machine(&id) >= 0);
246
247 condition = condition_new(CONDITION_HOST, SD_ID128_TO_STRING(id), false, false);
248 assert_se(condition);
249 assert_se(condition_test(condition, environ) > 0);
250 condition_free(condition);
251
252 condition = condition_new(CONDITION_HOST, "garbage value jjjjjjjjjjjjjj", false, false);
253 assert_se(condition);
254 assert_se(condition_test(condition, environ) == 0);
255 condition_free(condition);
256
257 condition = condition_new(CONDITION_HOST, SD_ID128_TO_STRING(id), false, true);
258 assert_se(condition);
259 assert_se(condition_test(condition, environ) == 0);
260 condition_free(condition);
261
262 hostname = gethostname_malloc();
263 assert_se(hostname);
264
265 /* if hostname looks like an id128 then skip testing it */
266 if (id128_is_valid(hostname))
267 log_notice("hostname is an id128, skipping test");
268 else {
269 condition = condition_new(CONDITION_HOST, hostname, false, false);
270 assert_se(condition);
271 assert_se(condition_test(condition, environ) > 0);
272 condition_free(condition);
273 }
274 }
275
TEST(condition_test_architecture)276 TEST(condition_test_architecture) {
277 Condition *condition;
278 const char *sa;
279 Architecture a;
280
281 a = uname_architecture();
282 assert_se(a >= 0);
283
284 sa = architecture_to_string(a);
285 assert_se(sa);
286
287 condition = condition_new(CONDITION_ARCHITECTURE, sa, false, false);
288 assert_se(condition);
289 assert_se(condition_test(condition, environ) > 0);
290 condition_free(condition);
291
292 condition = condition_new(CONDITION_ARCHITECTURE, "garbage value", false, false);
293 assert_se(condition);
294 assert_se(condition_test(condition, environ) == 0);
295 condition_free(condition);
296
297 condition = condition_new(CONDITION_ARCHITECTURE, sa, false, true);
298 assert_se(condition);
299 assert_se(condition_test(condition, environ) == 0);
300 condition_free(condition);
301 }
302
TEST(condition_test_kernel_command_line)303 TEST(condition_test_kernel_command_line) {
304 Condition *condition;
305 int r;
306
307 condition = condition_new(CONDITION_KERNEL_COMMAND_LINE, "thisreallyshouldntbeonthekernelcommandline", false, false);
308 assert_se(condition);
309 r = condition_test(condition, environ);
310 if (ERRNO_IS_PRIVILEGE(r))
311 return;
312 assert_se(r == 0);
313 condition_free(condition);
314
315 condition = condition_new(CONDITION_KERNEL_COMMAND_LINE, "andthis=neither", false, false);
316 assert_se(condition);
317 assert_se(condition_test(condition, environ) == 0);
318 condition_free(condition);
319 }
320
TEST(condition_test_kernel_version)321 TEST(condition_test_kernel_version) {
322 Condition *condition;
323 struct utsname u;
324 const char *v;
325
326 condition = condition_new(CONDITION_KERNEL_VERSION, "*thisreallyshouldntbeinthekernelversion*", false, false);
327 assert_se(condition);
328 assert_se(condition_test(condition, environ) == 0);
329 condition_free(condition);
330
331 condition = condition_new(CONDITION_KERNEL_VERSION, "*", false, false);
332 assert_se(condition);
333 assert_se(condition_test(condition, environ) > 0);
334 condition_free(condition);
335
336 /* An artificially empty condition. It evaluates to true, but normally
337 * such condition cannot be created, because the condition list is reset instead. */
338 condition = condition_new(CONDITION_KERNEL_VERSION, "", false, false);
339 assert_se(condition);
340 assert_se(condition_test(condition, environ) > 0);
341 condition_free(condition);
342
343 assert_se(uname(&u) >= 0);
344
345 condition = condition_new(CONDITION_KERNEL_VERSION, u.release, false, false);
346 assert_se(condition);
347 assert_se(condition_test(condition, environ) > 0);
348 condition_free(condition);
349
350 strshorten(u.release, 4);
351 strcpy(strchr(u.release, 0), "*");
352
353 condition = condition_new(CONDITION_KERNEL_VERSION, u.release, false, false);
354 assert_se(condition);
355 assert_se(condition_test(condition, environ) > 0);
356 condition_free(condition);
357
358 /* 0.1.2 would be a very very very old kernel */
359 condition = condition_new(CONDITION_KERNEL_VERSION, "> 0.1.2", false, false);
360 assert_se(condition);
361 assert_se(condition_test(condition, environ) > 0);
362 condition_free(condition);
363
364 condition = condition_new(CONDITION_KERNEL_VERSION, ">0.1.2", false, false);
365 assert_se(condition);
366 assert_se(condition_test(condition, environ) > 0);
367 condition_free(condition);
368
369 condition = condition_new(CONDITION_KERNEL_VERSION, "'>0.1.2' '<9.0.0'", false, false);
370 assert_se(condition);
371 assert_se(condition_test(condition, environ) > 0);
372 condition_free(condition);
373
374 condition = condition_new(CONDITION_KERNEL_VERSION, "> 0.1.2 < 9.0.0", false, false);
375 assert_se(condition);
376 assert_se(condition_test(condition, environ) == -EINVAL);
377 condition_free(condition);
378
379 condition = condition_new(CONDITION_KERNEL_VERSION, ">", false, false);
380 assert_se(condition);
381 assert_se(condition_test(condition, environ) == -EINVAL);
382 condition_free(condition);
383
384 condition = condition_new(CONDITION_KERNEL_VERSION, ">= 0.1.2", false, false);
385 assert_se(condition);
386 assert_se(condition_test(condition, environ) > 0);
387 condition_free(condition);
388
389 condition = condition_new(CONDITION_KERNEL_VERSION, "< 0.1.2", false, false);
390 assert_se(condition);
391 assert_se(condition_test(condition, environ) == 0);
392 condition_free(condition);
393
394 condition = condition_new(CONDITION_KERNEL_VERSION, "<= 0.1.2", false, false);
395 assert_se(condition);
396 assert_se(condition_test(condition, environ) == 0);
397 condition_free(condition);
398
399 condition = condition_new(CONDITION_KERNEL_VERSION, "= 0.1.2", false, false);
400 assert_se(condition);
401 assert_se(condition_test(condition, environ) == 0);
402 condition_free(condition);
403
404 /* 4711.8.15 is a very very very future kernel */
405 condition = condition_new(CONDITION_KERNEL_VERSION, "< 4711.8.15", false, false);
406 assert_se(condition);
407 assert_se(condition_test(condition, environ) > 0);
408 condition_free(condition);
409
410 condition = condition_new(CONDITION_KERNEL_VERSION, "<= 4711.8.15", false, false);
411 assert_se(condition);
412 assert_se(condition_test(condition, environ) > 0);
413 condition_free(condition);
414
415 condition = condition_new(CONDITION_KERNEL_VERSION, "= 4711.8.15", false, false);
416 assert_se(condition);
417 assert_se(condition_test(condition, environ) == 0);
418 condition_free(condition);
419
420 condition = condition_new(CONDITION_KERNEL_VERSION, "> 4711.8.15", false, false);
421 assert_se(condition);
422 assert_se(condition_test(condition, environ) == 0);
423 condition_free(condition);
424
425 condition = condition_new(CONDITION_KERNEL_VERSION, ">= 4711.8.15", false, false);
426 assert_se(condition);
427 assert_se(condition_test(condition, environ) == 0);
428 condition_free(condition);
429
430 assert_se(uname(&u) >= 0);
431
432 v = strjoina(">=", u.release);
433 condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
434 assert_se(condition);
435 assert_se(condition_test(condition, environ) > 0);
436 condition_free(condition);
437
438 v = strjoina("= ", u.release);
439 condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
440 assert_se(condition);
441 assert_se(condition_test(condition, environ) > 0);
442 condition_free(condition);
443
444 v = strjoina("<=", u.release);
445 condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
446 assert_se(condition);
447 assert_se(condition_test(condition, environ) > 0);
448 condition_free(condition);
449
450 v = strjoina("> ", u.release);
451 condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
452 assert_se(condition);
453 assert_se(condition_test(condition, environ) == 0);
454 condition_free(condition);
455
456 v = strjoina("< ", u.release);
457 condition = condition_new(CONDITION_KERNEL_VERSION, v, false, false);
458 assert_se(condition);
459 assert_se(condition_test(condition, environ) == 0);
460 condition_free(condition);
461 }
462
463 #if defined(__i386__) || defined(__x86_64__)
TEST(condition_test_cpufeature)464 TEST(condition_test_cpufeature) {
465 Condition *condition;
466
467 condition = condition_new(CONDITION_CPU_FEATURE, "fpu", false, false);
468 assert_se(condition);
469 assert_se(condition_test(condition, environ) > 0);
470 condition_free(condition);
471
472 condition = condition_new(CONDITION_CPU_FEATURE, "somecpufeaturethatreallydoesntmakesense", false, false);
473 assert_se(condition);
474 assert_se(condition_test(condition, environ) == 0);
475 condition_free(condition);
476
477 condition = condition_new(CONDITION_CPU_FEATURE, "a", false, false);
478 assert_se(condition);
479 assert_se(condition_test(condition, environ) == 0);
480 condition_free(condition);
481 }
482 #endif
483
TEST(condition_test_security)484 TEST(condition_test_security) {
485 Condition *condition;
486
487 condition = condition_new(CONDITION_SECURITY, "garbage oifdsjfoidsjoj", false, false);
488 assert_se(condition);
489 assert_se(condition_test(condition, environ) == 0);
490 condition_free(condition);
491
492 condition = condition_new(CONDITION_SECURITY, "selinux", false, true);
493 assert_se(condition);
494 assert_se(condition_test(condition, environ) != mac_selinux_use());
495 condition_free(condition);
496
497 condition = condition_new(CONDITION_SECURITY, "apparmor", false, false);
498 assert_se(condition);
499 assert_se(condition_test(condition, environ) == mac_apparmor_use());
500 condition_free(condition);
501
502 condition = condition_new(CONDITION_SECURITY, "tomoyo", false, false);
503 assert_se(condition);
504 assert_se(condition_test(condition, environ) == mac_tomoyo_use());
505 condition_free(condition);
506
507 condition = condition_new(CONDITION_SECURITY, "ima", false, false);
508 assert_se(condition);
509 assert_se(condition_test(condition, environ) == use_ima());
510 condition_free(condition);
511
512 condition = condition_new(CONDITION_SECURITY, "smack", false, false);
513 assert_se(condition);
514 assert_se(condition_test(condition, environ) == mac_smack_use());
515 condition_free(condition);
516
517 condition = condition_new(CONDITION_SECURITY, "audit", false, false);
518 assert_se(condition);
519 assert_se(condition_test(condition, environ) == use_audit());
520 condition_free(condition);
521
522 condition = condition_new(CONDITION_SECURITY, "uefi-secureboot", false, false);
523 assert_se(condition);
524 assert_se(condition_test(condition, environ) == is_efi_secure_boot());
525 condition_free(condition);
526 }
527
TEST(print_securities)528 TEST(print_securities) {
529 log_info("------ enabled security technologies ------");
530 log_info("SELinux: %s", yes_no(mac_selinux_use()));
531 log_info("AppArmor: %s", yes_no(mac_apparmor_use()));
532 log_info("Tomoyo: %s", yes_no(mac_tomoyo_use()));
533 log_info("IMA: %s", yes_no(use_ima()));
534 log_info("SMACK: %s", yes_no(mac_smack_use()));
535 log_info("Audit: %s", yes_no(use_audit()));
536 log_info("UEFI secure boot: %s", yes_no(is_efi_secure_boot()));
537 log_info("-------------------------------------------");
538 }
539
TEST(condition_test_virtualization)540 TEST(condition_test_virtualization) {
541 Condition *condition;
542 const char *virt;
543 int r;
544
545 condition = condition_new(CONDITION_VIRTUALIZATION, "garbage oifdsjfoidsjoj", false, false);
546 assert_se(condition);
547 r = condition_test(condition, environ);
548 if (ERRNO_IS_PRIVILEGE(r))
549 return;
550 log_info("ConditionVirtualization=garbage → %i", r);
551 assert_se(r == 0);
552 condition_free(condition);
553
554 condition = condition_new(CONDITION_VIRTUALIZATION, "container", false, false);
555 assert_se(condition);
556 r = condition_test(condition, environ);
557 log_info("ConditionVirtualization=container → %i", r);
558 assert_se(r == !!detect_container());
559 condition_free(condition);
560
561 condition = condition_new(CONDITION_VIRTUALIZATION, "vm", false, false);
562 assert_se(condition);
563 r = condition_test(condition, environ);
564 log_info("ConditionVirtualization=vm → %i", r);
565 assert_se(r == (detect_vm() && !detect_container()));
566 condition_free(condition);
567
568 condition = condition_new(CONDITION_VIRTUALIZATION, "private-users", false, false);
569 assert_se(condition);
570 r = condition_test(condition, environ);
571 log_info("ConditionVirtualization=private-users → %i", r);
572 assert_se(r == !!running_in_userns());
573 condition_free(condition);
574
575 NULSTR_FOREACH(virt,
576 "kvm\0"
577 "amazon\0"
578 "qemu\0"
579 "bochs\0"
580 "xen\0"
581 "uml\0"
582 "vmware\0"
583 "oracle\0"
584 "microsoft\0"
585 "zvm\0"
586 "parallels\0"
587 "bhyve\0"
588 "vm_other\0") {
589
590 condition = condition_new(CONDITION_VIRTUALIZATION, virt, false, false);
591 assert_se(condition);
592 r = condition_test(condition, environ);
593 log_info("ConditionVirtualization=%s → %i", virt, r);
594 assert_se(r >= 0);
595 condition_free(condition);
596 }
597 }
598
TEST(condition_test_user)599 TEST(condition_test_user) {
600 Condition *condition;
601 char* uid;
602 char* username;
603 int r;
604
605 condition = condition_new(CONDITION_USER, "garbage oifdsjfoidsjoj", false, false);
606 assert_se(condition);
607 r = condition_test(condition, environ);
608 log_info("ConditionUser=garbage → %i", r);
609 assert_se(r == 0);
610 condition_free(condition);
611
612 assert_se(asprintf(&uid, "%"PRIu32, UINT32_C(0xFFFF)) > 0);
613 condition = condition_new(CONDITION_USER, uid, false, false);
614 assert_se(condition);
615 r = condition_test(condition, environ);
616 log_info("ConditionUser=%s → %i", uid, r);
617 assert_se(r == 0);
618 condition_free(condition);
619 free(uid);
620
621 assert_se(asprintf(&uid, "%u", (unsigned)getuid()) > 0);
622 condition = condition_new(CONDITION_USER, uid, false, false);
623 assert_se(condition);
624 r = condition_test(condition, environ);
625 log_info("ConditionUser=%s → %i", uid, r);
626 assert_se(r > 0);
627 condition_free(condition);
628 free(uid);
629
630 assert_se(asprintf(&uid, "%u", (unsigned)getuid()+1) > 0);
631 condition = condition_new(CONDITION_USER, uid, false, false);
632 assert_se(condition);
633 r = condition_test(condition, environ);
634 log_info("ConditionUser=%s → %i", uid, r);
635 assert_se(r == 0);
636 condition_free(condition);
637 free(uid);
638
639 username = getusername_malloc();
640 assert_se(username);
641 condition = condition_new(CONDITION_USER, username, false, false);
642 assert_se(condition);
643 r = condition_test(condition, environ);
644 log_info("ConditionUser=%s → %i", username, r);
645 assert_se(r > 0);
646 condition_free(condition);
647 free(username);
648
649 username = (char*)(geteuid() == 0 ? NOBODY_USER_NAME : "root");
650 condition = condition_new(CONDITION_USER, username, false, false);
651 assert_se(condition);
652 r = condition_test(condition, environ);
653 log_info("ConditionUser=%s → %i", username, r);
654 assert_se(r == 0);
655 condition_free(condition);
656
657 condition = condition_new(CONDITION_USER, "@system", false, false);
658 assert_se(condition);
659 r = condition_test(condition, environ);
660 log_info("ConditionUser=@system → %i", r);
661 if (uid_is_system(getuid()) || uid_is_system(geteuid()))
662 assert_se(r > 0);
663 else
664 assert_se(r == 0);
665 condition_free(condition);
666 }
667
TEST(condition_test_group)668 TEST(condition_test_group) {
669 Condition *condition;
670 char* gid;
671 char* groupname;
672 gid_t *gids, max_gid;
673 int ngroups_max, ngroups, r, i;
674
675 assert_se(0 < asprintf(&gid, "%u", UINT32_C(0xFFFF)));
676 condition = condition_new(CONDITION_GROUP, gid, false, false);
677 assert_se(condition);
678 r = condition_test(condition, environ);
679 log_info("ConditionGroup=%s → %i", gid, r);
680 assert_se(r == 0);
681 condition_free(condition);
682 free(gid);
683
684 assert_se(0 < asprintf(&gid, "%u", getgid()));
685 condition = condition_new(CONDITION_GROUP, gid, false, false);
686 assert_se(condition);
687 r = condition_test(condition, environ);
688 log_info("ConditionGroup=%s → %i", gid, r);
689 assert_se(r > 0);
690 condition_free(condition);
691 free(gid);
692
693 ngroups_max = sysconf(_SC_NGROUPS_MAX);
694 assert_se(ngroups_max > 0);
695
696 gids = newa(gid_t, ngroups_max);
697
698 ngroups = getgroups(ngroups_max, gids);
699 assert_se(ngroups >= 0);
700
701 max_gid = getgid();
702 for (i = 0; i < ngroups; i++) {
703 assert_se(0 < asprintf(&gid, "%u", gids[i]));
704 condition = condition_new(CONDITION_GROUP, gid, false, false);
705 assert_se(condition);
706 r = condition_test(condition, environ);
707 log_info("ConditionGroup=%s → %i", gid, r);
708 assert_se(r > 0);
709 condition_free(condition);
710 free(gid);
711 max_gid = gids[i] > max_gid ? gids[i] : max_gid;
712
713 groupname = gid_to_name(gids[i]);
714 assert_se(groupname);
715 condition = condition_new(CONDITION_GROUP, groupname, false, false);
716 assert_se(condition);
717 r = condition_test(condition, environ);
718 log_info("ConditionGroup=%s → %i", groupname, r);
719 assert_se(r > 0);
720 condition_free(condition);
721 free(groupname);
722 max_gid = gids[i] > max_gid ? gids[i] : max_gid;
723 }
724
725 assert_se(0 < asprintf(&gid, "%u", max_gid+1));
726 condition = condition_new(CONDITION_GROUP, gid, false, false);
727 assert_se(condition);
728 r = condition_test(condition, environ);
729 log_info("ConditionGroup=%s → %i", gid, r);
730 assert_se(r == 0);
731 condition_free(condition);
732 free(gid);
733
734 groupname = (char*)(getegid() == 0 ? NOBODY_GROUP_NAME : "root");
735 condition = condition_new(CONDITION_GROUP, groupname, false, false);
736 assert_se(condition);
737 r = condition_test(condition, environ);
738 log_info("ConditionGroup=%s → %i", groupname, r);
739 assert_se(r == 0);
740 condition_free(condition);
741 }
742
test_condition_test_cpus_one(const char * s,bool result)743 static void test_condition_test_cpus_one(const char *s, bool result) {
744 Condition *condition;
745 int r;
746
747 log_debug("%s=%s", condition_type_to_string(CONDITION_CPUS), s);
748
749 condition = condition_new(CONDITION_CPUS, s, false, false);
750 assert_se(condition);
751
752 r = condition_test(condition, environ);
753 assert_se(r >= 0);
754 assert_se(r == result);
755 condition_free(condition);
756 }
757
TEST(condition_test_cpus)758 TEST(condition_test_cpus) {
759 _cleanup_free_ char *t = NULL;
760 int cpus;
761
762 cpus = cpus_in_affinity_mask();
763 assert_se(cpus >= 0);
764
765 test_condition_test_cpus_one("> 0", true);
766 test_condition_test_cpus_one(">= 0", true);
767 test_condition_test_cpus_one("!= 0", true);
768 test_condition_test_cpus_one("<= 0", false);
769 test_condition_test_cpus_one("< 0", false);
770 test_condition_test_cpus_one("= 0", false);
771
772 test_condition_test_cpus_one("> 100000", false);
773 test_condition_test_cpus_one("= 100000", false);
774 test_condition_test_cpus_one(">= 100000", false);
775 test_condition_test_cpus_one("< 100000", true);
776 test_condition_test_cpus_one("!= 100000", true);
777 test_condition_test_cpus_one("<= 100000", true);
778
779 assert_se(asprintf(&t, "= %i", cpus) >= 0);
780 test_condition_test_cpus_one(t, true);
781 t = mfree(t);
782
783 assert_se(asprintf(&t, "<= %i", cpus) >= 0);
784 test_condition_test_cpus_one(t, true);
785 t = mfree(t);
786
787 assert_se(asprintf(&t, ">= %i", cpus) >= 0);
788 test_condition_test_cpus_one(t, true);
789 t = mfree(t);
790
791 assert_se(asprintf(&t, "!= %i", cpus) >= 0);
792 test_condition_test_cpus_one(t, false);
793 t = mfree(t);
794
795 assert_se(asprintf(&t, "< %i", cpus) >= 0);
796 test_condition_test_cpus_one(t, false);
797 t = mfree(t);
798
799 assert_se(asprintf(&t, "> %i", cpus) >= 0);
800 test_condition_test_cpus_one(t, false);
801 t = mfree(t);
802 }
803
test_condition_test_memory_one(const char * s,bool result)804 static void test_condition_test_memory_one(const char *s, bool result) {
805 Condition *condition;
806 int r;
807
808 log_debug("%s=%s", condition_type_to_string(CONDITION_MEMORY), s);
809
810 condition = condition_new(CONDITION_MEMORY, s, false, false);
811 assert_se(condition);
812
813 r = condition_test(condition, environ);
814 assert_se(r >= 0);
815 assert_se(r == result);
816 condition_free(condition);
817 }
818
TEST(condition_test_memory)819 TEST(condition_test_memory) {
820 _cleanup_free_ char *t = NULL;
821 uint64_t memory;
822
823 memory = physical_memory();
824
825 test_condition_test_memory_one("> 0", true);
826 test_condition_test_memory_one(">= 0", true);
827 test_condition_test_memory_one("!= 0", true);
828 test_condition_test_memory_one("<= 0", false);
829 test_condition_test_memory_one("< 0", false);
830 test_condition_test_memory_one("= 0", false);
831
832 test_condition_test_memory_one("> 18446744073709547520", false);
833 test_condition_test_memory_one("= 18446744073709547520", false);
834 test_condition_test_memory_one(">= 18446744073709547520", false);
835 test_condition_test_memory_one("< 18446744073709547520", true);
836 test_condition_test_memory_one("!= 18446744073709547520", true);
837 test_condition_test_memory_one("<= 18446744073709547520", true);
838
839 assert_se(asprintf(&t, "= %" PRIu64, memory) >= 0);
840 test_condition_test_memory_one(t, true);
841 t = mfree(t);
842
843 assert_se(asprintf(&t, "<= %" PRIu64, memory) >= 0);
844 test_condition_test_memory_one(t, true);
845 t = mfree(t);
846
847 assert_se(asprintf(&t, ">= %" PRIu64, memory) >= 0);
848 test_condition_test_memory_one(t, true);
849 t = mfree(t);
850
851 assert_se(asprintf(&t, "!= %" PRIu64, memory) >= 0);
852 test_condition_test_memory_one(t, false);
853 t = mfree(t);
854
855 assert_se(asprintf(&t, "< %" PRIu64, memory) >= 0);
856 test_condition_test_memory_one(t, false);
857 t = mfree(t);
858
859 assert_se(asprintf(&t, "> %" PRIu64, memory) >= 0);
860 test_condition_test_memory_one(t, false);
861 t = mfree(t);
862 }
863
test_condition_test_environment_one(const char * s,bool result)864 static void test_condition_test_environment_one(const char *s, bool result) {
865 Condition *condition;
866 int r;
867
868 log_debug("%s=%s", condition_type_to_string(CONDITION_ENVIRONMENT), s);
869
870 condition = condition_new(CONDITION_ENVIRONMENT, s, false, false);
871 assert_se(condition);
872
873 r = condition_test(condition, environ);
874 assert_se(r >= 0);
875 assert_se(r == result);
876 condition_free(condition);
877 }
878
TEST(condition_test_environment)879 TEST(condition_test_environment) {
880 assert_se(setenv("EXISTINGENVVAR", "foo", false) >= 0);
881
882 test_condition_test_environment_one("MISSINGENVVAR", false);
883 test_condition_test_environment_one("MISSINGENVVAR=foo", false);
884 test_condition_test_environment_one("MISSINGENVVAR=", false);
885
886 test_condition_test_environment_one("EXISTINGENVVAR", true);
887 test_condition_test_environment_one("EXISTINGENVVAR=foo", true);
888 test_condition_test_environment_one("EXISTINGENVVAR=bar", false);
889 test_condition_test_environment_one("EXISTINGENVVAR=", false);
890 }
891
TEST(condition_test_os_release)892 TEST(condition_test_os_release) {
893 _cleanup_strv_free_ char **os_release_pairs = NULL;
894 _cleanup_free_ char *version_id = NULL;
895 const char *key_value_pair;
896 Condition *condition;
897
898 /* Should not happen, but it's a test so we don't know the environment. */
899 if (load_os_release_pairs(NULL, &os_release_pairs) < 0)
900 return;
901 if (strv_length(os_release_pairs) < 2)
902 return;
903
904 condition = condition_new(CONDITION_OS_RELEASE, "_THISHOPEFULLYWONTEXIST=01234 56789", false, false);
905 assert_se(condition);
906 assert_se(condition_test(condition, environ) == 0);
907 condition_free(condition);
908
909 condition = condition_new(CONDITION_OS_RELEASE, "WRONG FORMAT", false, false);
910 assert_se(condition);
911 assert_se(condition_test(condition, environ) == -EINVAL);
912 condition_free(condition);
913
914 condition = condition_new(CONDITION_OS_RELEASE, "WRONG!<>=FORMAT", false, false);
915 assert_se(condition);
916 assert_se(condition_test(condition, environ) == -EINVAL);
917 condition_free(condition);
918
919 condition = condition_new(CONDITION_OS_RELEASE, "WRONG FORMAT=", false, false);
920 assert_se(condition);
921 assert_se(condition_test(condition, environ) == -EINVAL);
922 condition_free(condition);
923
924 condition = condition_new(CONDITION_OS_RELEASE, "WRONG =FORMAT", false, false);
925 assert_se(condition);
926 assert_se(condition_test(condition, environ) == -EINVAL);
927 condition_free(condition);
928
929 condition = condition_new(CONDITION_OS_RELEASE, "WRONG = FORMAT", false, false);
930 assert_se(condition);
931 assert_se(condition_test(condition, environ) == -EINVAL);
932 condition_free(condition);
933
934 condition = condition_new(CONDITION_OS_RELEASE, "WRONGFORMAT= ", false, false);
935 assert_se(condition);
936 assert_se(condition_test(condition, environ) == -EINVAL);
937 condition_free(condition);
938
939 condition = condition_new(CONDITION_OS_RELEASE, "WRO NG=FORMAT", false, false);
940 assert_se(condition);
941 assert_se(condition_test(condition, environ) == -EINVAL);
942 condition_free(condition);
943
944 condition = condition_new(CONDITION_OS_RELEASE, "", false, false);
945 assert_se(condition);
946 assert_se(condition_test(condition, environ));
947 condition_free(condition);
948
949 /* load_os_release_pairs() removes quotes, we have to add them back,
950 * otherwise we get a string: "PRETTY_NAME=Debian GNU/Linux 10 (buster)"
951 * which is wrong, as the value is not quoted anymore. */
952 const char *quote = strchr(os_release_pairs[1], ' ') ? "\"" : "";
953 key_value_pair = strjoina(os_release_pairs[0], "=", quote, os_release_pairs[1], quote);
954 condition = condition_new(CONDITION_OS_RELEASE, key_value_pair, false, false);
955 assert_se(condition);
956 assert_se(condition_test(condition, environ));
957 condition_free(condition);
958
959 key_value_pair = strjoina(os_release_pairs[0], "!=", quote, os_release_pairs[1], quote);
960 condition = condition_new(CONDITION_OS_RELEASE, key_value_pair, false, false);
961 assert_se(condition);
962 assert_se(condition_test(condition, environ) == 0);
963 condition_free(condition);
964
965 /* Some distros (eg: Arch) do not set VERSION_ID */
966 if (parse_os_release(NULL, "VERSION_ID", &version_id) <= 0)
967 return;
968
969 key_value_pair = strjoina("VERSION_ID", "=", version_id);
970 condition = condition_new(CONDITION_OS_RELEASE, key_value_pair, false, false);
971 assert_se(condition);
972 assert_se(condition_test(condition, environ));
973 condition_free(condition);
974
975 key_value_pair = strjoina("VERSION_ID", "!=", version_id);
976 condition = condition_new(CONDITION_OS_RELEASE, key_value_pair, false, false);
977 assert_se(condition);
978 assert_se(condition_test(condition, environ) == 0);
979 condition_free(condition);
980
981 key_value_pair = strjoina("VERSION_ID", "<=", version_id);
982 condition = condition_new(CONDITION_OS_RELEASE, key_value_pair, false, false);
983 assert_se(condition);
984 assert_se(condition_test(condition, environ));
985 condition_free(condition);
986
987 key_value_pair = strjoina("VERSION_ID", ">=", version_id);
988 condition = condition_new(CONDITION_OS_RELEASE, key_value_pair, false, false);
989 assert_se(condition);
990 assert_se(condition_test(condition, environ));
991 condition_free(condition);
992
993 key_value_pair = strjoina("VERSION_ID", "<", version_id, ".1");
994 condition = condition_new(CONDITION_OS_RELEASE, key_value_pair, false, false);
995 assert_se(condition);
996 assert_se(condition_test(condition, environ));
997 condition_free(condition);
998
999 key_value_pair = strjoina("VERSION_ID", ">", version_id, ".1");
1000 condition = condition_new(CONDITION_OS_RELEASE, key_value_pair, false, false);
1001 assert_se(condition);
1002 assert_se(condition_test(condition, environ) == 0);
1003 condition_free(condition);
1004
1005 key_value_pair = strjoina("VERSION_ID", "=", version_id, " ", os_release_pairs[0], "=", quote, os_release_pairs[1], quote);
1006 condition = condition_new(CONDITION_OS_RELEASE, key_value_pair, false, false);
1007 assert_se(condition);
1008 assert_se(condition_test(condition, environ));
1009 condition_free(condition);
1010
1011 key_value_pair = strjoina("VERSION_ID", "!=", version_id, " ", os_release_pairs[0], "=", quote, os_release_pairs[1], quote);
1012 condition = condition_new(CONDITION_OS_RELEASE, key_value_pair, false, false);
1013 assert_se(condition);
1014 assert_se(condition_test(condition, environ) == 0);
1015 condition_free(condition);
1016
1017 key_value_pair = strjoina("VERSION_ID", "=", version_id, " ", os_release_pairs[0], "!=", quote, os_release_pairs[1], quote);
1018 condition = condition_new(CONDITION_OS_RELEASE, key_value_pair, false, false);
1019 assert_se(condition);
1020 assert_se(condition_test(condition, environ) == 0);
1021 condition_free(condition);
1022
1023 key_value_pair = strjoina("VERSION_ID", "!=", version_id, " ", os_release_pairs[0], "!=", quote, os_release_pairs[1], quote);
1024 condition = condition_new(CONDITION_OS_RELEASE, key_value_pair, false, false);
1025 assert_se(condition);
1026 assert_se(condition_test(condition, environ) == 0);
1027 condition_free(condition);
1028
1029 key_value_pair = strjoina("VERSION_ID", "<", version_id, ".1", " ", os_release_pairs[0], "=", quote, os_release_pairs[1], quote);
1030 condition = condition_new(CONDITION_OS_RELEASE, key_value_pair, false, false);
1031 assert_se(condition);
1032 assert_se(condition_test(condition, environ));
1033 condition_free(condition);
1034 }
1035
TEST(condition_test_psi)1036 TEST(condition_test_psi) {
1037 Condition *condition;
1038 CGroupMask mask;
1039 int r;
1040
1041 if (!is_pressure_supported())
1042 return (void) log_notice("Pressure Stall Information (PSI) is not supported, skipping %s", __func__);
1043
1044 condition = condition_new(CONDITION_MEMORY_PRESSURE, "", false, false);
1045 assert_se(condition);
1046 assert_se(condition_test(condition, environ) < 0);
1047 condition_free(condition);
1048
1049 condition = condition_new(CONDITION_CPU_PRESSURE, "sbarabau", false, false);
1050 assert_se(condition);
1051 assert_se(condition_test(condition, environ) < 0);
1052 condition_free(condition);
1053
1054 condition = condition_new(CONDITION_MEMORY_PRESSURE, "10%sbarabau", false, false);
1055 assert_se(condition);
1056 assert_se(condition_test(condition, environ) < 0);
1057 condition_free(condition);
1058
1059 condition = condition_new(CONDITION_CPU_PRESSURE, "10% sbarabau", false, false);
1060 assert_se(condition);
1061 assert_se(condition_test(condition, environ) < 0);
1062 condition_free(condition);
1063
1064 condition = condition_new(CONDITION_CPU_PRESSURE, "-10", false, false);
1065 assert_se(condition);
1066 assert_se(condition_test(condition, environ) < 0);
1067 condition_free(condition);
1068
1069 condition = condition_new(CONDITION_CPU_PRESSURE, "10%/10min", false, false);
1070 assert_se(condition);
1071 assert_se(condition_test(condition, environ) < 0);
1072 condition_free(condition);
1073
1074 condition = condition_new(CONDITION_CPU_PRESSURE, "10min/10%", false, false);
1075 assert_se(condition);
1076 assert_se(condition_test(condition, environ) < 0);
1077 condition_free(condition);
1078
1079 condition = condition_new(CONDITION_CPU_PRESSURE, "10% 5min", false, false);
1080 assert_se(condition);
1081 assert_se(condition_test(condition, environ) < 0);
1082 condition_free(condition);
1083
1084 condition = condition_new(CONDITION_CPU_PRESSURE, "/5min", false, false);
1085 assert_se(condition);
1086 assert_se(condition_test(condition, environ) < 0);
1087 condition_free(condition);
1088
1089 condition = condition_new(CONDITION_IO_PRESSURE, "10s / ", false, false);
1090 assert_se(condition);
1091 assert_se(condition_test(condition, environ) < 0);
1092 condition_free(condition);
1093
1094 condition = condition_new(CONDITION_MEMORY_PRESSURE, "100%", false, false);
1095 assert_se(condition);
1096 assert_se(condition_test(condition, environ) >= 0);
1097 condition_free(condition);
1098
1099 condition = condition_new(CONDITION_MEMORY_PRESSURE, "0%", false, false);
1100 assert_se(condition);
1101 assert_se(condition_test(condition, environ) >= 0);
1102 condition_free(condition);
1103
1104 condition = condition_new(CONDITION_MEMORY_PRESSURE, "0.0%", false, false);
1105 assert_se(condition);
1106 assert_se(condition_test(condition, environ) >= 0);
1107 condition_free(condition);
1108
1109 condition = condition_new(CONDITION_CPU_PRESSURE, "100%", false, false);
1110 assert_se(condition);
1111 assert_se(condition_test(condition, environ) >= 0);
1112 condition_free(condition);
1113
1114 condition = condition_new(CONDITION_CPU_PRESSURE, "0%", false, false);
1115 assert_se(condition);
1116 assert_se(condition_test(condition, environ) >= 0);
1117 condition_free(condition);
1118
1119 condition = condition_new(CONDITION_CPU_PRESSURE, "0.0%", false, false);
1120 assert_se(condition);
1121 assert_se(condition_test(condition, environ) >= 0);
1122 condition_free(condition);
1123
1124 condition = condition_new(CONDITION_CPU_PRESSURE, "0.01%", false, false);
1125 assert_se(condition);
1126 assert_se(condition_test(condition, environ) >= 0);
1127 condition_free(condition);
1128
1129 condition = condition_new(CONDITION_CPU_PRESSURE, "0.0%/10sec", false, false);
1130 assert_se(condition);
1131 assert_se(condition_test(condition, environ) >= 0);
1132 condition_free(condition);
1133
1134 condition = condition_new(CONDITION_CPU_PRESSURE, "100.0% / 1min", false, false);
1135 assert_se(condition);
1136 assert_se(condition_test(condition, environ) >= 0);
1137 condition_free(condition);
1138
1139 condition = condition_new(CONDITION_IO_PRESSURE, "50.0% / 1min", false, false);
1140 assert_se(condition);
1141 assert_se(condition_test(condition, environ) >= 0);
1142 condition_free(condition);
1143
1144 r = cg_all_unified();
1145 if (r < 0)
1146 return (void) log_notice("Failed to determine whether the unified cgroups hierarchy is used, skipping %s", __func__);
1147 if (r == 0)
1148 return (void) log_notice("Requires the unified cgroups hierarchy, skipping %s", __func__);
1149
1150 if (cg_mask_supported(&mask) < 0)
1151 return (void) log_notice("Failed to get supported cgroup controllers, skipping %s", __func__);
1152
1153 if (!FLAGS_SET(mask, CGROUP_MASK_MEMORY))
1154 return (void) log_notice("Requires the cgroup memory controller, skipping %s", __func__);
1155
1156 if (!FLAGS_SET(mask, CGROUP_MASK_CPU))
1157 return (void) log_notice("Requires the cgroup CPU controller, skipping %s", __func__);
1158
1159 condition = condition_new(CONDITION_MEMORY_PRESSURE, " : / ", false, false);
1160 assert_se(condition);
1161 assert_se(condition_test(condition, environ) < 0);
1162 condition_free(condition);
1163
1164 condition = condition_new(CONDITION_CPU_PRESSURE, "hopefullythisisnotarealone.slice:100% / 10sec", false, false);
1165 assert_se(condition);
1166 assert_se(condition_test(condition, environ) > 0);
1167 condition_free(condition);
1168
1169 condition = condition_new(CONDITION_CPU_PRESSURE, "-.slice:100.0% / 1min", false, false);
1170 assert_se(condition);
1171 assert_se(condition_test(condition, environ) >= 0);
1172 condition_free(condition);
1173
1174 condition = condition_new(CONDITION_MEMORY_PRESSURE, "-.slice:0.0%/5min", false, false);
1175 assert_se(condition);
1176 assert_se(condition_test(condition, environ) >= 0);
1177 condition_free(condition);
1178
1179 condition = condition_new(CONDITION_MEMORY_PRESSURE, "-.slice:100.0%", false, false);
1180 assert_se(condition);
1181 assert_se(condition_test(condition, environ) >= 0);
1182 condition_free(condition);
1183
1184 condition = condition_new(CONDITION_IO_PRESSURE, "-.slice:0.0%", false, false);
1185 assert_se(condition);
1186 assert_se(condition_test(condition, environ) >= 0);
1187 condition_free(condition);
1188 }
1189
1190 DEFINE_TEST_MAIN(LOG_DEBUG);
1191