From 6e0ed2865e344e18765c6a3d69c4646015f2a143 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Fri, 3 Jan 2020 18:25:51 +0100
Subject: test: hardcode shell to use

let's make sure we always invoke our commands through /bin/sh, since
on some distros su will use /bin/nologin (or whatever is listed in
/etc/passwd) as shell otherwise and we don#t want that.
---
 test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'test')

diff --git a/test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh b/test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh
index cd61dc95c9..158889888e 100755
--- a/test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh
+++ b/test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh
@@ -7,7 +7,7 @@ systemd-analyze log-level debug
 runas() {
     declare userid=$1
     shift
-    su "$userid" -c 'XDG_RUNTIME_DIR=/run/user/$UID "$@"' -- sh "$@"
+    su "$userid" -s /bin/sh -c 'XDG_RUNTIME_DIR=/run/user/$UID exec "$@"' -- sh "$@"
 }
 
 runas nobody systemctl --user --wait is-system-running
-- 
cgit v1.2.1


From e9786a5c016477c37905e4a5538f753643c672fd Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Fri, 3 Jan 2020 18:27:14 +0100
Subject: test: don't rely on "nobody" user for TEST-43

The name is not as universal as we want, still, hence let's use our own
user we create with sysusers.d/. That should yield same behaviour
everywhere (and also test sysusers a bit as side effect).
---
 test/TEST-43-PRIVATEUSER-UNPRIV/test.sh      | 17 +++++++++-------
 test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh | 30 ++++++++++++++--------------
 2 files changed, 25 insertions(+), 22 deletions(-)

(limited to 'test')

diff --git a/test/TEST-43-PRIVATEUSER-UNPRIV/test.sh b/test/TEST-43-PRIVATEUSER-UNPRIV/test.sh
index 49d61c6a7f..fe20114756 100755
--- a/test/TEST-43-PRIVATEUSER-UNPRIV/test.sh
+++ b/test/TEST-43-PRIVATEUSER-UNPRIV/test.sh
@@ -15,20 +15,23 @@ test_setup() {
 
         mask_supporting_services
 
-        usermod --root $initdir -d /home/nobody -s /bin/bash nobody
-        mkdir $initdir/home $initdir/home/nobody
-        # Ubuntu's equivalent is nogroup
-        chown nobody:nobody $initdir/home/nobody || chown nobody:nogroup $initdir/home/nobody
+        # Allocate user for running test case under
+        mkdir -p $initdir/etc/sysusers.d
+        cat >$initdir/etc/sysusers.d/testuser.conf <<EOF
+u testuser    4711     "Test User" /home/testuser
+EOF
 
-        enable_user_manager nobody
+        mkdir -p $initdir/home/testuser -m 0700
+        chown 4711:4711 $initdir/home/testuser
 
-        nobody_uid=$(id -u nobody)
+        enable_user_manager testuser
 
         # setup the testsuite service
         cat >$initdir/etc/systemd/system/testsuite.service <<EOF
 [Unit]
 Description=Testsuite service
-After=systemd-logind.service user@$nobody_uid.service
+After=systemd-logind.service user@4711.service
+Wants=user@4711.service
 
 [Service]
 ExecStart=/testsuite.sh
diff --git a/test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh b/test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh
index 158889888e..837d5dbfa8 100755
--- a/test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh
+++ b/test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh
@@ -10,12 +10,12 @@ runas() {
     su "$userid" -s /bin/sh -c 'XDG_RUNTIME_DIR=/run/user/$UID exec "$@"' -- sh "$@"
 }
 
-runas nobody systemctl --user --wait is-system-running
+runas testuser systemctl --user --wait is-system-running
 
-runas nobody systemd-run --user --unit=test-private-users \
+runas testuser systemd-run --user --unit=test-private-users \
     -p PrivateUsers=yes -P echo hello
 
-runas nobody systemd-run --user --unit=test-private-tmp-innerfile \
+runas testuser systemd-run --user --unit=test-private-tmp-innerfile \
     -p PrivateUsers=yes -p PrivateTmp=yes \
     -P touch /tmp/innerfile.txt
 # File should not exist outside the job's tmp directory.
@@ -23,31 +23,31 @@ test ! -e /tmp/innerfile.txt
 
 touch /tmp/outerfile.txt
 # File should not appear in unit's private tmp.
-runas nobody systemd-run --user --unit=test-private-tmp-outerfile \
+runas testuser systemd-run --user --unit=test-private-tmp-outerfile \
     -p PrivateUsers=yes -p PrivateTmp=yes \
     -P test ! -e /tmp/outerfile.txt
 
 # Confirm that creating a file in home works
-runas nobody systemd-run --user --unit=test-unprotected-home \
-    -P touch /home/nobody/works.txt
-test -e /home/nobody/works.txt
+runas testuser systemd-run --user --unit=test-unprotected-home \
+    -P touch /home/testuser/works.txt
+test -e /home/testuser/works.txt
 
 # Confirm that creating a file in home is blocked under read-only
-runas nobody systemd-run --user --unit=test-protect-home-read-only \
+runas testuser systemd-run --user --unit=test-protect-home-read-only \
     -p PrivateUsers=yes -p ProtectHome=read-only \
     -P bash -c '
-        test -e /home/nobody/works.txt
-        ! touch /home/nobody/blocked.txt
+        test -e /home/testuser/works.txt
+        ! touch /home/testuser/blocked.txt
     '
-test ! -e /home/nobody/blocked.txt
+test ! -e /home/testuser/blocked.txt
 
 # Check that tmpfs hides the whole directory
-runas nobody systemd-run --user --unit=test-protect-home-tmpfs \
+runas testuser systemd-run --user --unit=test-protect-home-tmpfs \
     -p PrivateUsers=yes -p ProtectHome=tmpfs \
-    -P test ! -e /home/nobody
+    -P test ! -e /home/testuser
 
 # Confirm that home, /root, and /run/user are inaccessible under "yes"
-runas nobody systemd-run --user --unit=test-protect-home-yes \
+runas testuser systemd-run --user --unit=test-protect-home-yes \
     -p PrivateUsers=yes -p ProtectHome=yes \
     -P bash -c '
         test "$(stat -c %a /home)" = "0"
@@ -59,7 +59,7 @@ runas nobody systemd-run --user --unit=test-protect-home-yes \
 # namespace (no CAP_SETGID in the parent namespace to write the additional
 # mapping of the user supplied group and thus cannot change groups to an
 # unmapped group ID)
-! runas nobody systemd-run --user --unit=test-group-fail \
+! runas testuser systemd-run --user --unit=test-group-fail \
     -p PrivateUsers=yes -p Group=daemon \
     -P true
 
-- 
cgit v1.2.1


From f9aefc91f170081fe021539977b0d2e6b86567f7 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Mon, 6 Jan 2020 13:40:36 +0100
Subject: testsuite: drop "systemctl is-system-running --wait" invocation

We wait for "basic.target" being reached in the user instance anyway
before allowing the user's session to start, hence doing such a wait is
unnecessary, since that would just mean we'd wait for "default.target"
on top of "basic.target", but we shouldn#t need anything of that...

Hence, let's simplify this, reduce explicit sync points.
---
 test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh | 2 --
 1 file changed, 2 deletions(-)

(limited to 'test')

diff --git a/test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh b/test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh
index 837d5dbfa8..fa5da2ec7d 100755
--- a/test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh
+++ b/test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh
@@ -10,8 +10,6 @@ runas() {
     su "$userid" -s /bin/sh -c 'XDG_RUNTIME_DIR=/run/user/$UID exec "$@"' -- sh "$@"
 }
 
-runas testuser systemctl --user --wait is-system-running
-
 runas testuser systemd-run --user --unit=test-private-users \
     -p PrivateUsers=yes -P echo hello
 
-- 
cgit v1.2.1