| |
packager |
rpm id |
test |
status |
message |
 |
ancieg |
zed-1.24.3-alt1.x86_64 |
freedesktop-desktop |
info |
desktop-file-validate utility printed the following message(s): /usr/share/applications/dev.zed.Zed.desktop: hint: value "Utility;TextEditor;Development;IDE;" for key "Categories" in group "Desktop Entry" contains more than one main category; application might appear more than once in the application menu |
 |
andy |
ifupdown2-3.3.0.11-alt1.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
 |
aris |
ostree-2026.4-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/ostree-2026.4-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/ostree-tmpfiles.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
aris |
ostree-2026.4-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
 |
crux |
bird-3.3.3-alt1.src |
specfile-useradd-n |
warn |
-n in useradd is compat option and can be removed any time. Use -N instead. |
|
crux |
bird-3.3.3-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/bird-3.3.3-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/bird.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
dans |
lxcfs-6.0.5-alt1.x86_64 |
init-lsb |
fail |
/etc/rc.d/init.d/lxcfs: not systemd compatible: lsb init header missing and lxcfs.service is not present. See http://www.altlinux.org/Services_Policy for details. |
|
dans |
lxd-5.21.1-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
ender |
lldpd-1.0.20-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/lldpd-1.0.20-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/lldpd.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
geochip |
etcd-3.5.32-alt2.src |
specfile-useradd-n |
warn |
-n in useradd is compat option and can be removed any time. Use -N instead. |
|
geochip |
etcd-3.5.32-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
geochip |
gatus-5.37.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
iv |
krb5-kdc-1.22.2-alt2.1.x86_64 |
init-lsb |
fail |
/etc/rc.d/init.d/kadmin: not systemd compatible: lsb init header missing and kadmin.service is not present. /etc/rc.d/init.d/kprop: not systemd compatible: lsb init header missing and kprop.service is not present. /etc/rc.d/init.d/krb5kdc: not systemd compatible: lsb init header missing and krb5kdc.service is not present. See http://www.altlinux.org/Services_Policy for details. |
|
iv |
krb5-kdc-1.22.2-alt2.1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/krb5-kdc-1.22.2-alt2.1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/krb5-krb5kdc.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
lakostis |
nvme-2.16-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/nvme-2.16-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/65-persistent-net-nbft.rules /usr/lib/udev/rules.d/70-nvmf-autoconnect.rules /usr/lib/udev/rules.d/70-nvmf-keys.rules /usr/lib/udev/rules.d/71-nvmf-hpe.rules /usr/lib/udev/rules.d/71-nvmf-netapp.rules /usr/lib/udev/rules.d/71-nvmf-vastdata.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
lakostis |
nvme-2.16-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
lav |
redis-8.6.6-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/redis-8.6.6-alt1.x86_64.rpm: license not found in '/usr/share/license' directory: AGPLv3 /ALT/Sisyphus/files/x86_64/RPMS/redis-8.6.6-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/redis.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
mike |
ppp-2.5.2-alt3.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/ppp-2.5.2-alt3.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/ppp.conf sisyphus_check: check-fhs ERROR: FHS violation /ALT/Sisyphus/files/x86_64/RPMS/ppp-2.5.2-alt3.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/95-ppp.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
naf |
cryptsetup-2.8.4-alt1.x86_64 |
init-but-no-native-systemd |
info |
The package have SysV init script(s) but no native systemd files. |
|
naf |
cryptsetup-2.8.4-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/cryptsetup-2.8.4-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/cryptsetup.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
nash |
nvidia-nccl-2.31.2-alt1.src |
unmet-dependency-build-missing-package |
fail |
build dependency gcc12-c++ not found. |
|
nofex |
mstpd-0.2.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
obirvalger |
gitea-28.1.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
rider |
MySQL-8.4.11-alt1.src |
specfile-useradd-n |
warn |
-n in useradd is compat option and can be removed any time. Use -N instead. |
|
rider |
MySQL-client-8.4.11-alt1.x86_64 |
rpm-filesystem-conflict-file-file |
warn |
There are file conflicts with the package mariadb-server-12.3.3-alt3.x86_64, for example, /usr/share/man/man1/myisam_ftdump.1.xz (4 file conflicts in total). Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives. |
|
rider |
MySQL-router-8.4.11-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/MySQL-router-8.4.11-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/mysqlrouter.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
rider |
MySQL-router-8.4.11-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
rider |
MySQL-server-8.4.11-alt1.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
rider |
MySQL-server-8.4.11-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/MySQL-server-8.4.11-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/mysql.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
rider |
collectd-5.12.0-alt9.x86_64 |
big-changelog |
info |
Package contains big ChangeLog. Gzip it. |
|
rider |
gnote-51.0-alt1.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
rider |
gnote-51.0-alt1.x86_64 |
freedesktop-categories |
warn |
Menu-related Additional Categories (http://standards.freedesktop.org/menu-spec/latest/apa.html) not found in /usr/share/applications/org.gnome.Gnote.desktop. Please add it or report a bug against this test if you already have registered one (not including menu unrelated ones as Core or Qt). |
|
rider |
keepalived-2.3.4-alt1.x86_64 |
big-changelog |
info |
Package contains big ChangeLog. Gzip it. |
|
rider |
keepalived-2.3.4-alt1.x86_64 |
dbus-xml-not-in-devel |
info |
file /usr/share/dbus-1/interfaces/org.keepalived.Vrrp1.Vrrp.xml is not used in run time. Move it to the -devel subpackage.
ge. |
|
rider |
libmysqlclient-devel-8.4.11-alt1.x86_64 |
rpm-obsolete-live-package |
info |
The package obsoletes the package libmysqlclient21-devel-8.0.44-alt2.x86_64, but the package libmysqlclient21-devel-8.0.44-alt2.x86_64 is still alive and in the repository. Ask its maintainer to remove it, or, if it should not be removed, remove the Obsoletes: tag. Do not forget to add explicit conflicts with the other package if nessessary. |
|
rider |
ocaml-5.5.0-alt1.x86_64 |
file-in-usr-marked-as-conffile |
warn |
Files below /usr may not be marked as conffiles, since
/usr might be mounted read-only and thus, the local system
administrator would not have a chance to modify this configuration
file. |
|
rider |
openvswitch-3.3.8-alt1.src |
specfile-useradd-n |
warn |
-n in useradd is compat option and can be removed any time. Use -N instead. |
|
rider |
openvswitch-3.3.8-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/openvswitch-3.3.8-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/openvswitch.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
rider |
openvswitch-ipsec-3.3.8-alt1.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
romenskiy |
tuwunel-1.9.3-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
sem |
etcnet-0.9.35-alt1.noarch |
init-condrestart |
warn |
/etc/rc.d/init.d/network: missing condrestart target. Note: alt-specific script %_sbindir/post_service (used in %post_service macro) depends on condrestart. It is wise to add condrestart anyway./etc/rc.d/init.d/network: missing condstop target. Note: alt-specific script %_sbindir/preun_service (used in %preun_service macro) depends on condstop. It is wise to add condstop anyway. |
|
shaba |
NetworkManager-openconnect-1.2.10-alt2.x86_64 |
file-in-usr-marked-as-conffile |
warn |
Files below /usr may not be marked as conffiles, since
/usr might be mounted read-only and thus, the local system
administrator would not have a chance to modify this configuration
file. |
|
shaba |
acmed-0.25.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
agola-0.5.0-alt3.src |
specfile-useradd-n |
warn |
-n in useradd is compat option and can be removed any time. Use -N instead. |
|
shaba |
agola-0.5.0-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
anubis-1.27.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
argon2-debuginfo-20190702-alt1.x86_64 |
unmet-dependency-no-suitable-version |
fail |
install dependency libargon2-debuginfo has no suitable version. |
|
shaba |
arrow-glib-doc-23.0.1-alt1.1.x86_64 |
arch-dep-package-consists-of-usr-share |
info |
The package consists of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
baibot-1.28.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
branding-alt-container-11-alt1.src |
requires-ImageMagick |
info |
Dependency on ImageMagick (compat package) found. It probably should be replaced with more specific dependency like /usr/bin/convert or ImageMagick-tools, or it can be already autodetected by findreq-shell. |
|
shaba |
branding-alt-container-notes-11-alt1.noarch |
file-in-usr-marked-as-conffile |
warn |
Files below /usr may not be marked as conffiles, since
/usr might be mounted read-only and thus, the local system
administrator would not have a chance to modify this configuration
file. |
|
shaba |
branding-alt-server-11.2-alt5.src |
requires-ImageMagick |
info |
Dependency on ImageMagick (compat package) found. It probably should be replaced with more specific dependency like /usr/bin/convert or ImageMagick-tools, or it can be already autodetected by findreq-shell. |
|
shaba |
branding-alt-virtualization-pve-11.2-alt1.src |
requires-ImageMagick |
info |
Dependency on ImageMagick (compat package) found. It probably should be replaced with more specific dependency like /usr/bin/convert or ImageMagick-tools, or it can be already autodetected by findreq-shell. |
|
shaba |
branding-alt-virtualization-pve-notes-11.2-alt1.noarch |
file-in-usr-marked-as-conffile |
warn |
Files below /usr may not be marked as conffiles, since
/usr might be mounted read-only and thus, the local system
administrator would not have a chance to modify this configuration
file. |
|
shaba |
branding-alt-virtualization-pve-release-11.2-alt1.noarch |
rpm-filesystem-conflict-file-file |
warn |
File /etc/altlinux-release conflicts with the package altlinux-release-sisyphus-20201124-alt1.noarch. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives. |
|
shaba |
caddy-2.11.4-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ceph-base-19.2.3-alt5.x86_64 |
altlinux-policy-shared-lib-contains-devel-so |
info |
SharedLibs Policy Draft violation: Shared Lib package should not contain symlink /usr/lib64/libosd_tp.so but just /usr/lib64/libosd_tp.so.1.0.0. According to SharedLibs Policy Draft, symlink /usr/lib64/libosd_tp.so should be placed in a special subpackage named lib-devel. If you have already packaged this symlink in lib-devel, just append \%exclude /usr/lib64/libosd_tp.so to \%files of ceph-base-19.2.3-alt5.x86_64. Otherwise, move the symlink into the subpackage lib-devel. There is a known exception for case the .so file is not a shared lib but a plugin that is never directly linked with. Please report such a case to repocop test.
pocop test. |
|
shaba |
ceph-base-19.2.3-alt5.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ceph-common-19.2.3-alt5.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
ceph-common-19.2.3-alt5.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/ceph-common-19.2.3-alt5.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/ceph-common.conf sisyphus_check: check-fhs ERROR: FHS violation /ALT/Sisyphus/files/x86_64/RPMS/ceph-common-19.2.3-alt5.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/50-rbd.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
ceph-common-19.2.3-alt5.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ceph-exporter-19.2.3-alt5.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ceph-fuse-19.2.3-alt5.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ceph-immutable-object-cache-19.2.3-alt5.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ceph-mds-19.2.3-alt5.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ceph-mgr-19.2.3-alt5.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ceph-mgr-cephadm-19.2.3-alt5.x86_64 |
arch-dep-package-consists-of-usr-share |
info |
The package consists of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
ceph-mgr-dashboard-19.2.3-alt5.x86_64 |
arch-dep-package-consists-of-usr-share |
info |
The package consists of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
ceph-mgr-diskprediction-local-19.2.3-alt5.x86_64 |
arch-dep-package-consists-of-usr-share |
info |
The package consists of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
ceph-mgr-modules-core-19.2.3-alt5.x86_64 |
arch-dep-package-consists-of-usr-share |
info |
The package consists of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
ceph-mgr-rook-19.2.3-alt5.x86_64 |
arch-dep-package-consists-of-usr-share |
info |
The package consists of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
ceph-mon-19.2.3-alt5.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ceph-osd-19.2.3-alt5.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ceph-radosgw-19.2.3-alt5.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ceph-volume-19.2.3-alt5.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
cephfs-mirror-19.2.3-alt5.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
cloud-init-25.3-alt1.noarch |
big-changelog |
info |
Package contains big ChangeLog. Gzip it. |
|
shaba |
cloud-init-25.3-alt1.noarch |
file-in-usr-marked-as-conffile |
warn |
Files below /usr may not be marked as conffiles, since
/usr might be mounted read-only and thus, the local system
administrator would not have a chance to modify this configuration
file. |
|
shaba |
cloud-init-25.3-alt1.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/cloud-init-25.3-alt1.noarch.rpm: Invalid path names: /usr/lib/tmpfiles.d/cloud-init.conf sisyphus_check: check-fhs ERROR: FHS violation /ALT/Sisyphus/files/noarch/RPMS/cloud-init-25.3-alt1.noarch.rpm: invalid udev rules path: /usr/lib/udev/rules.d/66-azure-ephemeral.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
cloud-init-25.3-alt1.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
cni-plugins-1.9.1-alt2.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/cni-plugins-1.9.1-alt2.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/cni-plugins.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
cni-plugins-1.9.1-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
connman-2.0-alt1.x86_64 |
init-lsb |
fail |
/etc/rc.d/init.d/connmand: not systemd compatible: lsb init header missing and connmand.service is not present. See http://www.altlinux.org/Services_Policy for details. |
|
shaba |
connman-2.0-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/connman-2.0-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/connman_resolvconf.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
cri-o1.23-1.23.5-alt4.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
cri-o1.24-1.24.6-alt4.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
cri-o1.25-1.25.5-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
cri-o1.26-1.26.4-alt5.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
cri-o1.27-1.27.8-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
cri-o1.28-1.28.11-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
dmeventd-1.02.212-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
dmsetup-1.02.212-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/dmsetup-1.02.212-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/10-dm.rules /usr/lib/udev/rules.d/11-dm-lvm.rules /usr/lib/udev/rules.d/13-dm-disk.rules /usr/lib/udev/rules.d/95-dm-notify.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
dracut-111-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
dracut-111-alt1.x86_64 |
unsafe-tmp-usage-in-scripts |
fail |
0755 |
|
shaba |
dracut-live-111-alt1.noarch |
unsafe-tmp-usage-in-scripts |
fail |
The test discovered scripts with errors which may be used by a user for damaging important system files. For example if a script uses in its work a temp file which is created in /tmp directory, then every user can create symlinks with the same name (pattern) in this directory in order to destroy or rewrite some system or another user's files. Scripts _must_ _use_ mktemp/tempfile or must use $TMPDIR. mktemp/tempfile is safest. $TMPDIR is safer than /tmp/ because libpam-tmpdir creates a subdirectory of /tmp that is only accessible by that user, and then sets TMPDIR and other variables to that. Hence, it doesn't matter nearly as much if you create a non-random filename, because nobody but you can access it. Found error in /usr/lib/dracut/modules.d/70livenet/parse-livenet.sh: $ grep /tmp/ /usr/lib/dracut/modules.d/70livenet/parse-livenet.sh # live updates updates=$(getarg live.updates=) if [ "$updates" ]; then # make sure network comes up even if we're doing a local live device if [ "$netroot" ]; then echo > /tmp/net.ifaces fi echo "$updates" > /tmp/liveupdates.info echo '[ /tmp/liveupdates.done ]' > "$hookdir"/initqueue/finished/liveupdates.sh fi case "$root" in http://* | https://*) liveurl="${root}" Found error in /usr/lib/dracut/modules.d/70livenet/livenetroot.sh: $ grep /tmp/ /usr/lib/dracut/modules.d/70livenet/livenetroot.sh PATH=/usr/sbin:/usr/bin:/sbin:/bin RETRIES=${RETRIES:-100} SLEEP=${SLEEP:-5} [ /tmp/livenet.downloaded ] && exit 0 # args get passed from 40network/netroot netroot="$2" liveurl="${netroot#livenet:}" info "fetching $liveurl" sleep "$SLEEP" fi i=$((i + 1)) done > /tmp/livenet.downloaded # TODO: couldn't dmsquash-live-root handle this? if [ "${imgfile##*.}" = "iso" ]; then root=$(losetup -f) losetup "$root" "$imgfile" Found error in /usr/lib/dracut/modules.d/70dmsquash-live-autooverlay/create-overlay.sh: $ grep -A5 -B5 /tmp/ /usr/lib/dracut/modules.d/70dmsquash-live-autooverlay/create-overlay.sh command -v getarg > /dev/null || . /lib/dracut-lib.sh command -v get_rd_overlay > /dev/null || . /lib/overlayfs-lib.sh if getargbool 0 rd.live.debug; then exec > /tmp/create-overlay.$$.out exec 2>> /tmp/create-overlay.$$.out set -x fi gatherData() { overlay=$(get_rd_overlay) Found error in /usr/lib/dracut/modules.d/70dmsquash-live/iso-scan.sh: $ grep -A5 -B5 /tmp/ /usr/lib/dracut/modules.d/70dmsquash-live/iso-scan.sh do_iso_scan() { local _name local dev for dev in /dev/disk/by-uuid/*; do _name=$(dev_unit_name "$dev") [ -e /tmp/isoscan-"${_name}" ] && continue : > /tmp/isoscan-"${_name}" mount -t auto -o ro "$dev" "/run/initramfs/isoscan" || continue if [ -f "/run/initramfs/isoscan/$isofile" ]; then losetup -f "/run/initramfs/isoscan/$isofile" udevadm trigger --action=add > /dev/null 2>&1 ln -s "$dev" /run/initramfs/isoscandev Found error in /usr/lib/dracut/modules.d/70dmsquash-live/dmsquash-live-root.sh: $ grep -A5 -B5 /tmp/ /usr/lib/dracut/modules.d/70dmsquash-live/dmsquash-live-root.sh command -v get_rd_overlay > /dev/null || . /lib/overlayfs-lib.sh PATH=/usr/sbin:/usr/bin:/sbin:/bin if getargbool 0 rd.live.debug; then exec > /tmp/liveroot.$$.out exec 2>> /tmp/liveroot.$$.out set -x fi [ -z "$1" ] && exit 1 livedev="$1" |
|
shaba |
driverctl-0.111-alt1.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
fapolicyd-1.3.3-alt2.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/fapolicyd-1.3.3-alt2.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/fapolicyd.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
fapolicyd-1.3.3-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
fcoe-utils-1.0.34-alt4.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
fcoe-utils-1.0.34-alt4.x86_64 |
systemd-check-socket-name |
experimental |
in fcoe-utils-1.0.34-alt4.x86_64: there is a socket fcoemon.socket but no service fcoemon.service. Ask ildar@ why it is not right. |
|
shaba |
fence-sanlock-4.2.0-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/fence-sanlock-4.2.0-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/fence_sanlockd.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
flannel-0.28.2-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/flannel-0.28.2-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/flannel.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
flannel-0.28.2-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
foomuuri-0.33-alt1.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/foomuuri-0.33-alt1.noarch.rpm: Invalid path names: /usr/lib/tmpfiles.d/foomuuri.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
foomuuri-0.33-alt1.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
forgejo-15.0.10-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
freeradius-3.2.8-alt2.src |
specfile-useradd-n |
warn |
-n in useradd is compat option and can be removed any time. Use -N instead. |
|
shaba |
freeradius-3.2.8-alt2.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
freeradius-3.2.8-alt2.x86_64 |
init-lsb |
fail |
/etc/rc.d/init.d/radiusd: not systemd compatible: lsb init header missing and radiusd.service is not present. See http://www.altlinux.org/Services_Policy for details. |
|
shaba |
freeradius-3.2.8-alt2.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/freeradius-3.2.8-alt2.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/radiusd.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
frr-10.7.0-alt1.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
fwbuilder-6.0.0-alt2.beta.106.a5e1.x86_64 |
big-changelog |
info |
Package contains big ChangeLog. Gzip it. |
|
shaba |
fwbuilder-6.0.0-alt2.beta.106.a5e1.x86_64 |
freedesktop-desktop |
info |
desktop-file-validate utility printed the following message(s): /usr/share/applications/fwbuilder.desktop: hint: value "System;Settings;Security;Qt;" for key "Categories" in group "Desktop Entry" contains more than one main category; application might appear more than once in the application menu |
|
shaba |
galera-garbd-26.4.28-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/galera-garbd-26.4.28-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/garbd.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
gdm-51.1-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
gdm-data-51.1-alt1.noarch |
file-in-usr-marked-as-conffile |
warn |
Files below /usr may not be marked as conffiles, since
/usr might be mounted read-only and thus, the local system
administrator would not have a chance to modify this configuration
file. |
|
shaba |
gdm-libs-51.1-alt1.x86_64 |
library-pkgnames |
info |
package contains public library which is used in external packages: name should be lib* according to http://altlinux.org/Drafts/SharedLibs |
|
shaba |
gerbera-3.2.1-alt1.src |
specfile-useradd-n |
warn |
-n in useradd is compat option and can be removed any time. Use -N instead. |
|
shaba |
gerbera-3.2.1-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
gitea-act-0.3.0-alt1.x86_64 |
rpm-package-is-obsoleted |
warn |
The package is obsoleted by the package gitea-runner-5.0.0-alt1.x86_64, but is still alive and in the repository. Consider removing the package, or, if you want the package to be alive, ask the maintainer of gitea-runner-5.0.0-alt1.x86_64 to remove Obsoletes: tag. |
|
shaba |
gitea-act-0.3.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
gitea-runner-5.0.0-alt1.x86_64 |
rpm-obsolete-live-package |
info |
The package obsoletes the package gitea-act-0.3.0-alt1.x86_64, but the package gitea-act-0.3.0-alt1.x86_64 is still alive and in the repository. Ask its maintainer to remove it, or, if it should not be removed, remove the Obsoletes: tag. Do not forget to add explicit conflicts with the other package if nessessary. |
|
shaba |
gitea-tea-0.15.1-alt1.x86_64 |
rpm-filesystem-conflict-file-file |
warn |
File /usr/bin/tea conflicts with the package tea-63.3.1-alt1.x86_64. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives. |
|
shaba |
gnome-boxes-50.0-alt1.1.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
gnome-boxes-50.0-alt1.1.x86_64 |
freedesktop-desktop |
info |
desktop-file-validate utility printed the following message(s): /usr/share/applications/org.gnome.Boxes.desktop: hint: value "GNOME;GTK;System;Development;Emulator;" for key "Categories" in group "Desktop Entry" contains more than one main category; application might appear more than once in the application menu |
|
shaba |
goose-desktop-1.44.0-alt1.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
goose-desktop-1.44.0-alt1.x86_64 |
freedesktop-categories |
warn |
Menu-related Additional Categories (http://standards.freedesktop.org/menu-spec/latest/apa.html) not found in /usr/share/applications/goose-desktop.desktop. Please add it or report a bug against this test if you already have registered one (not including menu unrelated ones as Core or Qt). |
|
shaba |
grafana-12.3.6-alt2.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
grafana-12.3.6-alt2.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/grafana-12.3.6-alt2.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/grafana.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
guestfs-data-0.6-alt3.x86_64 |
missing-url |
info |
Missing Url: in a package. |
|
shaba |
hivex-1.3.24-alt1.x86_64 |
library-pkgnames |
info |
package contains public library which is used in external packages: name should be lib* according to http://altlinux.org/Drafts/SharedLibs |
|
shaba |
ignition-2.19.0-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
influxdb-1.12.0-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/influxdb-1.12.0-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/influxdb.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
influxdb-1.12.0-alt1.x86_64 |
subdir-in-var-run |
info |
Found a subdir in /var/run or /var/lock. /var/run and /var/lock may be mounted as temporary filesystems, so the init.d scripts must handle this correctly. This will typically amount to creating any required subdirectories dynamically when the init.d script is run, rather than including them in the package and relying on rpm to create them. |
|
shaba |
installer-distro-alt-server-v-stage2-10.1.0-alt2.noarch |
rpm-filesystem-conflict-file-file |
warn |
Files /usr/share/install2/alterator-menu/module-expert-list /usr/share/install2/alterator-menu/module-order-list /usr/share/install2/installer-steps conflict with the package installer-distro-virtualization-pve-stage2-11.1.0-alt3.noarch. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives.
ves. |
|
shaba |
installer-distro-virtualization-pve-stage2-11.1.0-alt3.noarch |
rpm-filesystem-conflict-file-file |
warn |
Files /usr/share/install2/alterator-menu/module-expert-list /usr/share/install2/alterator-menu/module-order-list /usr/share/install2/installer-steps conflict with the package installer-distro-virtualization-one-stage2-11.0.0-alt0.4.noarch. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives. |
|
shaba |
iwpmd-62.0-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/iwpmd-62.0-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/90-iwpmd.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
kapacitor-1.5.9-alt1.x86_64 |
subdir-in-var-run |
info |
Found a subdir in /var/run or /var/lock. /var/run and /var/lock may be mounted as temporary filesystems, so the init.d scripts must handle this correctly. This will typically amount to creating any required subdirectories dynamically when the init.d script is run, rather than including them in the package and relying on rpm to create them. |
|
shaba |
kea-common-3.2.1-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/kea-common-3.2.1-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/kea.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
kea-dhcp-ddns-3.2.1-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kea-dhcp4-3.2.1-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kea-dhcp6-3.2.1-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kea-doc-3.2.1-alt1.noarch |
big-changelog |
info |
Package contains big ChangeLog. Gzip it. |
|
shaba |
kmscon-10.0.4-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
knot-3.5.3-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
knot-resolver-6.2.0-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/knot-resolver-6.2.0-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/knot-resolver.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
knot-resolver-6.2.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kpartx-0.14.3-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/kpartx-0.14.3-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/66-kpartx.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
kubernetes1.23-common-1.23.17-alt4.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/kubernetes1.23-common-1.23.17-alt4.noarch.rpm: Invalid path names: /usr/lib/tmpfiles.d/kubernetes.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
kubernetes1.23-kubelet-1.23.17-alt4.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.23-master-1.23.17-alt4.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.23-node-1.23.17-alt4.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.24-common-1.24.17-alt3.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/kubernetes1.24-common-1.24.17-alt3.noarch.rpm: Invalid path names: /usr/lib/tmpfiles.d/kubernetes.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
kubernetes1.24-kubelet-1.24.17-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.24-master-1.24.17-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.24-node-1.24.17-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.25-common-1.25.16-alt3.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/kubernetes1.25-common-1.25.16-alt3.noarch.rpm: Invalid path names: /usr/lib/tmpfiles.d/kubernetes.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
kubernetes1.25-kubelet-1.25.16-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.25-master-1.25.16-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.25-node-1.25.16-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.26-common-1.26.15-alt3.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/kubernetes1.26-common-1.26.15-alt3.noarch.rpm: Invalid path names: /usr/lib/tmpfiles.d/kubernetes.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
kubernetes1.26-kubelet-1.26.15-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.26-master-1.26.15-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.26-node-1.26.15-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.27-common-1.27.16-alt3.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/kubernetes1.27-common-1.27.16-alt3.noarch.rpm: Invalid path names: /usr/lib/tmpfiles.d/kubernetes.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
kubernetes1.27-kubelet-1.27.16-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.27-master-1.27.16-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.27-node-1.27.16-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.28-common-1.28.15-alt3.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/kubernetes1.28-common-1.28.15-alt3.noarch.rpm: Invalid path names: /usr/lib/tmpfiles.d/kubernetes.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
kubernetes1.28-kubelet-1.28.15-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.28-master-1.28.15-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
kubernetes1.28-node-1.28.15-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
libdevmapper-event-1.02.212-alt1.x86_64 |
altlinux-policy-shared-lib-contains-devel-so |
info |
SharedLibs Policy Draft violation: Shared Lib package should not contain symlink /usr/lib64/libdevmapper-event-lvm2.so but just /usr/lib64/libdevmapper-event-lvm2.so.2.03. According to SharedLibs Policy Draft, symlink /usr/lib64/libdevmapper-event-lvm2.so should be placed in a special subpackage named lib-devel. If you have already packaged this symlink in lib-devel, just append \%exclude /usr/lib64/libdevmapper-event-lvm2.so to \%files of libdevmapper-event-1.02.212-alt1.x86_64. Otherwise, move the symlink into the subpackage lib-devel. There is a known exception for case the .so file is not a shared lib but a plugin that is never directly linked with. Please report such a case to repocop test. |
|
shaba |
liberasurecode-doc-1.6.5-alt1.x86_64 |
arch-dep-package-consists-of-usr-share |
info |
The package consists of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
libgadu-devel-1.12.2-alt1.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
libpcsclite-2.5.3-alt1.x86_64 |
altlinux-policy-shared-lib-contains-devel-so |
info |
SharedLibs Policy Draft violation: Shared Lib package should not contain symlink /usr/lib64/libpcsclite_real.so but just /usr/lib64/libpcsclite_real.so.1. According to SharedLibs Policy Draft, symlink /usr/lib64/libpcsclite_real.so should be placed in a special subpackage named lib-devel. If you have already packaged this symlink in lib-devel, just append \%exclude /usr/lib64/libpcsclite_real.so to \%files of libpcsclite-2.5.3-alt1.x86_64. Otherwise, move the symlink into the subpackage lib-devel. There is a known exception for case the .so file is not a shared lib but a plugin that is never directly linked with. Please report such a case to repocop test. |
|
shaba |
libpcsclite-devel-2.5.3-alt1.x86_64 |
altlinux-policy-shared-lib-contains-devel-so |
info |
SharedLibs Policy Draft violation: Shared Lib package should not contain symlink /usr/lib64/libpcscspy.so but just /usr/lib64/libpcscspy.so.0. According to SharedLibs Policy Draft, symlink /usr/lib64/libpcscspy.so should be placed in a special subpackage named lib-devel. If you have already packaged this symlink in lib-devel, just append \%exclude /usr/lib64/libpcscspy.so to \%files of libpcsclite-devel-2.5.3-alt1.x86_64. Otherwise, move the symlink into the subpackage lib-devel. There is a known exception for case the .so file is not a shared lib but a plugin that is never directly linked with. Please report such a case to repocop test. |
|
shaba |
libproxy-tools-0.5.12-alt1.x86_64 |
rpm-filesystem-conflict-file-file |
warn |
File /usr/bin/proxy conflicts with the package python3-module-proxy-py-2.4.10-alt2.noarch. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives.
lternatives. |
|
shaba |
libsmi-0.5.0-alt4.x86_64 |
big-changelog |
info |
Package contains big ChangeLog. Gzip it. |
|
shaba |
libspice-gtk3-gir-devel-0.42-alt1.noarch |
unmet-dependency-no-suitable-version |
fail |
install dependency libspice-gtk3-gir has no suitable version. |
|
shaba |
libvirt-daemon-12.6.0-alt2.x86_64 |
systemd-check-socket-name |
experimental |
in libvirt-daemon-12.6.0-alt2.x86_64: there is a socket libvirtd-admin.socket but no service libvirtd-admin.service. Ask ildar@ why it is not right.
in libvirt-daemon-12.6.0-alt2.x86_64: there is a socket libvirtd-ro.socket but no service libvirtd-ro.service. Ask ildar@ why it is not right.
in libvirt-daemon-12.6.0-alt2.x86_64: there is a socket libvirtd-tcp.socket but no service libvirtd-tcp.service. Ask ildar@ why it is not right.
in libvirt-daemon-12.6.0-alt2.x86_64: there is a socket libvirtd-tls.socket but no service libvirtd-tls.service. Ask ildar@ why it is not right. |
|
shaba |
libvirt-daemon-common-12.6.0-alt2.x86_64 |
init-condrestart |
fail |
/etc/rc.d/init.d/libvirt-guests: missing condrestart target. Note: alt-specific script %_sbindir/post_service (used in %post_service macro) depends on condrestart. It is wise to add condrestart anyway./etc/rc.d/init.d/libvirt-guests: missing condstop target. ERROR: alt-specific script %_sbindir/preun_service (used in your %preun_service macro) depends on condstop. Please, fix. |
|
shaba |
libvirt-daemon-driver-interface-12.6.0-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
libvirt-daemon-driver-interface-12.6.0-alt2.x86_64 |
systemd-check-socket-name |
experimental |
in libvirt-daemon-driver-interface-12.6.0-alt2.x86_64: there is a socket virtinterfaced-admin.socket but no service virtinterfaced-admin.service. Ask ildar@ why it is not right.
in libvirt-daemon-driver-interface-12.6.0-alt2.x86_64: there is a socket virtinterfaced-ro.socket but no service virtinterfaced-ro.service. Ask ildar@ why it is not right. |
|
shaba |
libvirt-daemon-driver-lxc-12.6.0-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
libvirt-daemon-driver-lxc-12.6.0-alt2.x86_64 |
systemd-check-socket-name |
experimental |
in libvirt-daemon-driver-lxc-12.6.0-alt2.x86_64: there is a socket virtlxcd-admin.socket but no service virtlxcd-admin.service. Ask ildar@ why it is not right.
in libvirt-daemon-driver-lxc-12.6.0-alt2.x86_64: there is a socket virtlxcd-ro.socket but no service virtlxcd-ro.service. Ask ildar@ why it is not right. |
|
shaba |
libvirt-daemon-driver-network-12.6.0-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
libvirt-daemon-driver-network-12.6.0-alt2.x86_64 |
systemd-check-socket-name |
experimental |
in libvirt-daemon-driver-network-12.6.0-alt2.x86_64: there is a socket virtnetworkd-admin.socket but no service virtnetworkd-admin.service. Ask ildar@ why it is not right.
in libvirt-daemon-driver-network-12.6.0-alt2.x86_64: there is a socket virtnetworkd-ro.socket but no service virtnetworkd-ro.service. Ask ildar@ why it is not right. |
|
shaba |
libvirt-daemon-driver-nodedev-12.6.0-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
libvirt-daemon-driver-nodedev-12.6.0-alt2.x86_64 |
systemd-check-socket-name |
experimental |
in libvirt-daemon-driver-nodedev-12.6.0-alt2.x86_64: there is a socket virtnodedevd-admin.socket but no service virtnodedevd-admin.service. Ask ildar@ why it is not right.
in libvirt-daemon-driver-nodedev-12.6.0-alt2.x86_64: there is a socket virtnodedevd-ro.socket but no service virtnodedevd-ro.service. Ask ildar@ why it is not right. |
|
shaba |
libvirt-daemon-driver-nwfilter-12.6.0-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
libvirt-daemon-driver-nwfilter-12.6.0-alt2.x86_64 |
systemd-check-socket-name |
experimental |
in libvirt-daemon-driver-nwfilter-12.6.0-alt2.x86_64: there is a socket virtnwfilterd-admin.socket but no service virtnwfilterd-admin.service. Ask ildar@ why it is not right.
in libvirt-daemon-driver-nwfilter-12.6.0-alt2.x86_64: there is a socket virtnwfilterd-ro.socket but no service virtnwfilterd-ro.service. Ask ildar@ why it is not right. |
|
shaba |
libvirt-daemon-driver-qemu-12.6.0-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
libvirt-daemon-driver-qemu-12.6.0-alt2.x86_64 |
systemd-check-socket-name |
experimental |
in libvirt-daemon-driver-qemu-12.6.0-alt2.x86_64: there is a socket virtqemud-admin.socket but no service virtqemud-admin.service. Ask ildar@ why it is not right.
in libvirt-daemon-driver-qemu-12.6.0-alt2.x86_64: there is a socket virtqemud-ro.socket but no service virtqemud-ro.service. Ask ildar@ why it is not right. |
|
shaba |
libvirt-daemon-driver-secret-12.6.0-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
libvirt-daemon-driver-secret-12.6.0-alt2.x86_64 |
systemd-check-socket-name |
experimental |
in libvirt-daemon-driver-secret-12.6.0-alt2.x86_64: there is a socket virtsecretd-admin.socket but no service virtsecretd-admin.service. Ask ildar@ why it is not right.
in libvirt-daemon-driver-secret-12.6.0-alt2.x86_64: there is a socket virtsecretd-ro.socket but no service virtsecretd-ro.service. Ask ildar@ why it is not right. |
|
shaba |
libvirt-daemon-driver-storage-core-12.6.0-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
libvirt-daemon-driver-storage-core-12.6.0-alt2.x86_64 |
systemd-check-socket-name |
experimental |
in libvirt-daemon-driver-storage-core-12.6.0-alt2.x86_64: there is a socket virtstoraged-admin.socket but no service virtstoraged-admin.service. Ask ildar@ why it is not right.
in libvirt-daemon-driver-storage-core-12.6.0-alt2.x86_64: there is a socket virtstoraged-ro.socket but no service virtstoraged-ro.service. Ask ildar@ why it is not right. |
|
shaba |
libvirt-daemon-driver-vbox-12.6.0-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
libvirt-daemon-driver-vbox-12.6.0-alt2.x86_64 |
systemd-check-socket-name |
experimental |
in libvirt-daemon-driver-vbox-12.6.0-alt2.x86_64: there is a socket virtvboxd-admin.socket but no service virtvboxd-admin.service. Ask ildar@ why it is not right.
in libvirt-daemon-driver-vbox-12.6.0-alt2.x86_64: there is a socket virtvboxd-ro.socket but no service virtvboxd-ro.service. Ask ildar@ why it is not right. |
|
shaba |
libvirt-daemon-lock-12.6.0-alt2.x86_64 |
systemd-check-socket-name |
experimental |
in libvirt-daemon-lock-12.6.0-alt2.x86_64: there is a socket virtlockd-admin.socket but no service virtlockd-admin.service. Ask ildar@ why it is not right. |
|
shaba |
libvirt-daemon-log-12.6.0-alt2.x86_64 |
systemd-check-socket-name |
experimental |
in libvirt-daemon-log-12.6.0-alt2.x86_64: there is a socket virtlogd-admin.socket but no service virtlogd-admin.service. Ask ildar@ why it is not right. |
|
shaba |
libvirt-daemon-proxy-12.6.0-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
libvirt-daemon-proxy-12.6.0-alt2.x86_64 |
systemd-check-socket-name |
experimental |
in libvirt-daemon-proxy-12.6.0-alt2.x86_64: there is a socket virtproxyd-admin.socket but no service virtproxyd-admin.service. Ask ildar@ why it is not right.
in libvirt-daemon-proxy-12.6.0-alt2.x86_64: there is a socket virtproxyd-ro.socket but no service virtproxyd-ro.service. Ask ildar@ why it is not right.
in libvirt-daemon-proxy-12.6.0-alt2.x86_64: there is a socket virtproxyd-tcp.socket but no service virtproxyd-tcp.service. Ask ildar@ why it is not right.
in libvirt-daemon-proxy-12.6.0-alt2.x86_64: there is a socket virtproxyd-tls.socket but no service virtproxyd-tls.service. Ask ildar@ why it is not right. |
|
shaba |
libvirt-libs-12.6.0-alt2.x86_64 |
altlinux-find-lang-mo |
warn |
Language specific files in /usr/share/locale should be marked, for example, using %find_lang. See http://www.altlinux.org/FindLangPolicy for details. |
|
shaba |
libvirt-libs-12.6.0-alt2.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
linstor-common-1.35.2-alt1.x86_64 |
arch-dep-package-consists-of-usr-share |
info |
The package consists of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
linstor-controller-1.35.2-alt1.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
linstor-controller-1.35.2-alt1.x86_64 |
obsolete-call-in-post-alternatives-0.3 |
warn |
alternatives-* calls in post/preun and in triggers are deprecated |
|
shaba |
linstor-controller-1.35.2-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
linstor-satellite-1.35.2-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
livekit-1.13.5-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
lk-jwt-service-0.6.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
llama.cpp-cpu-0.7.0-alt1.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
llama.cpp-cpu-0.7.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
lldpad-1.1.1-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
loki-3.6.7-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
lvm2-2.03.38-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/lvm2-2.03.38-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/lvm2.conf sisyphus_check: check-fhs ERROR: FHS violation /ALT/Sisyphus/files/x86_64/RPMS/lvm2-2.03.38-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/69-dm-lvm.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
lvm2-cmirrord-2.03.38-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
lvm2-lockd-2.03.38-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
mariadb-12.3.3-alt3.src |
specfile-useradd-n |
warn |
-n in useradd is compat option and can be removed any time. Use -N instead. |
|
shaba |
mariadb-client-debuginfo-12.3.3-alt3.x86_64 |
rpm-filesystem-conflict-symlink-file |
warn |
symlink /usr/lib/debug/usr/bin/mysqltest.debug is a file in the package MySQL-client-debuginfo-8.4.11-alt1.x86_64. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives.
.
ives. |
|
shaba |
mariadb-server-12.3.3-alt3.x86_64 |
rpm-filesystem-conflict-file-file |
warn |
There are file conflicts with the package MySQL-client-8.4.11-alt1.x86_64, for example, /usr/share/man/man1/myisam_ftdump.1.xz (4 file conflicts in total). Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives. |
|
shaba |
mariadb-server-12.3.3-alt3.x86_64 |
rpm-filesystem-conflict-symlink-file |
warn |
symlink /usr/share/man/man1/mysql_tzinfo_to_sql.1.xz is a file in the package MySQL-client-8.4.11-alt1.x86_64. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives.
ives. |
|
shaba |
mariadb-server-12.3.3-alt3.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/mariadb-server-12.3.3-alt3.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/mariadb.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
mariadb-server-debuginfo-12.3.3-alt3.x86_64 |
rpm-filesystem-conflict-symlink-file |
warn |
symlink /usr/lib/debug/usr/sbin/mysqld.debug is a file in the package MySQL-server-debuginfo-8.4.11-alt1.x86_64. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives.
ternatives. |
|
shaba |
mariadb-server-galera-12.3.3-alt3.x86_64 |
bin-permissions |
info |
not executable file /usr/bin/wsrep_sst_common |
|
shaba |
mariadb-server-galera-12.3.3-alt3.x86_64 |
systemd-check-socket-name |
experimental |
in mariadb-server-galera-12.3.3-alt3.x86_64: there is a socket mariadbcheck.socket but no service mariadbcheck.service. Ask ildar@ why it is not right. |
|
shaba |
mariadb-server-perl-12.3.3-alt3.noarch |
rpm-filesystem-conflict-symlink-file |
warn |
symlink /usr/share/man/man1/mysqldumpslow.1.xz is a file in the package MySQL-client-8.4.11-alt1.x86_64. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives. |
|
shaba |
matchbox-0.11.0-alt1.x86_64 |
rpm-filesystem-conflict-dir-dir |
fail |
directory /etc/matchbox is a directory in package matchbox-window-manager-1.2-alt6.x86_64 with different user,group or permissions. You should add explicit conflicts. |
|
shaba |
matchbox-0.11.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
mdadm-4.6-alt1.x86_64 |
init-lsb |
fail |
/etc/rc.d/init.d/mdadm: not systemd compatible: lsb init header missing and mdadm.service is not present. See http://www.altlinux.org/Services_Policy for details. |
|
shaba |
mdadm-4.6-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/mdadm-4.6-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/01-md-raid-creating.rules /usr/lib/udev/rules.d/63-md-raid-arrays.rules /usr/lib/udev/rules.d/64-md-raid-assembly.rules /usr/lib/udev/rules.d/69-md-clustered-confirm-device.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
mdevctl-1.4.0-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/mdevctl-1.4.0-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/60-mdevctl.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
memcached-1.6.45-alt1.src |
specfile-useradd-n |
warn |
-n in useradd is compat option and can be removed any time. Use -N instead. |
|
shaba |
minio-2025.10.15-alt3.src |
specfile-useradd-n |
warn |
-n in useradd is compat option and can be removed any time. Use -N instead. |
|
shaba |
minio-2025.10.15-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
moosefs-chunkserver-4.59.2-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/moosefs-chunkserver-4.59.2-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/80-moosefs-chunkserver.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
mstflint-4.37.0.1-alt1.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
multipath-tools-0.14.3-alt1.x86_64 |
init-lsb |
fail |
/etc/rc.d/init.d/multipathd: not systemd compatible: lsb init header missing and multipathd.service is not present. See http://www.altlinux.org/Services_Policy for details. |
|
shaba |
multipath-tools-0.14.3-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/multipath-tools-0.14.3-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/multipath.conf sisyphus_check: check-fhs ERROR: FHS violation /ALT/Sisyphus/files/x86_64/RPMS/multipath-tools-0.14.3-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/11-dm-mpath.rules /usr/lib/udev/rules.d/11-dm-parts.rules /usr/lib/udev/rules.d/56-multipath.rules /usr/lib/udev/rules.d/68-del-part-nodes.rules /usr/lib/udev/rules.d/99-z-dm-mpath-late.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
netavark-1.17.2-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
nfs-ganesha-9.9-alt1.x86_64 |
altlinux-policy-shared-lib-contains-devel-so |
info |
SharedLibs Policy Draft violation: Shared Lib package should not contain symlink /usr/lib64/libganesha_nfsd.so but just /usr/lib64/libganesha_nfsd.so.9.9. According to SharedLibs Policy Draft, symlink /usr/lib64/libganesha_nfsd.so should be placed in a special subpackage named lib-devel. If you have already packaged this symlink in lib-devel, just append \%exclude /usr/lib64/libganesha_nfsd.so to \%files of nfs-ganesha-9.9-alt1.x86_64. Otherwise, move the symlink into the subpackage lib-devel. There is a known exception for case the .so file is not a shared lib but a plugin that is never directly linked with. Please report such a case to repocop test. |
|
shaba |
nfs-ganesha-9.9-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
nmstate-2.2.60-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
open-iscsi-2.1.11-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/open-iscsi-2.1.11-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/iscsi.conf sisyphus_check: check-fhs ERROR: FHS violation /ALT/Sisyphus/files/x86_64/RPMS/open-iscsi-2.1.11-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/50-iscsi-firmware-login.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
open-iscsi-iscsiuio-2.1.11-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
open-vm-tools-13.1.0-alt2.x86_64 |
big-changelog |
info |
Package contains big ChangeLog. Gzip it. |
|
shaba |
open-vm-tools-13.1.0-alt2.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/open-vm-tools-13.1.0-alt2.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/open-vm-tools-vgauthd.conf sisyphus_check: check-fhs ERROR: FHS violation /ALT/Sisyphus/files/x86_64/RPMS/open-vm-tools-13.1.0-alt2.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/90-vmware-guest-tools.rules /usr/lib/udev/rules.d/98-open-vm-tools.rules /usr/lib/udev/rules.d/99-vmware-scsi-udev.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
open-vm-tools-13.1.0-alt2.x86_64 |
subdir-in-var-run |
info |
Found a subdir in /var/run or /var/lock. /var/run and /var/lock may be mounted as temporary filesystems, so the init.d scripts must handle this correctly. This will typically amount to creating any required subdirectories dynamically when the init.d script is run, rather than including them in the package and relying on rpm to create them. |
|
shaba |
open-vm-tools-desktop-13.1.0-alt2.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/open-vm-tools-desktop-13.1.0-alt2.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/open-vm-tools-desktop.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
opennebula-context-7.2.1-alt2.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/opennebula-context-7.2.1-alt2.noarch.rpm: invalid udev rules path: /usr/lib/udev/rules.d/65-context.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
opennebula-context-7.2.1-alt2.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
openuds-actor-4.0.0-alt1.noarch |
freedesktop-categories |
warn |
Menu-related Additional Categories (http://standards.freedesktop.org/menu-spec/latest/apa.html) not found in /usr/share/applications/UDS_Actor_Configuration.desktop. Please add it or report a bug against this test if you already have registered one (not including menu unrelated ones as Core or Qt). |
|
shaba |
openuds-actor-4.0.0-alt1.noarch |
freedesktop-desktop |
info |
desktop-file-validate utility printed the following message(s): /usr/share/applications/UDS_Actor_Configuration.desktop: hint: value "Settings;System;" for key "Categories" in group "Desktop Entry" contains more than one main category; application might appear more than once in the application menu |
|
shaba |
openuds-client-4.0.0-alt2.noarch |
freedesktop-categories |
warn |
Menu-related Additional Categories (http://standards.freedesktop.org/menu-spec/latest/apa.html) not found in /usr/share/applications/UDSClient.desktop. Please add it or report a bug against this test if you already have registered one (not including menu unrelated ones as Core or Qt). |
|
shaba |
openuds-server-4.0.0-alt9.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
openuds-server-nginx-4.0.0-alt9.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/openuds-server-nginx-4.0.0-alt9.noarch.rpm: Invalid path names: /usr/lib/tmpfiles.d/openuds.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
openuds-server-nginx-4.0.0-alt9.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
openuds-tunnel-4.0.0-alt1.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ovirt-imageio-daemon-2.4.7-alt1.1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ovirt-vmconsole-host-1.0.9-alt1.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ovirt-vmconsole-proxy-1.0.9-alt1.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ovn-24.03.5-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/ovn-24.03.5-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/ovn.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
ovn-central-24.03.5-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ovn-host-24.03.5-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
ovn-vtep-24.03.5-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
pcsc-lite-2.5.3-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/pcsc-lite-2.5.3-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/pcsc-lite.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
pgbouncer-1.26.1-alt1.x86_64 |
init-lsb |
fail |
/etc/rc.d/init.d/pgbouncer: not systemd compatible: lsb init header missing and pgbouncer.service is not present. See http://www.altlinux.org/Services_Policy for details. |
|
shaba |
pgbouncer-1.26.1-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/pgbouncer-1.26.1-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/pgbouncer.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
podman-5.8.5-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/podman-5.8.5-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/podman.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
podman-5.8.5-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
podman-docker-5.8.5-alt1.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/podman-docker-5.8.5-alt1.noarch.rpm: Invalid path names: /usr/lib/tmpfiles.d/podman-docker.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
postgresql14-repmgr-5.5.0-alt5.x86_64 |
init-lsb |
fail |
/etc/rc.d/init.d/repmgr: not systemd compatible: lsb init header missing and repmgr.service is not present. See http://www.altlinux.org/Services_Policy for details. |
|
shaba |
postgresql14-repmgr-5.5.0-alt5.x86_64 |
rpm-filesystem-conflict-file-file |
warn |
There are file conflicts with the package postgresql18-repmgr-5.5.0-alt5.x86_64, for example, /usr/bin/repmgr (4 file conflicts in total). Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives.
s.
ternatives. |
|
shaba |
postgresql14-repmgr-5.5.0-alt5.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/postgresql14-repmgr-5.5.0-alt5.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/repmgr.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
postgresql15-repmgr-5.5.0-alt5.x86_64 |
init-lsb |
fail |
/etc/rc.d/init.d/repmgr: not systemd compatible: lsb init header missing and repmgr.service is not present. See http://www.altlinux.org/Services_Policy for details. |
|
shaba |
postgresql15-repmgr-5.5.0-alt5.x86_64 |
rpm-filesystem-conflict-file-file |
warn |
Files /usr/bin/repmgr /usr/bin/repmgrd /usr/lib64/pgsql/bitcode/repmgr/repmgr.bc conflict with the package postgresql18-repmgr-5.5.0-alt5.x86_64. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives.
s.
ves. |
|
shaba |
postgresql15-repmgr-5.5.0-alt5.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/postgresql15-repmgr-5.5.0-alt5.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/repmgr.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
pptpd-1.5.0-alt1.x86_64 |
init-lsb |
fail |
/etc/rc.d/init.d/pptpd: not systemd compatible: lsb init header missing and pptpd.service is not present. See http://www.altlinux.org/Services_Policy for details. |
|
shaba |
prometheus-common-3.15.0-alt1.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/prometheus-common-3.15.0-alt1.noarch.rpm: Invalid path names: /usr/lib/tmpfiles.d/prometheus.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
prometheus-foomuuri-exporter-0.33-alt1.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
promtail-3.6.7-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
proxmox-acme-1.7.1-alt1.x86_64 |
arch-dep-package-consists-of-usr-share |
info |
The package consists of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
proxmox-backup-server-4.2.0.1-alt2.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/proxmox-backup-server-4.2.0.1-alt2.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/60-proxmox-backup-server.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
proxmox-backup-server-4.2.0.1-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
proxmox-widget-toolkit-5.2.6-alt1.x86_64 |
arch-dep-package-consists-of-usr-share |
info |
The package consists of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
pve-backup-restore-image-0.5-alt1.x86_64 |
file-in-usr-marked-as-conffile |
warn |
Files below /usr may not be marked as conffiles, since
/usr might be mounted read-only and thus, the local system
administrator would not have a chance to modify this configuration
file. |
|
shaba |
pve-backup-restore-image-0.5-alt1.x86_64 |
missing-url |
info |
Missing Url: in a package. |
|
shaba |
pve-backup-restore-image-0.5-alt1.x86_64 |
rpm-package-is-obsoleted |
warn |
The package is obsoleted by the package proxmox-backup-restore-image-4.2.0.1-alt2.x86_64, but is still alive and in the repository. Consider removing the package, or, if you want the package to be alive, ask the maintainer of proxmox-backup-restore-image-4.2.0.1-alt2.x86_64 to remove Obsoletes: tag. |
|
shaba |
pve-cluster-9.1.6-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
pve-common-9.1.18-alt3.x86_64 |
arch-dep-package-consists-of-usr-share |
info |
The package consists of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
pve-container-6.1.11-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
pve-firewall-6.0.5-alt4.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/pve-firewall-6.0.5-alt4.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/pve-firewall.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
pve-firewall-6.0.5-alt4.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
pve-ha-manager-5.2.4-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
pve-lxc-7.0.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
pve-manager-9.2.5-alt6.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
pve-manager-9.2.5-alt6.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/pve-manager-9.2.5-alt6.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/pve-manager.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
pve-manager-9.2.5-alt6.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
pve-qemu-common-10.2.2-alt1.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
pve-qemu-common-10.2.2-alt1.x86_64 |
rpm-filesystem-conflict-file-file |
warn |
File /usr/share/qemu/trace-events-all conflicts with the package qemu-tools-10.2.4-alt2.x86_64. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives. |
|
shaba |
pve-qemu-server-9.2.0-alt3.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/pve-qemu-server-9.2.0-alt3.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/qemu-server.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
pve-qemu-server-9.2.0-alt3.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
pve-qemu-system-10.2.2-alt1.x86_64 |
rpm-filesystem-conflict-file-file |
warn |
File /usr/bin/qemu-vmsr-helper conflicts with the package qemu-vmsr-helper-10.2.4-alt2.x86_64. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives.
using alternatives.
ernatives. |
|
shaba |
pve-storage-9.1.6-alt2.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/pve-storage-9.1.6-alt2.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/50-rbd-pve.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
pve-xtermjs-6.0.0.2-alt1.x86_64 |
arch-dep-package-consists-of-usr-share |
info |
The package consists of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
qemu-common-10.2.4-alt2.x86_64 |
rpm-filesystem-conflict-file-file |
warn |
Files /usr/libexec/qemu-bridge-helper /usr/share/man/man1/qemu.1.xz conflict with the package pve-qemu-system-10.2.2-alt1.x86_64. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives. |
|
shaba |
qemu-device-display-vhost-user-gpu-10.2.4-alt2.x86_64 |
rpm-filesystem-conflict-file-file |
warn |
File /usr/libexec/vhost-user-gpu conflicts with the package pve-qemu-system-10.2.2-alt1.x86_64. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives. |
|
shaba |
qemu-guest-agent-10.2.4-alt2.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/qemu-guest-agent-10.2.4-alt2.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/90-qemu-guest-agent.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
qemu-pr-helper-10.2.4-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
qemu-system-ppc-core-10.2.4-alt2.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
qemu-tools-10.2.4-alt2.x86_64 |
rpm-filesystem-conflict-file-file |
warn |
File /usr/share/qemu/trace-events-all conflicts with the package pve-qemu-common-10.2.2-alt1.x86_64. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives. |
|
shaba |
qemu-vmsr-helper-10.2.4-alt2.x86_64 |
rpm-filesystem-conflict-file-file |
warn |
File /usr/bin/qemu-vmsr-helper conflicts with the package pve-qemu-system-10.2.2-alt1.x86_64. Moreover, the packages have no explicit conflicts with each other. You should add explicit conflicts, or, if conflicts are avoidable, consider using alternatives. |
|
shaba |
qemu-vmsr-helper-10.2.4-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
rbd-mirror-19.2.3-alt5.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
rdma-core-62.0-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/rdma-core-62.0-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/60-rdma-ndd.rules /usr/lib/udev/rules.d/60-rdma-persistent-naming.rules /usr/lib/udev/rules.d/75-rdma-description.rules /usr/lib/udev/rules.d/90-rdma-hw-modules.rules /usr/lib/udev/rules.d/90-rdma-ulp-modules.rules /usr/lib/udev/rules.d/90-rdma-umad.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
resource-agents-4.18.0-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/resource-agents-4.18.0-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/resource-agents.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
resource-agents-4.18.0-alt1.x86_64 |
unsafe-tmp-usage-in-scripts |
fail |
The test discovered scripts with errors which may be used by a user for damaging important system files. For example if a script uses in its work a temp file which is created in /tmp directory, then every user can create symlinks with the same name (pattern) in this directory in order to destroy or rewrite some system or another user's files. Scripts _must_ _use_ mktemp/tempfile or must use $TMPDIR. mktemp/tempfile is safest. $TMPDIR is safer than /tmp/ because libpam-tmpdir creates a subdirectory of /tmp that is only accessible by that user, and then sets TMPDIR and other variables to that. Hence, it doesn't matter nearly as much if you create a non-random filename, because nobody but you can access it. Found error in /usr/lib/ocf/resource.d/heartbeat/rabbitmq-server-ha: $ grep /tmp/ /usr/lib/ocf/resource.d/heartbeat/rabbitmq-server-ha The debug flag for agent (${OCF_RESKEY_binary}) instance. In the /tmp/ directory will be created rmq-* files for log some operations and ENV values inside OCF-script. AMQP server (${OCF_RESKEY_binary}) debug flag local rc=$OCF_ERR_GENERIC local LH="${LL} monitor:" ocf_log debug "${LH} action start." if ocf_is_true "${OCF_RESKEY_debug}"; then d=`date '+%Y%m%d %H:%M:%S'` echo $d >> /tmp/rmq-monitor.log env >> /tmp/rmq-monitor.log echo "$d [monitor] start='${OCF_RESKEY_CRM_meta_notify_start_uname}' stop='${OCF_RESKEY_CRM_meta_notify_stop_uname}' active='${OCF_RESKEY_CRM_meta_notify_active_uname}' inactive='${OCF_RESKEY_CRM_meta_notify_inactive_uname}'" >> /tmp/rmq-ocf.log fi get_monitor rc=$? ocf_log debug "${LH} role: ${OCF_RESKEY_CRM_meta_role}" ocf_log debug "${LH} result: $rc" -- local LH="${LL} start:" local nowtime if ocf_is_true "${OCF_RESKEY_debug}"; then d=`date '+%Y%m%d %H:%M:%S'` echo $d >> /tmp/rmq-start.log env >> /tmp/rmq-start.log echo "$d [start] start='${OCF_RESKEY_CRM_meta_notify_start_uname}' stop='${OCF_RESKEY_CRM_meta_notify_stop_uname}' active='${OCF_RESKEY_CRM_meta_notify_active_uname}' inactive='${OCF_RESKEY_CRM_meta_notify_inactive_uname}'" >> /tmp/rmq-ocf.log fi ocf_log info "${LH} action begin." get_status -- local rc=$OCF_ERR_GENERIC local LH="${LL} stop:" if ocf_is_true "${OCF_RESKEY_debug}"; then d=$(date '+%Y%m%d %H:%M:%S') echo $d >> /tmp/rmq-stop.log env >> /tmp/rmq-stop.log echo "$d [stop] start='${OCF_RESKEY_CRM_meta_notify_start_uname}' stop='${OCF_RESKEY_CRM_meta_notify_stop_uname}' active='${OCF_RESKEY_CRM_meta_notify_active_uname}' inactive='${OCF_RESKEY_CRM_meta_notify_inactive_uname}'" >> /tmp/rmq-ocf.log fi ocf_log info "${LH} action begin." ocf_log info "${LH} Deleting master attribute" -- local LH="${LL} notify:" local nodelist if ocf_is_true "${OCF_RESKEY_debug}"; then d=`date '+%Y%m%d %H:%M:%S'` echo $d >> /tmp/rmq-notify.log env >> /tmp/rmq-notify.log echo "$d [notify] ${OCF_RESKEY_CRM_meta_notify_type}-${OCF_RESKEY_CRM_meta_notify_operation} promote='${OCF_RESKEY_CRM_meta_notify_promote_uname}' demote='${OCF_RESKEY_CRM_meta_notify_demote_uname}' master='${OCF_RESKEY_CRM_meta_notify_master_uname}' slave='${OCF_RESKEY_CRM_meta_notify_slave_uname}' start='${OCF_RESKEY_CRM_meta_notify_start_uname}' stop='${OCF_RESKEY_CRM_meta_notify_stop_uname}' active='${OCF_RESKEY_CRM_meta_notify_active_uname}' inactive='${OCF_RESKEY_CRM_meta_notify_inactive_uname}'" >> /tmp/rmq-ocf.log fi if [ "${OCF_RESKEY_CRM_meta_notify_type}" = 'post' ] ; then # POST- anything notify section case "$OCF_RESKEY_CRM_meta_notify_operation" in -- local rc=$OCF_ERR_GENERIC local LH="${LL} promote:" if ocf_is_true "${OCF_RESKEY_debug}"; then d=$(date '+%Y%m%d %H:%M:%S') echo $d >> /tmp/rmq-promote.log env >> /tmp/rmq-promote.log echo "$d [promote] start='${OCF_RESKEY_CRM_meta_notify_start_uname}' stop='${OCF_RESKEY_CRM_meta_notify_stop_uname}' active='${OCF_RESKEY_CRM_meta_notify_active_uname}' inactive='${OCF_RESKEY_CRM_meta_notify_inactive_uname}'" >> /tmp/rmq-ocf.log fi ocf_log info "${LH} action begin." get_monitor |
|
shaba |
rsyslog-8.2502.0-alt4.1.x86_64 |
big-changelog |
info |
Package contains big ChangeLog. Gzip it. |
|
shaba |
rygel-46.1-alt1.x86_64 |
freedesktop-categories |
warn |
Menu-related Additional Categories (http://standards.freedesktop.org/menu-spec/latest/apa.html) not found in /usr/share/applications/rygel-preferences.desktop. Please add it or report a bug against this test if you already have registered one (not including menu unrelated ones as Core or Qt). |
|
shaba |
sanlock-4.2.0-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/sanlock-4.2.0-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/sanlock.conf /usr/lib/tmpfiles.d/wdmd.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
shorewall6-5.2.8-alt2.noarch |
uncompressed-manpages |
info |
Package contains uncompressed manual pages. |
|
shaba |
snapd-2.66.1-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/snapd-2.66.1-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/snapd.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
snapd-2.66.1-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
spice-vdagent-0.23.0-alt7.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/spice-vdagent-0.23.0-alt7.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/spice-vdagentd.conf sisyphus_check: check-fhs ERROR: FHS violation /ALT/Sisyphus/files/x86_64/RPMS/spice-vdagent-0.23.0-alt7.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/70-spice-vdagentd.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
spice-vdagent-0.23.0-alt7.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
squid-7.7-alt2.x86_64 |
init-lsb |
fail |
/etc/rc.d/init.d/squid: not systemd compatible: lsb init header missing and squid.service is not present. See http://www.altlinux.org/Services_Policy for details. |
|
shaba |
squid-7.7-alt2.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/squid-7.7-alt2.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/squid.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
squid-7.7-alt2.x86_64 |
subdir-in-var-run |
info |
Found a subdir in /var/run or /var/lock. /var/run and /var/lock may be mounted as temporary filesystems, so the init.d scripts must handle this correctly. This will typically amount to creating any required subdirectories dynamically when the init.d script is run, rather than including them in the package and relying on rpm to create them. |
|
shaba |
squid-doc-7.7-alt2.noarch |
big-changelog |
info |
Package contains big ChangeLog. Gzip it. |
|
shaba |
srp_daemon-62.0-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/srp_daemon-62.0-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/60-srp_daemon.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
systemd-262-alt1.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
systemd-262-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/systemd-262-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/20-systemd-osc-context.conf /usr/lib/tmpfiles.d/20-systemd-shell-extra.conf /usr/lib/tmpfiles.d/20-systemd-ssh-generator.conf /usr/lib/tmpfiles.d/20-systemd-stub.conf /usr/lib/tmpfiles.d/20-systemd-userdb.conf /usr/lib/tmpfiles.d/20-systemd-varlink.conf /usr/lib/tmpfiles.d/README /usr/lib/tmpfiles.d/credstore.conf /usr/lib/tmpfiles.d/journal-nocow.conf /usr/lib/tmpfiles.d/provision.conf /usr/lib/tmpfiles.d/root.conf /usr/lib/tmpfiles.d/systemd-nologin.conf /usr/lib/tmpfiles.d/systemd-pstore.conf /usr/lib/tmpfiles.d/systemd-tmp.conf /usr/lib/tmpfiles.d/systemd.conf sisyphus_check: check-fhs ERROR: FHS violation /ALT/Sisyphus/files/x86_64/RPMS/systemd-262-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/70-uaccess.rules /usr/lib/udev/rules.d/71-seat.rules /usr/lib/udev/rules.d/73-seat-late.rules /usr/lib/udev/rules.d/90-vconsole.rules /usr/lib/udev/rules.d/99-systemd.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
systemd-container-262-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/systemd-container-262-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/systemd-nspawn.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
systemd-networkd-262-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/systemd-networkd-262-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/systemd-network.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
systemd-portable-262-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/systemd-portable-262-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/portables.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
systemd-stateless-262-alt1.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/systemd-stateless-262-alt1.noarch.rpm: Invalid path names: /usr/lib/tmpfiles.d/etc.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
systemd-tests-262-alt1.x86_64 |
unsafe-tmp-usage-in-scripts |
fail |
The test discovered scripts with errors which may be used by a user for damaging important system files. For example if a script uses in its work a temp file which is created in /tmp directory, then every user can create symlinks with the same name (pattern) in this directory in order to destroy or rewrite some system or another user's files. Scripts _must_ _use_ mktemp/tempfile or must use $TMPDIR. mktemp/tempfile is safest. $TMPDIR is safer than /tmp/ because libpam-tmpdir creates a subdirectory of /tmp that is only accessible by that user, and then sets TMPDIR and other variables to that. Hence, it doesn't matter nearly as much if you create a non-random filename, because nobody but you can access it. Found error in /usr/lib/systemd/tests/testdata/units/TEST-92-TPM2-SWTPM.sh: $ grep /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-92-TPM2-SWTPM.sh case "$REBOOT_COUNT" in 0) assert_swtpm_up # Seal a secret to the software TPM and keep the blob for the next boot. echo "$PLAINTEXT" >/tmp/swtpm-plaintext systemd-creds encrypt /tmp/swtpm-plaintext "$CRED" systemd-creds decrypt "$CRED" - | cmp /tmp/swtpm-plaintext - systemctl_final reboot exec sleep infinity ;; 1) assert_swtpm_up # Persistence: the TPM state survived the reboot on the ESP, so the blob still unseals. echo "$PLAINTEXT" >/tmp/swtpm-plaintext systemd-creds decrypt "$CRED" - | cmp /tmp/swtpm-plaintext - # Mimic a manufacture interrupted after swtpm began writing TPM state but before the marker: stop # swtpm, drop everything except the three config files, then leave a partial/corrupt state file # behind. swtpm_setup would refuse to recreate that, so recovery must clear it first. statedir="$(swtpm_state_dir)" # Regression test for keying re-manufacture off an incomplete state directory. assert_swtpm_up statedir="$(swtpm_state_dir)" test -e "$statedir/$MARKER" test -e "$statedir/issuer-certificate.pem" echo -n "$PLAINTEXT" >/tmp/swtpm-plaintext systemd-creds --tpm2-device="$TPM2_DEVICE" encrypt --name= --with-key=tpm2 /tmp/swtpm-plaintext /tmp/swtpm-new.cred systemd-creds --tpm2-device="$TPM2_DEVICE" decrypt --name= /tmp/swtpm-new.cred - | cmp /tmp/swtpm-plaintext - touch /testok ;; *) assert_not_reached ;; Found error in /usr/lib/systemd/tests/testdata/units/TEST-90-RESTRICT-FSACCESS.enforce.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-90-RESTRICT-FSACCESS.enforce.sh at_exit() { set +e # Kill the attach helper to detach BPF programs synchronously [[ -n "${HELPER_PID:-}" ]] && kill "$HELPER_PID" 2>/dev/null && wait "$HELPER_PID" 2>/dev/null || true # Clean up tmpfs test directories umount /tmp/restrict-fsaccess-test 2>/dev/null || true rm -rf /tmp/restrict-fsaccess-test umount /tmp/restrict-fsaccess-baseline 2>/dev/null || true rm -rf /tmp/restrict-fsaccess-baseline # Clean up overlay test mounts umount /tmp/restrict-fsaccess-overlay/merged 2>/dev/null || true umount /tmp/restrict-fsaccess-overlay/rw 2>/dev/null || true systemd-dissect --umount /tmp/restrict-fsaccess-overlay/lower 2>/dev/null || true rm -rf /tmp/restrict-fsaccess-overlay # Clean up background processes [[ -n "${SLEEP_PID:-}" ]] && kill "$SLEEP_PID" 2>/dev/null || true rm -rf /tmp/restrict-fsaccess-attach.out } trap at_exit EXIT # ------ Preconditions: helper "check" must agree with the cmdline ------ # "check" runs the same gates as PID1: BPF LSM, require_signatures, -- # (or busybox) as a multicall binary, /usr/bin/true is a symlink and cp # dereferences it, copying the multicall binary. The dispatcher selects the # subcommand from basename(argv[0]), so the copy only behaves as true when # invoked under that name. mkdir -p /tmp/restrict-fsaccess-baseline mount -t tmpfs tmpfs /tmp/restrict-fsaccess-baseline cp /usr/bin/true /tmp/restrict-fsaccess-baseline/true chmod +x /tmp/restrict-fsaccess-baseline/true if ! /tmp/restrict-fsaccess-baseline/true 2>/dev/null; then echo "WARNING: tmpfs exec blocked BEFORE BPF attach (another LSM?)" >&2 echo "Skipping enforcement test, baseline tmpfs exec fails" umount /tmp/restrict-fsaccess-baseline; rm -rf /tmp/restrict-fsaccess-baseline exit 77 fi echo "Baseline: tmpfs exec works without BPF" umount /tmp/restrict-fsaccess-baseline; rm -rf /tmp/restrict-fsaccess-baseline # ------ Attach BPF with rootfs trusted ------ # The helper attaches, prints map/prog/link IDs, then blocks holding FDs. # Kill it to detach synchronously (close() drops last ref via bpf_link_put_direct). -- # Read helper output line by line until LINK_IDS= (the last line before pause()). # read -t 60 handles both timeout and helper crash (EOF on death). while IFS= read -r -t 60 line <&3; do echo "$line" [[ "$line" == LINK_IDS=* ]] && break done >/tmp/restrict-fsaccess-attach.out VERITY_MAP_ID=$(sed -n 's/^VERITY_MAP_ID=//p' /tmp/restrict-fsaccess-attach.out) BSS_MAP_ID=$(sed -n 's/^BSS_MAP_ID=//p' /tmp/restrict-fsaccess-attach.out) PROG_IDS=$(sed -n 's/^PROG_IDS="\(.*\)"$/\1/p' /tmp/restrict-fsaccess-attach.out) LINK_IDS=$(sed -n 's/^LINK_IDS="\(.*\)"$/\1/p' /tmp/restrict-fsaccess-attach.out) [[ -n "$VERITY_MAP_ID" ]] || { echo "ERROR: Failed to capture VERITY_MAP_ID from helper output" >&2; exit 1; } [[ -n "$BSS_MAP_ID" ]] || { echo "ERROR: Failed to capture BSS_MAP_ID from helper output" >&2; exit 1; } [[ -n "$PROG_IDS" ]] || { echo "ERROR: Failed to capture PROG_IDS from helper output" >&2; exit 1; } [[ -n "$LINK_IDS" ]] || { echo "ERROR: Failed to capture LINK_IDS from helper output" >&2; exit 1; } -- /usr/bin/true echo "Rootfs execution: OK" # ------ Test: Execution from tmpfs is blocked ------ mkdir -p /tmp/restrict-fsaccess-test mount -t tmpfs tmpfs /tmp/restrict-fsaccess-test # Copy a binary to tmpfs. Basename must stay "true" for multicall coreutils # binaries (uutils, busybox) — see the baseline comment above. cp /usr/bin/true /tmp/restrict-fsaccess-test/true chmod +x /tmp/restrict-fsaccess-test/true # This should fail with EPERM if /tmp/restrict-fsaccess-test/true 2>/dev/null; then echo "ERROR: Execution from tmpfs should have been blocked!" >&2 exit 1 fi echo "Execution from tmpfs blocked: OK" # ------ Test: PROT_EXEC mmap from tmpfs is blocked (mmap_file hook) ------ # Write a test file on the tmpfs mount for mmap/mprotect tests dd if=/dev/zero of=/tmp/restrict-fsaccess-test/testfile bs=4096 count=1 2>/dev/null # File-backed PROT_EXEC mmap should be denied (with EPERM, see expect_probe). expect_probe 1 "PROT_EXEC mmap of tmpfs file" mmap-exec /tmp/restrict-fsaccess-test/testfile echo "PROT_EXEC mmap from tmpfs blocked: OK" # Anonymous PROT_EXEC mmap should be denied (NULL file — mmap_file hook) expect_probe 1 "anonymous PROT_EXEC mmap" anon-mmap-exec echo "Anonymous PROT_EXEC mmap blocked: OK" # ------ Test: mprotect adding PROT_EXEC is blocked (file_mprotect hook) ------ # mmap PROT_READ then mprotect to PROT_EXEC — the file_mprotect hook should deny this. expect_probe 1 "mprotect PROT_EXEC on tmpfs file" mprotect-exec /tmp/restrict-fsaccess-test/testfile echo "mprotect PROT_EXEC from tmpfs blocked: OK" # ------ Test: W^X on a trusted file (mmap_file + file_mprotect hooks) ------ # /usr/bin/true lives on the trusted rootfs, so a denial here is due to the # W^X rules, not provenance. -- if bpftool btf dump file /sys/kernel/btf/vmlinux 2>/dev/null | grep "FUNC 'bpf_real_data_inode'" >/dev/null; then KERNEL_HAS_REAL_DATA_INODE=1 fi # The loader's BTF probe must agree with the kernel BTF HAVE_RDI="$(sed -n 's/^HAVE_REAL_DATA_INODE=//p' /tmp/restrict-fsaccess-attach.out)" if [[ "$HAVE_RDI" != "$KERNEL_HAS_REAL_DATA_INODE" ]]; then echo "ERROR: Loader probed have_real_data_inode=$HAVE_RDI but kernel BTF says $KERNEL_HAS_REAL_DATA_INODE!" >&2 exit 1 fi if machine_supports_verity_keyring; then OVL=/tmp/restrict-fsaccess-overlay mkdir -p "$OVL"/{lower,rw,merged} systemd-dissect --mount "$MINIMAL.raw" "$OVL/lower" mount -t tmpfs tmpfs "$OVL/rw" mkdir -p "$OVL/rw/upper" "$OVL/rw/work" # metacopy=off: a metadata-only copy-up would keep the data — and -- kill "$HELPER_PID" wait "$HELPER_PID" 2>/dev/null || true HELPER_PID= echo "Helper killed, BPF programs detached synchronously" if [[ -x /tmp/restrict-fsaccess-test/true ]]; then /tmp/restrict-fsaccess-test/true echo "Execution from tmpfs after detach: OK" fi umount /tmp/restrict-fsaccess-test 2>/dev/null || true rm -rf /tmp/restrict-fsaccess-test echo "All enforcement tests passed" Found error in /usr/lib/systemd/tests/testdata/units/TEST-90-RESTRICT-FSACCESS.dm-verity-keyring.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-90-RESTRICT-FSACCESS.dm-verity-keyring.sh echo "Provisioned .dm-verity keyring with mkosi.crt" at_exit() { set +e [[ -n "${HELPER_PID:-}" ]] && kill "$HELPER_PID" 2>/dev/null && wait "$HELPER_PID" 2>/dev/null || true rm -rf /tmp/restrict-fsaccess-dvk-attach.out } trap at_exit EXIT HELPER_PID= exec 3< <(exec "$HELPER" attach) HELPER_PID=$! while IFS= read -r -t 60 line <&3; do echo "$line" [[ "$line" == LINK_IDS=* ]] && break done >/tmp/restrict-fsaccess-dvk-attach.out # Fail closed if helper died before printing the full handshake: an unattached # program would let the subsequent verity exec test pass trivially. if ! kill -0 "$HELPER_PID" 2>/dev/null; then echo "ERROR: helper exited before BPF programs were attached" >&2 exit 1 fi grep -E '^LINK_IDS="[^"]+"' /tmp/restrict-fsaccess-dvk-attach.out >/dev/null || { echo "ERROR: helper did not report LINK_IDS, BPF programs not attached" >&2 exit 1 } # Run a binary off the signed minimal_0 verity image. Trust path is exclusively Found error in /usr/lib/systemd/tests/testdata/units/TEST-88-UPGRADE.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-88-UPGRADE.sh if command -v udevadm >/dev/null && systemctl is-active --quiet systemd-udevd.service; then udev=1 fi : >/tmp/failed-units if [[ $($unitscmd --output json | jq length) -gt 0 ]]; then echo 'Systemd failed units found before the test:' $unitscmd $unitscmd --output json | jq -r '.[].unit' >/tmp/failed-units fi save_unit_state() { local snapshot_failed="" trigger_list unit local unit_files=/tmp/unit-files-before-package-operation.json local units=/tmp/units-before-package-operation.json local -a state_files=(/tmp/active-units /tmp/preexisting-units /tmp/triggered-units) local -a triggers rm -f "${state_files[@]}" "$unit_files" "$units" if ! systemctl list-units --all '*systemd*' --output json >"$units" || ! systemctl list-unit-files '*systemd*' --output json >"$unit_files" || ! jq -r '.[].unit' "$units" >/tmp/preexisting-units || ! jq -r '.[].unit_file' "$unit_files" >>/tmp/preexisting-units || ! jq -r ' .[] | select(.active == "active" or .active == "activating" or .active == "reloading") | .unit ' "$units" >/tmp/active-units; then echo 'Failed to save unit state before package operation, unit retries will be skipped.' snapshot_failed=1 fi if [[ -z $snapshot_failed ]]; then : >/tmp/triggered-units while read -r unit; do if ! trigger_list=$(systemctl show -P Triggers "$unit"); then echo 'Failed to save unit triggers before package operation, unit retries will be skipped.' snapshot_failed=1 break fi if [[ -n $trigger_list ]]; then read -ra triggers <<<"$trigger_list" printf '%s\n' "${triggers[@]}" >>/tmp/triggered-units fi done /tmp/restart-units : >/tmp/retry-units for unit in $($unitscmd --output json | jq -r '.[].unit'); do if grep -sxqF "$unit" /tmp/failed-units; then continue fi if ! grep -sxqF "$unit" /tmp/active-units && ! grep -sxqF "$unit" /tmp/triggered-units && grep -sxqF "$unit" /tmp/preexisting-units; then continue fi if ! load_state=$(systemctl show -P LoadState "$unit"); then fail=1 -- if ! systemctl reset-failed "$unit"; then fail=1 continue fi if grep -sxqF "$unit" /tmp/active-units || ! grep -sxqF "$unit" /tmp/preexisting-units; then echo "$unit" >>/tmp/restart-units else echo "$unit" >>/tmp/retry-units fi done while read -r unit; do if ! systemctl start "$unit"; then fail=1 systemctl status "$unit" || true fi done /tmp/validatefs-test/validatefs-root.conf </tmp/validatefs-test/validatefs-usr.conf </tmp/validatefs-test/validatefs-usr-verity.conf </tmp/validatefs-test/validatefs-home.conf </tmp/validatefs-test/validatefs-esp.conf </tmp/validatefs-test/validatefs-generic.conf </dev/null getfattr --dump /tmp/validatefs-test.mount/ | grep user.validatefs.gpt_label=\"kromm\" >/dev/null getfattr --dump /tmp/validatefs-test.mount/ | grep user.validatefs.mount_point=\"/\" >/dev/null /usr/lib/systemd/systemd-validatefs --root=/tmp/validatefs-test.mount /tmp/validatefs-test.mount/ (! /usr/lib/systemd/systemd-validatefs /tmp/validatefs-test.mount/ ) getfattr --dump /tmp/validatefs-test.mount/usr getfattr --dump /tmp/validatefs-test.mount/usr | grep user.validatefs.gpt_type_uuid='".*\\000.*"' >/dev/null getfattr --dump /tmp/validatefs-test.mount/usr | grep user.validatefs.gpt_label='"plisch\\000plisch-verity"' >/dev/null getfattr --dump /tmp/validatefs-test.mount/usr | grep user.validatefs.mount_point=\"/usr\" >/dev/null /usr/lib/systemd/systemd-validatefs --root=/tmp/validatefs-test.mount /tmp/validatefs-test.mount/usr (! /usr/lib/systemd/systemd-validatefs /tmp/validatefs-test.mount/usr ) getfattr --dump /tmp/validatefs-test.mount/home getfattr --dump /tmp/validatefs-test.mount/home | grep user.validatefs.gpt_type_uuid= >/dev/null getfattr --dump /tmp/validatefs-test.mount/home | grep user.validatefs.gpt_label=\"rupft\" >/dev/null getfattr --dump /tmp/validatefs-test.mount/home | grep user.validatefs.mount_point=\"/home\" >/dev/null /usr/lib/systemd/systemd-validatefs --root=/tmp/validatefs-test.mount /tmp/validatefs-test.mount/home (! /usr/lib/systemd/systemd-validatefs /tmp/validatefs-test.mount/home ) getfattr --dump /tmp/validatefs-test.mount/efi (! getfattr --dump /tmp/validatefs-test.mount/efi | grep user.validatefs.gpt_type_uuid= >/dev/null ) (! getfattr --dump /tmp/validatefs-test.mount/efi | grep user.validatefs.gpt_label= >/dev/null ) (! getfattr --dump /tmp/validatefs-test.mount/efi | grep user.validatefs.mount_point= >/dev/null ) /usr/lib/systemd/systemd-validatefs --root=/tmp/validatefs-test.mount /tmp/validatefs-test.mount/efi /usr/lib/systemd/systemd-validatefs /tmp/validatefs-test.mount/efi # the generic one we must mount by hand mkdir -p /tmp/validatefs-test.mount/somewhere/else udevadm wait --settle --timeout=30 /dev/disk/by-label/qnurx mount /dev/disk/by-label/qnurx /tmp/validatefs-test.mount/somewhere/else getfattr --dump /tmp/validatefs-test.mount/somewhere/else /usr/lib/systemd/systemd-validatefs --root=/tmp/validatefs-test.mount /tmp/validatefs-test.mount/somewhere/else # Set up a fake mount point with incorrect data to validate a failure mkdir /tmp/validatefs-test.fake mount --bind /tmp/validatefs-test.fake /tmp/validatefs-test.fake /usr/lib/systemd/systemd-validatefs /tmp/validatefs-test.fake if setfattr -n "user.validatefs.mount_point" -v "/foo\000/bar\000/tmp/validatefs-test.fake\000/waldo" /tmp/validatefs-test.fake ; then # xattrs on tmpfs are only available starting with kernel 6.6, hence handle setfattr failures gracefully /usr/lib/systemd/systemd-validatefs /tmp/validatefs-test.fake setfattr -n "user.validatefs.mount_point" -v "/knurz/schnurz\000/foo/bar/mor\000/end" /tmp/validatefs-test.fake (! /usr/lib/systemd/systemd-validatefs /tmp/validatefs-test.fake ) fi Found error in /usr/lib/systemd/tests/testdata/units/TEST-87-AUX-UTILS-VM.sysctl.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-87-AUX-UTILS-VM.sysctl.sh # shellcheck source=test/units/util.sh . "$(dirname "$0")"/util.sh export SYSTEMD_LOG_LEVEL=debug echo "foo.bar=42" >/tmp/foo.conf assert_rc 0 /usr/lib/systemd/systemd-sysctl /tmp/foo.conf assert_rc 1 /usr/lib/systemd/systemd-sysctl --strict /tmp/foo.conf echo "-foo.foo=42" >/tmp/foo.conf assert_rc 0 /usr/lib/systemd/systemd-sysctl /tmp/foo.conf assert_rc 0 /usr/lib/systemd/systemd-sysctl --strict /tmp/foo.conf assert_rc 1 /usr/lib/systemd/systemd-sysctl --inline assert_rc 0 /usr/lib/systemd/systemd-sysctl --inline " foo.bar=42" "#comment" " " assert_rc 1 /usr/lib/systemd/systemd-sysctl --inline --strict "foo.bar=42" assert_rc 0 /usr/lib/systemd/systemd-sysctl --inline -- "-foo.bar=42" -- ip link add hoge type dummy trap 'ip link del hoge' EXIT udevadm wait --timeout=30 /sys/class/net/hoge cat >/tmp/foo.conf </proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp echo 0 >/proc/sys/net/ipv4/conf/hoge/bootp_relay echo 0 >/proc/sys/net/ipv4/conf/hoge/disable_policy assert_rc 0 /usr/lib/systemd/systemd-sysctl --prefix=/net/ipv4/conf/hoge /tmp/foo.conf assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "1" assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "1" assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "0" echo 0 >/proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp Found error in /usr/lib/systemd/tests/testdata/units/TEST-87-AUX-UTILS-VM.modules-load.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-87-AUX-UTILS-VM.modules-load.sh "$MODULES_LOAD_BIN" --version # Explicit config file modprobe -v --all --remove dummy printf "dummy" >"$CONFIG_FILE" "$MODULES_LOAD_BIN" "$CONFIG_FILE" |& tee /tmp/out.log grep -E "Inserted module .*dummy" /tmp/out.log # Implicit config file modprobe -v --all --remove dummy printf "dummy" >"$CONFIG_FILE" "$MODULES_LOAD_BIN" |& tee /tmp/out.log grep -E "Inserted module .*dummy" /tmp/out.log # Valid & invalid data mixed together modprobe -v --all --remove dummy cat >"$CONFIG_FILE" </tmp/core.redirected test -s /tmp/core.redirected coredumpctl dump -o /tmp/core.output "${CORE_TEST_BIN##*/}" test -s /tmp/core.output rm -f /tmp/core.{output,redirected} # Unprivileged stuff # Related issue: https://github.com/systemd/systemd/issues/26912 UNPRIV_CMD=(systemd-run --user --wait --pipe -M "testuser@.host" -E SYSTEMD_PAGER --) # Trigger a couple of coredumps as an unprivileged user -- # Verify JSON output for unprivileged coredumps "${UNPRIV_CMD[@]}" coredumpctl info --json=short "$CORE_TEST_UNPRIV_BIN" | jq (! "${UNPRIV_CMD[@]}" coredumpctl info --all "$CORE_TEST_BIN") (! "${UNPRIV_CMD[@]}" coredumpctl info --all "${CORE_TEST_BIN##*/}") # We should have a couple of externally stored coredumps "${UNPRIV_CMD[@]}" coredumpctl --field=COREDUMP_FILENAME | tee /tmp/coredumpctl.out grep "/var/lib/systemd/coredump/core" /tmp/coredumpctl.out rm -f /tmp/coredumpctl.out "${UNPRIV_CMD[@]}" coredumpctl debug --debugger=/bin/true "$CORE_TEST_UNPRIV_BIN" "${UNPRIV_CMD[@]}" coredumpctl debug --debugger=/bin/true --debugger-arguments="-this --does --not 'do anything' -a -t --all" "${CORE_TEST_UNPRIV_BIN##*/}" "${UNPRIV_CMD[@]}" coredumpctl dump "$CORE_TEST_UNPRIV_BIN" >/tmp/core.redirected test -s /tmp/core.redirected "${UNPRIV_CMD[@]}" coredumpctl dump -o /tmp/core.output "${CORE_TEST_UNPRIV_BIN##*/}" test -s /tmp/core.output rm -f /tmp/core.{output,redirected} (! "${UNPRIV_CMD[@]}" coredumpctl dump "$CORE_TEST_BIN" >/dev/null) # --backtrace mode # Pass one of the existing journal coredump records to systemd-coredump. # Use our PID as the source to be able to create a PIDFD and to make matching easier. -- # # FIXME: drop the objdump call once https://github.com/systemd/systemd/pull/39268#issuecomment-3390745718 is # addressed if pkgconf --atleast-version 0.192 libdw && objdump -h -j .gnu_debugdata -j .debug_info /usr/lib/systemd/tests/unit-tests/manual/test-coredump-stacktrace; then MAKE_STACKTRACE_DUMP="/tmp/make-stacktrace-dump" # Simple script that mounts tmpfs on /tmp/ and copies the crashing test binary there, which in # combination with `unshare --mount` ensures the "outside" systemd-coredump process won't be able to # access the crashed binary (and hence won't be able to symbolize its stacktrace) unless # EnterNamespace=yes is used cat >"$MAKE_STACKTRACE_DUMP" <<\EOF #!/bin/bash -eux TARGET="/tmp/${1:?}" EC=0 # "Unhide" debuginfo in the namespace (see the comment below) test -d /usr/lib/debug/ && umount /usr/lib/debug/ mount -t tmpfs tmpfs /tmp/ cp /usr/lib/systemd/tests/unit-tests/manual/test-coredump-stacktrace "$TARGET" $TARGET || EC=$? if [[ $EC -ne 139 ]]; then echo >&2 "$TARGET didn't crash, this shouldn't happen" -- mkdir -p /run/systemd/coredump.conf.d/ printf '[Coredump]\nEnterNamespace=no' >/run/systemd/coredump.conf.d/99-enter-namespace.conf maybe_reload_coredumpd unshare --pid --fork --mount-proc --mount --uts --ipc --net "$MAKE_STACKTRACE_DUMP" "test-stacktrace-not-symbolized" timeout 30 bash -c "until coredumpctl list -q --no-legend /tmp/test-stacktrace-not-symbolized; do sleep .2; done" coredumpctl info /tmp/test-stacktrace-not-symbolized | tee /tmp/not-symbolized.log (! grep -E "#[0-9]+ .* main " /tmp/not-symbolized.log) (! grep -E "#[0-9]+ .* foo " /tmp/not-symbolized.log) (! grep -E "#[0-9]+ .* bar " /tmp/not-symbolized.log) (! grep -E "#[0-9]+ .* baz " /tmp/not-symbolized.log) printf '[Coredump]\nEnterNamespace=yes' >/run/systemd/coredump.conf.d/99-enter-namespace.conf maybe_reload_coredumpd unshare --pid --fork --mount-proc --mount --uts --ipc --net "$MAKE_STACKTRACE_DUMP" "test-stacktrace-symbolized" timeout 30 bash -c "until coredumpctl list -q --no-legend /tmp/test-stacktrace-symbolized; do sleep .2; done" coredumpctl info /tmp/test-stacktrace-symbolized | tee /tmp/symbolized.log grep -E "#[0-9]+ .* main " /tmp/symbolized.log grep -E "#[0-9]+ .* foo " /tmp/symbolized.log grep -E "#[0-9]+ .* bar " /tmp/symbolized.log grep -E "#[0-9]+ .* baz " /tmp/symbolized.log test -d /usr/lib/debug/ && umount /usr/lib/debug/ rm -f "$MAKE_STACKTRACE_DUMP" /run/systemd/coredump.conf.d/99-enter-namespace.conf /tmp/{not-,}symbolized.log maybe_reload_coredumpd else echo "libdw doesn't not support setting sysroot, skipping EnterNamespace= test" fi Found error in /usr/lib/systemd/tests/testdata/units/TEST-87-AUX-UTILS-VM.bootctl.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-87-AUX-UTILS-VM.bootctl.sh . "$(dirname "$0")"/test-control.sh (! systemd-detect-virt -cq) restore_esp() { if [ ! -d /tmp/esp.bak ]; then return fi if [ -d /tmp/esp.bak/EFI/ ]; then mkdir -p "$(bootctl --print-esp-path)/EFI/" cp -r /tmp/esp.bak/EFI/* "$(bootctl --print-esp-path)/EFI/" fi if [ -d /tmp/esp.bak/loader/ ]; then mkdir -p "$(bootctl --print-esp-path)/loader/" cp -r /tmp/esp.bak/loader/* "$(bootctl --print-esp-path)/loader/" fi rm -rf /tmp/esp.bak } backup_esp() { if [ -d /tmp/esp.bak ]; then return fi # make a backup of the two key dirs in the ESP, and delete them if [[ -d "$(bootctl --print-esp-path)/EFI" ]]; then mkdir -p /tmp/esp.bak cp -r "$(bootctl --print-esp-path)/EFI/" /tmp/esp.bak/ rm -rf "$(bootctl --print-esp-path)/EFI" mkdir "$(bootctl --print-esp-path)/EFI" fi if [[ -d "$(bootctl --print-esp-path)/loader" ]]; then mkdir -p /tmp/esp.bak cp -r "$(bootctl --print-esp-path)/loader/" /tmp/esp.bak/ rm -rf "$(bootctl --print-esp-path)/loader" mkdir "$(bootctl --print-esp-path)/loader" fi } -- return 0 ) testcase_bootctl_image() { IMAGE_DIR="$(mktemp --directory /tmp/test-bootctl.XXXXXXXXXX)" trap cleanup_image RETURN truncate -s 256m "${IMAGE_DIR}/image" cat >"${IMAGE_DIR}/partscript" </dev/null; then echo "mkfs.btrfs not found, skipping." return 0 fi IMAGE_DIR="$(mktemp --directory /tmp/test-bootctl.XXXXXXXXXX)" trap cleanup_raid RETURN truncate -s 256m "${IMAGE_DIR}/image1" truncate -s 256m "${IMAGE_DIR}/image2" -- testcase_bootctl_secure_boot_auto_enroll() { # mkosi can also add keys here, so back them up and restored them backup_esp trap restore_esp RETURN ERR cat >/tmp/openssl.conf </dev/null) # Same again into fresh directories with makeEntryDirectory:true, and check loader.conf now # gets a "default -*" line and the entry token directory shows up under $BOOT. rm -rf "$FAKE_ESP" "$FAKE_BOOT" FAKE_ESP="$(mktemp --directory /tmp/test-bootctl-esp.XXXXXXXXXX)" FAKE_BOOT="$(mktemp --directory /tmp/test-bootctl-boot.XXXXXXXXXX)" SYSTEMD_RELAX_ESP_CHECKS=yes SYSTEMD_RELAX_XBOOTLDR_CHECKS=yes SYSTEMD_LOG_TARGET=console \ varlinkctl call --quiet "$(type -p bootctl)" io.systemd.BootControl.Install \ "{\"operation\":\"new\",\"touchVariables\":false,\"espPath\":\"$FAKE_ESP\",\"xbootldrPath\":\"$FAKE_BOOT\",\"makeEntryDirectory\":true}" local TOKEN TOKEN="$(sed -n 's/^default \(.*\)-\*$/\1/p' "$FAKE_ESP/loader/loader.conf")" -- echo "ukify not found, skipping." return 0 fi backup_esp LINK_WORKDIR="$(mktemp --directory /tmp/test-bootctl-link.XXXXXXXXXX)" trap cleanup_link RETURN ERR # Ensure loader/entries directory is present bootctl install --make-entry-directory=yes -- echo "ukify not found, skipping." return 0 fi backup_esp LINK_WORKDIR="$(mktemp --directory /tmp/test-bootctl-link-auto.XXXXXXXXXX)" trap cleanup_link_auto RETURN ERR # Ensure loader/entries directory is present bootctl install --make-entry-directory=yes Found error in /usr/lib/systemd/tests/testdata/units/TEST-82-SOFTREBOOT.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-82-SOFTREBOOT.sh timeout 30 bash -c "until systemctl is-active --quiet user@${linger_uid}.service; do sleep 1; done" loginctl disable-linger testuser loginctl terminate-user testuser || true # This time we test the /run/nextroot/ root switching logic. (We synthesize a new rootfs from the old via overlayfs) mkdir -p /run/nextroot /tmp/nextroot-lower /original-root mount -t tmpfs tmpfs /tmp/nextroot-lower echo miep >/tmp/nextroot-lower/lower # Copy os-release away, so that we can manipulate it and check that it is updated in the propagate # directory across soft reboots. Try to cover corner cases by truncating it. mkdir -p /tmp/nextroot-lower/etc grep ID /etc/os-release >/tmp/nextroot-lower/etc/os-release echo MARKER=1 >>/tmp/nextroot-lower/etc/os-release cmp /etc/os-release /run/systemd/propagate/.os-release-stage/os-release (! grep -q MARKER=1 /etc/os-release) mount -t overlay nextroot /run/nextroot -o lowerdir=/tmp/nextroot-lower:/,ro # Bind our current root into the target so that we later can return to it mount --bind / /run/nextroot/original-root # Restart the unit that is not supposed to survive -- systemd-run --collect --service-type=exec -p DefaultDependencies=no -p IgnoreOnIsolate=yes -p SetCredential=gone:hoge --unit=TEST-82-SOFTREBOOT-nosurvive.service sleep infinity # Ensure that the unit doesn't get deactivated by dependencies on the source file. Given it's a verity # image that is already open, even if the tmpfs with the image goes away, the file will be pinned by the # kernel and will keep working. cp /usr/share/minimal_0.* /tmp/ # Configure these transient units to survive the soft reboot - they will not conflict with shutdown.target # and it will be ignored on the isolate that happens in the next boot. The first will use argv[0][0] = # '@', and the second will use SurviveFinalKillSignal=yes. Both should survive. # By writing to stdout, which is connected to the journal, we also ensure logging doesn't break across -- --property SetCredential=preserve:yay \ "$survive_argv" # shellcheck disable=SC2016 systemd-run --service-type=exec --unit=TEST-82-SOFTREBOOT-survive.service \ --property TemporaryFileSystem="/run /tmp /var" \ --property RootImage=/tmp/minimal_0.raw \ --property SurviveFinalKillSignal=yes \ --property IgnoreOnIsolate=yes \ --property DefaultDependencies=no \ --property After=basic.target \ --property "Conflicts=reboot.target kexec.target poweroff.target halt.target emergency.target rescue.target" \ Found error in /usr/lib/systemd/tests/testdata/units/TEST-81-GENERATORS.system-update-generator.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-81-GENERATORS.system-update-generator.sh # shellcheck source=test/units/generator-utils.sh . "$(dirname "$0")/generator-utils.sh" GENERATOR_BIN="/usr/lib/systemd/system-generators/systemd-system-update-generator" OUT_DIR="$(mktemp -d /tmp/system-update-generator-generator.XXX)" at_exit() { rm -frv "${OUT_DIR:?}" /system-update } -- link_endswith "$OUT_DIR/early/default.target" "/lib/systemd/system/system-update.target" : "system-update-generator: kernel cmdline warnings" # We should warn if the default target is overridden on the kernel cmdline # by a runlevel or systemd.unit=, but still generate the symlink SYSTEMD_PROC_CMDLINE="systemd.unit=foo.bar 3" run_and_list "$GENERATOR_BIN" "$OUT_DIR" |& tee /tmp/system-update-generator.log link_endswith "$OUT_DIR/early/default.target" "/lib/systemd/system/system-update.target" grep -qE "Offline system update overridden .* systemd.unit=" /tmp/system-update-generator.log grep -qE "Offline system update overridden .* runlevel" /tmp/system-update-generator.log Found error in /usr/lib/systemd/tests/testdata/units/TEST-81-GENERATORS.getty-generator.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-81-GENERATORS.getty-generator.sh # shellcheck source=test/units/generator-utils.sh . "$(dirname "$0")/generator-utils.sh" GENERATOR_BIN="/usr/lib/systemd/system-generators/systemd-getty-generator" OUT_DIR="$(mktemp -d /tmp/getty-generator.XXX)" CREDENTIALS_DIR="$(mktemp -d /tmp/getty-generator-creds.XXX)" at_exit() { rm -frv "${OUT_DIR:?}" "${CREDENTIALS_DIR:?}" } -- done # Sneak in one "not-a-tty" console touch /dev/notatty99 # Temporarily replace /sys/class/tty/console/active with our list of dummy # consoles so getty-generator can process them echo -ne "${DUMMY_ACTIVE_CONSOLES[@]}" /dev/notatty99 >/tmp/dummy-active-consoles mount -v --bind /tmp/dummy-active-consoles /sys/class/tty/console/active : "getty-generator: no arguments" # Sneak in an invalid value for $SYSTEMD_GETTY_AUTO to test things out PID1_ENVIRON="SYSTEMD_GETTY_AUTO=foo" run_and_list "$GENERATOR_BIN" "$OUT_DIR" check_no_container Found error in /usr/lib/systemd/tests/testdata/units/TEST-80-NOTIFYACCESS.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-80-NOTIFYACCESS.sh set -o pipefail # shellcheck source=test/units/util.sh . "$(dirname "$0")"/util.sh mkfifo /tmp/syncfifo1 /tmp/syncfifo2 sync_in() { read -r x /tmp/syncfifo2 } export SYSTEMD_LOG_LEVEL=debug # Test NotifyAccess= override through sd_notify() -- timeout 40 bash -c 'until [[ $(systemctl show reload-timeout.service -P SubState) == "running" ]]; do sleep 1; done' assert_eq "$(systemctl show reload-timeout.service -P ReloadResult)" "success" systemctl stop reload-timeout.service rm /tmp/syncfifo1 /tmp/syncfifo2 # Explicitly test busctl's BUSERROR= reporting and systemctl status should show it (! systemd-run --wait --unit="TEST-80-BUSERROR.service" -p NotifyAccess=main busctl introspect org.freedesktop.systemd1 /bogus/001) assert_eq "$(systemctl show TEST-80-BUSERROR.service -P StatusBusError)" "org.freedesktop.DBus.Error.UnknownObject" assert_in "D-Bus: org.freedesktop.DBus.Error.UnknownObject" "$(systemctl status TEST-80-BUSERROR.service)" # Now test basic fdstore behaviour MYSCRIPT="/tmp/myscript$RANDOM.sh" cat >>"$MYSCRIPT" <<'EOF' #!/usr/bin/env bash set -eux set -o pipefail test "$FDSTORE" -eq 7 N="/tmp/$RANDOM" echo $RANDOM >"$N" systemd-notify --fd=4 --fdname=quux --pid=parent 4<"$N" rm "$N" systemd-notify --ready exec sleep infinity -- MYUNIT="myunit$RANDOM.service" systemd-run -u "$MYUNIT" -p Type=notify -p FileDescriptorStoreMax=7 "$MYSCRIPT" test "$(systemd-analyze fdstore "$MYUNIT" | wc -l)" -eq 2 systemd-analyze fdstore "$MYUNIT" --json=short systemd-analyze fdstore "$MYUNIT" --json=short | grep -P '\[{"fdname":"quux","type":.*,"devno":\[.*\],"inode":.*,"rdevno":null,"path":"/tmp/.*","flags":"ro"}\]' >/dev/null systemctl stop "$MYUNIT" rm "$MYSCRIPT" # Test fdstore pinning (this will pull in fdstore-pin.service fdstore-nopin.service) -- notify-reload-well-behaved.service || : systemctl reset-failed notify-reload-no-handler.service \ notify-reload-sigstop.service \ notify-reload-toggle-handler.service \ notify-reload-well-behaved.service || : rm -f /tmp/reload-nohandler-in /tmp/reload-nohandler-out \ /tmp/reload-nohandler-cursor \ /tmp/reload-sigstop-in /tmp/reload-sigstop-out \ /tmp/reload-toggle-in /tmp/reload-toggle-out \ /tmp/reload-toggle-cursor \ /tmp/reload-wellbehaved-in /tmp/reload-wellbehaved-out } trap cleanup_notify_reload EXIT cleanup_notify_reload # Test 1: Service without signal handler should fail to start mkfifo /tmp/reload-nohandler-in /tmp/reload-nohandler-out journalctl -q -n 0 --cursor-file=/tmp/reload-nohandler-cursor (! systemctl start notify-reload-no-handler.service) assert_eq "$(systemctl show notify-reload-no-handler.service -P SubState)" "failed" assert_eq "$(systemctl show notify-reload-no-handler.service -P Result)" "protocol" # Verify error was logged about missing signal handler journalctl --sync journalctl -u notify-reload-no-handler.service --cursor-file=/tmp/reload-nohandler-cursor \ --grep "lacks handler for reload signal" >/dev/null systemctl reset-failed notify-reload-no-handler.service rm -f /tmp/reload-nohandler-in /tmp/reload-nohandler-out # Test 2: SIGSTOP cannot be caught or blocked, so it is exempt from handler validation mkfifo /tmp/reload-sigstop-in /tmp/reload-sigstop-out systemctl start notify-reload-sigstop.service assert_eq "$(systemctl show notify-reload-sigstop.service -P SubState)" "running" systemctl stop notify-reload-sigstop.service rm -f /tmp/reload-sigstop-in /tmp/reload-sigstop-out # Test 3: Service that removes handler should warn on reload but still reload mkfifo /tmp/reload-toggle-in /tmp/reload-toggle-out systemctl start notify-reload-toggle-handler.service assert_eq "$(systemctl show notify-reload-toggle-handler.service -P SubState)" "running" # Command service to remove its signal handler timeout 10 bash -c 'echo "remove-handler" >/tmp/reload-toggle-in' response="$(timeout 10 cat /tmp/reload-toggle-out)" assert_eq "$response" "handler-removed" # Reload should succeed (with warning) even though handler is gone - service will be killed by SIGHUP # but that's intentional after the first start succeeds journalctl -q -n 0 --cursor-file=/tmp/reload-toggle-cursor systemctl reload --no-block notify-reload-toggle-handler.service # The service will die from SIGHUP since the handler is removed timeout 10 bash -c 'while systemctl is-active --quiet notify-reload-toggle-handler.service; do sleep .5; done' # Verify warning was logged journalctl --sync journalctl -u notify-reload-toggle-handler.service --cursor-file=/tmp/reload-toggle-cursor \ --grep "lacks handler for reload signal" >/dev/null rm -f /tmp/reload-toggle-in /tmp/reload-toggle-out # Test 4: Well-behaved service with handler should work correctly mkfifo /tmp/reload-wellbehaved-in /tmp/reload-wellbehaved-out systemctl start notify-reload-well-behaved.service assert_eq "$(systemctl show notify-reload-well-behaved.service -P SubState)" "running" # Reload should succeed systemctl reload --no-block notify-reload-well-behaved.service timeout 10 bash -c 'until [[ $(systemctl show notify-reload-well-behaved.service -P SubState) == "reload-signal" ]]; do sleep .5; done' response="$(timeout 10 cat /tmp/reload-wellbehaved-out)" assert_eq "$response" "reload" timeout 10 bash -c 'until [[ $(systemctl show notify-reload-well-behaved.service -P SubState) == "running" ]]; do sleep .5; done' assert_eq "$(systemctl show notify-reload-well-behaved.service -P ReloadResult)" "success" timeout 10 bash -c 'echo "exit" >/tmp/reload-wellbehaved-in' systemctl stop notify-reload-well-behaved.service rm -f /tmp/reload-wellbehaved-in /tmp/reload-wellbehaved-out touch /testok Found error in /usr/lib/systemd/tests/testdata/units/TEST-74-AUX-UTILS.varlinkctl.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-74-AUX-UTILS.varlinkctl.sh varlinkctl info /run/systemd/io.systemd.Hostname varlinkctl introspect /run/systemd/io.systemd.Hostname io.systemd.Hostname varlinkctl call /run/systemd/io.systemd.Hostname io.systemd.Hostname.Describe '{}' # Validate that --exec results in the very same values varlinkctl call /run/systemd/io.systemd.Hostname io.systemd.Hostname.Describe '{}' | jq >/tmp/describe1.json varlinkctl --exec call /run/systemd/io.systemd.Hostname io.systemd.Hostname.Describe '{}' -- jq >/tmp/describe2.json cmp /tmp/describe1.json /tmp/describe2.json rm /tmp/describe1.json /tmp/describe2.json # test io.systemd.Manager varlinkctl info /run/systemd/io.systemd.Manager varlinkctl introspect /run/systemd/io.systemd.Manager io.systemd.Manager varlinkctl call /run/systemd/io.systemd.Manager io.systemd.Manager.Describe '{}' -- # Test --upgrade with stdin redirected from a regular file (epoll can't poll regular files, # so this exercises the sd_event_add_defer fallback path) UPGRADE_SOCKET2="$(mktemp -d)/upgrade.sock" systemd-notify --fork -q -- python3 "$UPGRADE_SERVER" "$UPGRADE_SOCKET2" echo "file input test" >/tmp/test-upgrade-input result="$(varlinkctl call --upgrade "unix:$UPGRADE_SOCKET2" io.systemd.test.Reverse '{"foo":"file"}' >>" >/dev/null echo "$result" | grep '"foo": "file"' >/dev/null echo "$result" | grep "tset tupni elif" >/dev/null # Test --upgrade over ssh-exec: transport (pipe pair, not a bidirectional socket). -- grep "<<< UPGRADED >>>" "$EXEC_RESULT" >/dev/null grep '"foo": "bar"' "$EXEC_RESULT" >/dev/null grep "dlrow olleh" "$EXEC_RESULT" >/dev/null rm -f "$EXEC_RESULT" rm -f "$UPGRADE_SOCKET" "$UPGRADE_SOCKET2" "$UPGRADE_SERVER" /tmp/test-upgrade-input rm -rf "$(dirname "$UPGRADE_SOCKET")" "$(dirname "$UPGRADE_SOCKET2")" # Test varlinkctl serve: expose a stdio command via varlink protocol upgrade with socket activation. # This is the "inetd for varlink" pattern: any stdio tool becomes a varlink service. SERVE_SOCKET="$(mktemp -d)/serve.sock" Found error in /usr/lib/systemd/tests/testdata/units/TEST-74-AUX-UTILS.sbsign.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-74-AUX-UTILS.sbsign.sh if [[ ! -d /usr/lib/systemd/boot/efi ]]; then echo "systemd-boot is not installed, skipping." exit 77 fi cat >/tmp/openssl.conf </dev/null; then echo "sbverify not found, skipping." return 0 fi SD_BOOT="$(find /usr/lib/systemd/boot/efi/ -name "systemd-boot*.efi" | head -n1)" (! sbverify --cert /tmp/sb.crt "$SD_BOOT") /usr/lib/systemd/systemd-sbsign sign --certificate /tmp/sb.crt --private-key /tmp/sb.key --output /tmp/sdboot "$SD_BOOT" sbverify --cert /tmp/sb.crt /tmp/sdboot # Make sure appending signatures to an existing certificate table works as well. /usr/lib/systemd/systemd-sbsign sign --certificate /tmp/sb.crt --private-key /tmp/sb.key --output /tmp/sdboot /tmp/sdboot sbverify --cert /tmp/sb.crt /tmp/sdboot } testcase_sign_systemd_boot_offline() { if ! command -v sbverify >/dev/null; then echo "sbverify not found, skipping." return 0 fi SD_BOOT="$(find /usr/lib/systemd/boot/efi/ -name "systemd-boot*.efi" | head -n1)" /usr/lib/systemd/systemd-sbsign sign --certificate /tmp/sb.crt --output /tmp/signed-data.bin --prepare-offline-signing "$SD_BOOT" openssl dgst -sha256 -sign /tmp/sb.key -out /tmp/signed-data.sig /tmp/signed-data.bin /usr/lib/systemd/systemd-sbsign \ sign \ --certificate /tmp/sb.crt \ --output /tmp/sdboot \ --signed-data /tmp/signed-data.bin \ --signed-data-signature /tmp/signed-data.sig \ "$SD_BOOT" sbverify --cert /tmp/sb.crt /tmp/sdboot } run_testcases Found error in /usr/lib/systemd/tests/testdata/units/TEST-74-AUX-UTILS.pty-forward.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-74-AUX-UTILS.pty-forward.sh set -o pipefail systemd-pty-forward --background 41 --title test echo foobar # Test that signals are forwarded to the systemd-pty-forward child process. cat >/tmp/child <<\EOF #!/usr/bin/env bash set -x trap 'touch /tmp/int' INT # We need to wait for the sleep process asynchronously in order to allow # bash to process signals sleep infinity & # notify that the process is ready touch /tmp/ready PID=$! while :; do wait || : done EOF chmod +x /tmp/child systemd-pty-forward /tmp/child & PID=$! timeout 5 bash -c "until test -e /tmp/ready; do sleep .5; done" kill -INT "$PID" timeout 5 bash -c "until test -e /tmp/int; do sleep .5; done" kill "$PID" Found error in /usr/lib/systemd/tests/testdata/units/TEST-74-AUX-UTILS.keyutil.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-74-AUX-UTILS.keyutil.sh if ! command -v /usr/lib/systemd/systemd-keyutil >/dev/null; then echo "systemd-keyutil not found, skipping." exit 77 fi cat >/tmp/openssl.conf </dev/null # Verify using external (original) certificate openssl smime -verify -binary -inform der -in /tmp/payload.p7s -content /tmp/payload -noverify -certfile /tmp/test.crt -nointern >/dev/null } verify_pkcs7_fail() { # Verify using internal certificate (! openssl smime -verify -binary -inform der -in /tmp/payload.p7s -content /tmp/payload -noverify >/dev/null) # Verify using external (original) certificate (! openssl smime -verify -binary -inform der -in /tmp/payload.p7s -content /tmp/payload -noverify -certfile /tmp/test.crt -nointern >/dev/null) } testcase_pkcs7() { echo -n "test" >/tmp/payload for hashalg in sha256 sha384 sha512; do # shellcheck disable=SC2086 openssl dgst -$hashalg -sign /tmp/test.key -out /tmp/payload.p1s /tmp/payload # Test with and without content in the PKCS7 for content_param in "" "--content /tmp/payload"; do # Test with and without specifying signing hash alg for hashalg_param in "" "--hash-algorithm $hashalg"; do # shellcheck disable=SC2086 /usr/lib/systemd/systemd-keyutil --certificate /tmp/test.crt --output /tmp/payload.p7s --signature /tmp/payload.p1s $content_param $hashalg_param pkcs7 # Should always pass, except when not specifying hash alg and hash alg != sha256 if [ -z "$hashalg_param" ] && [ "$hashalg" != "sha256" ]; then verify_pkcs7_fail else verify_pkcs7 fi rm -f /tmp/payload.p7s done done rm -f /tmp/payload.p1s done rm -f /tmp/payload } run_testcases Found error in /usr/lib/systemd/tests/testdata/units/TEST-70-TPM2.pcrlock.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-70-TPM2.pcrlock.sh "$SD_PCRLOCK" unlock-file-system "$SD_PCRLOCK" unlock-raw --pcrlock=/var/lib/pcrlock.d/910-test70.pcrlock "$SD_PCRLOCK" unlock-raw --pcrlock=/var/lib/pcrlock.d/920-test70.pcrlock fi rm -rf /tmp/fakexbootldr /var/lib/pcrlock.d/123-empty.pcrlock.d /run/systemd/system/systemd-pcrlock.socket.d if [[ -n "${img:-}" ]]; then rm -f "$img" "$img".private.pem "$img".public.pem "$img".pcrsign fi rm -f /tmp/borked /tmp/pcrlockpwd /var/lib/systemd/pcrlock.json /var/lib/systemd/pcrlock.json.gone systemctl daemon-reload } trap at_exit EXIT -- # Reset TPM PCR 16 ("debug") explicitly, so that we can use it in a known good state tpm2_pcrreset 16 # Ensure a truncated log doesn't crash pcrlock echo -n -e \\x1e >/tmp/borked set +e SYSTEMD_MEASURE_LOG_USERSPACE=/tmp/borked "$SD_PCRLOCK" cel --no-pager --json=pretty ret=$? set -e # If it crashes the exit code will be 149 test $ret -eq 1 -- # Repeat immediately (this call will have to reuse the nvindex, rather than create it) "$SD_PCRLOCK" make-policy --pcr="$PCRS" "$SD_PCRLOCK" make-policy --pcr="$PCRS" --force fi img="/tmp/pcrlock.img" truncate -s 20M "$img" echo -n hoho >/tmp/pcrlockpwd chmod 0600 /tmp/pcrlockpwd cryptsetup luksFormat -q --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --use-urandom "$img" /tmp/pcrlockpwd systemd-cryptenroll --unlock-key-file=/tmp/pcrlockpwd --tpm2-device=auto --tpm2-pcrlock=/var/lib/systemd/pcrlock.json --tpm2-public-key= --wipe-slot=tpm2 "$img" systemd-cryptsetup attach pcrlock "$img" - tpm2-device=auto,tpm2-pcrlock=/var/lib/systemd/pcrlock.json,headless systemd-cryptsetup detach pcrlock # Ensure systemd-pcrlock not crashing on empty variant directory mkdir -p /var/lib/pcrlock.d/123-empty.pcrlock.d -- openssl rsa -pubout -in "$img".private.pem -out "$img".public.pem systemd-cryptenroll --unlock-tpm2-device=auto --tpm2-device=auto --tpm2-pcrlock=/var/lib/systemd/pcrlock.json --tpm2-public-key="$img".public.pem --wipe-slot=tpm2 "$img" "$SD_MEASURE" sign --current --bank=sha256 --private-key="$img".private.pem --public-key="$img".public.pem --phase=: | tee "$img".pcrsign SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=0 systemd-cryptsetup attach pcrlock "$img" - "tpm2-device=auto,tpm2-pcrlock=/var/lib/systemd/pcrlock.json,tpm2-signature=$img.pcrsign,headless" systemd-cryptsetup detach pcrlock systemd-cryptenroll --unlock-key-file=/tmp/pcrlockpwd --tpm2-device=auto --tpm2-pcrlock=/var/lib/systemd/pcrlock.json --tpm2-public-key= --wipe-slot=tpm2 "$img" rm "$img".public.pem "$img".private.pem "$img".pcrsign # Now use the root fs support, i.e. make the tool write a copy of the pcrlock # file as service credential to some temporary dir and remove the local copy, so that # it has to use the credential version. mkdir /tmp/fakexbootldr SYSTEMD_XBOOTLDR_PATH=/tmp/fakexbootldr SYSTEMD_RELAX_XBOOTLDR_CHECKS=1 "$SD_PCRLOCK" make-policy --pcr="$PCRS" --force mv /var/lib/systemd/pcrlock.json /var/lib/systemd/pcrlock.json.gone ls -al /tmp/fakexbootldr/loader/credentials CREDENTIAL_FILE="$(echo /tmp/fakexbootldr/loader/credentials/pcrlock.*.cred)" test -f "$CREDENTIAL_FILE" # Strip dir and .cred suffix from file name. CREDENTIAL_NAME=${CREDENTIAL_FILE#/tmp/fakexbootldr/loader/credentials/} CREDENTIAL_NAME=${CREDENTIAL_NAME%.cred} # If SB is enabled then this will fail as it's not locked but TPM2 is enabled if cmp /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c <(printf '\6\0\0\0\1'); then ALLOW_NULL=--allow-null fi systemd-creds decrypt "${ALLOW_NULL:-}" --name="$CREDENTIAL_NAME" "$CREDENTIAL_FILE" ln -s "$CREDENTIAL_FILE" /tmp/fakexbootldr/loader/credentials/"$CREDENTIAL_NAME" test -f /tmp/fakexbootldr/loader/credentials/"$CREDENTIAL_NAME" SYSTEMD_ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY=/tmp/fakexbootldr/loader/credentials systemd-cryptsetup attach pcrlock "$img" - tpm2-device=auto,headless systemd-cryptsetup detach pcrlock mv /var/lib/systemd/pcrlock.json.gone /var/lib/systemd/pcrlock.json SYSTEMD_XBOOTLDR_PATH=/tmp/fakexbootldr SYSTEMD_RELAX_XBOOTLDR_CHECKS=1 "$SD_PCRLOCK" remove-policy "$SD_PCRLOCK" unlock-firmware-config "$SD_PCRLOCK" unlock-gpt "$SD_PCRLOCK" unlock-machine-id "$SD_PCRLOCK" unlock-file-system -- varlinkctl call /run/systemd/io.systemd.PCRLock io.systemd.PCRLock.Lock '{"category":"firmwareConfig","lock":false}' varlinkctl call /run/systemd/io.systemd.PCRLock io.systemd.PCRLock.Lock '{"category":"firmwareCode","lock":false}' varlinkctl call /run/systemd/io.systemd.PCRLock io.systemd.PCRLock.Lock '{"category":"secureBootPolicy","lock":false}' varlinkctl call /run/systemd/io.systemd.PCRLock io.systemd.PCRLock.Lock '{"category":"secureBootAuthority","lock":false}' rm "$img" /tmp/pcrlockpwd # For issue #35746 for _ in {0..10}; do run0 /usr/lib/systemd/systemd-pcrlock done Found error in /usr/lib/systemd/tests/testdata/units/TEST-70-TPM2.nvpcr.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-70-TPM2.nvpcr.sh jq --seq --slurp "/run/systemd/tpm2-pcr-signature.json" mkdir -p /run/nvpcr cat >/run/nvpcr/test.nvpcr </tmp/test.policy rm -f /run/systemd/nvpcr/test.auth tpm2_nvundefine -C o 0x01d1020a tpm2_nvdefine -C o -s 32 -g sha256 -a "policywrite|ownerread|authread|orderly|clear_stclear|nt=extend" -L /tmp/test.policy 0x01d1020a run_tpm2_setup test -f /run/systemd/nvpcr/test.auth DIGEST_ACTUAL3="$(systemd-analyze nvpcrs test --json=pretty | jq -r '.[] | select(.name=="test") | .value')" test "$DIGEST_ACTUAL3" = "$DIGEST_BASE_EXPECTED" NAME_ACTUAL=$(tpm2_nvreadpublic 0x01d1020a | awk '/name:/{print $2; exit}') test "$NAME_ACTUAL" = "$NAME_EXPECTED" # Make sure that systemd-tpm2-setup is able to replace a pre-existing NvPCR index associated # with a different PCR signing key. OLD_POLICY="0000000000000000000000000000000000000000000000000000000000000000" echo "$OLD_POLICY" | basenc --base16 -d >/tmp/test.policy rm -f /run/systemd/nvpcr/test.auth tpm2_nvundefine -C o 0x01d1020a tpm2_nvdefine -C o -s 32 -g sha256 -a "policywrite|ownerread|authread|orderly|clear_stclear|nt=extend" -L /tmp/test.policy 0x01d1020a run_tpm2_setup test -f /run/systemd/nvpcr/test.auth DIGEST_ACTUAL4="$(systemd-analyze nvpcrs test --json=pretty | jq -r '.[] | select(.name=="test") | .value')" test "$DIGEST_ACTUAL4" = "$DIGEST_BASE_EXPECTED" NAME_ACTUAL=$(tpm2_nvreadpublic 0x01d1020a | awk '/name:/{print $2; exit}') -- if ! systemctl is-active --quiet systemd-pcrextend.socket; then echo "systemd-pcrextend.socket not active, skipping verity NvPCR measurement check" exit 0 fi mkdir -p /tmp/nvpcr/tree touch /tmp/nvpcr/tree/file if machine_supports_verity_keyring; then SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs \ systemd-repart -P \ -s /tmp/nvpcr/tree \ --certificate=/usr/share/mkosi.crt \ --private-key=/usr/share/mkosi.key \ /var/tmp/nvpcr.raw else OPENSSL_CONFIG="/tmp/nvpcr/opensslconfig" # Unfortunately OpenSSL insists on reading some config file, hence provide one with mostly placeholder contents cat >"${OPENSSL_CONFIG:?}" </tmp/tpmdata1 echo foobar >/tmp/tpmdata2 cat >/tmp/result </tmp/result.json </tmp/result </tmp/result.json </tmp/result </dev/null; then MEASURE_BANKS+=("--bank=sha1") fi # Sign current PCR state with it "$SD_MEASURE" sign --current "${MEASURE_BANKS[@]}" --private-key="/tmp/pcrsign-private.pem" --public-key="/tmp/pcrsign-public.pem" --phase=: | tee "/tmp/pcrsign.sig" dd if=/dev/urandom of=/tmp/pcrtestdata bs=1024 count=64 systemd-creds encrypt /tmp/pcrtestdata /tmp/pcrtestdata.encrypted --with-key=host+tpm2-with-public-key --tpm2-public-key="/tmp/pcrsign-public.pem" systemd-creds decrypt /tmp/pcrtestdata.encrypted - --tpm2-signature="/tmp/pcrsign.sig" | cmp - /tmp/pcrtestdata # Invalidate PCR, decrypting should fail now tpm2_pcrextend 11:sha256=0000000000000000000000000000000000000000000000000000000000000000 (! systemd-creds decrypt /tmp/pcrtestdata.encrypted - --tpm2-signature="/tmp/pcrsign.sig" >/dev/null) # Sign new PCR state, decrypting should work now. "$SD_MEASURE" sign --current "${MEASURE_BANKS[@]}" --private-key="/tmp/pcrsign-private.pem" --public-key="/tmp/pcrsign-public.pem" --phase=: >"/tmp/pcrsign.sig2" systemd-creds decrypt /tmp/pcrtestdata.encrypted - --tpm2-signature="/tmp/pcrsign.sig2" | cmp - /tmp/pcrtestdata # Now, do the same, but with a cryptsetup binding dd if=/dev/urandom of=/tmp/passphrase bs=32 count=1 truncate -s 20M "$IMAGE" cryptsetup luksFormat -q --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --use-urandom "$IMAGE" /tmp/passphrase # Ensure that an unrelated signature, when not requested, is not used touch /run/systemd/tpm2-pcr-signature.json systemd-cryptenroll --unlock-key-file=/tmp/passphrase --tpm2-device=auto --tpm2-public-key="/tmp/pcrsign-public.pem" "$IMAGE" # Reset and use the signature now rm -f /run/systemd/tpm2-pcr-signature.json systemd-cryptenroll --wipe-slot=tpm2 "$IMAGE" systemd-cryptenroll --unlock-key-file=/tmp/passphrase --tpm2-device=auto --tpm2-public-key="/tmp/pcrsign-public.pem" --tpm2-signature="/tmp/pcrsign.sig2" "$IMAGE" # Check if we can activate that (without the token module stuff) SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=0 systemd-cryptsetup attach test-volume2 "$IMAGE" - tpm2-device=auto,tpm2-signature="/tmp/pcrsign.sig2",headless=1 SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=0 systemd-cryptsetup detach test-volume2 # Check if we can activate that (and a second time with the token module stuff enabled) SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=1 systemd-cryptsetup attach test-volume2 "$IMAGE" - tpm2-device=auto,tpm2-signature="/tmp/pcrsign.sig2",headless=1 SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=1 systemd-cryptsetup detach test-volume2 # After extending the PCR things should fail tpm2_pcrextend 11:sha256=0000000000000000000000000000000000000000000000000000000000000000 (! SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=0 systemd-cryptsetup attach test-volume2 "$IMAGE" - tpm2-device=auto,tpm2-signature="/tmp/pcrsign.sig2",headless=1) (! SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=1 systemd-cryptsetup attach test-volume2 "$IMAGE" - tpm2-device=auto,tpm2-signature="/tmp/pcrsign.sig2",headless=1) # But once we sign the current PCRs, we should be able to unlock again "$SD_MEASURE" sign --current "${MEASURE_BANKS[@]}" --private-key="/tmp/pcrsign-private.pem" --public-key="/tmp/pcrsign-public.pem" --phase=: >"/tmp/pcrsign.sig3" SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=0 systemd-cryptsetup attach test-volume2 "$IMAGE" - tpm2-device=auto,tpm2-signature="/tmp/pcrsign.sig3",headless=1 systemd-cryptsetup detach test-volume2 SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=1 systemd-cryptsetup attach test-volume2 "$IMAGE" - tpm2-device=auto,tpm2-signature="/tmp/pcrsign.sig3",headless=1 systemd-cryptsetup detach test-volume2 # Test --append mode and de-duplication. With the same parameters signing should not add a new entry "$SD_MEASURE" sign --current "${MEASURE_BANKS[@]}" --private-key="/tmp/pcrsign-private.pem" --public-key="/tmp/pcrsign-public.pem" --phase=: --append="/tmp/pcrsign.sig3" >"/tmp/pcrsign.sig4" cmp "/tmp/pcrsign.sig3" "/tmp/pcrsign.sig4" # Sign one more phase, this should "$SD_MEASURE" sign --current "${MEASURE_BANKS[@]}" --private-key="/tmp/pcrsign-private.pem" --public-key="/tmp/pcrsign-public.pem" --phase=quux:waldo --append="/tmp/pcrsign.sig4" >"/tmp/pcrsign.sig5" (! cmp "/tmp/pcrsign.sig4" "/tmp/pcrsign.sig5") # Should still be good to unlock, given the old entry still exists SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=0 systemd-cryptsetup attach test-volume2 "$IMAGE" - tpm2-device=auto,tpm2-signature="/tmp/pcrsign.sig5",headless=1 systemd-cryptsetup detach test-volume2 # Adding both signatures once more should not change anything, due to the deduplication "$SD_MEASURE" sign --current "${MEASURE_BANKS[@]}" --private-key="/tmp/pcrsign-private.pem" --public-key="/tmp/pcrsign-public.pem" --phase=: --append="/tmp/pcrsign.sig5" >"/tmp/pcrsign.sig6" "$SD_MEASURE" sign --current "${MEASURE_BANKS[@]}" --private-key="/tmp/pcrsign-private.pem" --public-key="/tmp/pcrsign-public.pem" --phase=quux:waldo --append="/tmp/pcrsign.sig6" >"/tmp/pcrsign.sig7" cmp "/tmp/pcrsign.sig5" "/tmp/pcrsign.sig7" # Enroll a keyslot bound to a policyref systemd-cryptenroll --wipe-slot=tpm2 "$IMAGE" systemd-cryptenroll --unlock-key-file=/tmp/passphrase --tpm2-device=auto --tpm2-public-key="/tmp/pcrsign-public.pem" --tpm2-public-key-policyref="foo" "$IMAGE" # Unlocking should fail initially as there is no signature for this policyref (! SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=0 systemd-cryptsetup attach test-volume2 "$IMAGE" - tpm2-device=auto,tpm2-signature="/tmp/pcrsign.sig3",headless=1) (! SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=1 systemd-cryptsetup attach test-volume2 "$IMAGE" - tpm2-device=auto,tpm2-signature="/tmp/pcrsign.sig3",headless=1) # Create a signature for a new phase with the enrolled policyref "$SD_MEASURE" sign --current "${MEASURE_BANKS[@]}" --private-key="/tmp/pcrsign-private.pem" --public-key="/tmp/pcrsign-public.pem" --phase=: --policyref="foo" --append="/tmp/pcrsign.sig3" >"/tmp/pcrsign.sig8" (! cmp "/tmp/pcrsign.sig3" "/tmp/pcrsign.sig8") # Unlocking should work now SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=0 systemd-cryptsetup attach test-volume2 "$IMAGE" - tpm2-device=auto,tpm2-signature="/tmp/pcrsign.sig8",headless=1 SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=0 systemd-cryptsetup detach test-volume2 SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=1 systemd-cryptsetup attach test-volume2 "$IMAGE" - tpm2-device=auto,tpm2-signature="/tmp/pcrsign.sig8",headless=1 SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=1 systemd-cryptsetup detach test-volume2 # After extending the PCR things should fail tpm2_pcrextend 11:sha256=0000000000000000000000000000000000000000000000000000000000000000 (! SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=0 systemd-cryptsetup attach test-volume2 "$IMAGE" - tpm2-device=auto,tpm2-signature="/tmp/pcrsign.sig8",headless=1) (! SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=1 systemd-cryptsetup attach test-volume2 "$IMAGE" - tpm2-device=auto,tpm2-signature="/tmp/pcrsign.sig8",headless=1) rm -f "$IMAGE" Found error in /usr/lib/systemd/tests/testdata/units/TEST-70-TPM2.cryptsetup.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-70-TPM2.cryptsetup.sh } at_exit() { set +e umount /tmp/dditest.mnt systemd-cryptsetup detach test-volume systemd-cryptsetup detach dditest # Evict the TPM primary key that we persisted if [[ -n "${PERSISTENT_HANDLE:-}" ]]; then -- if [[ -n "${DEVICE:-}" ]]; then systemd-dissect --detach "$DEVICE" fi rm -rf /tmp/dditest /tmp/dditest.mnt rm -f /tmp/dditest.raw "${IMAGE:-}" "${PRIMARY:-}" /tmp/passphrase /tmp/pcr.dat /tmp/srk.pub /tmp/srk2.pub } trap at_exit EXIT # Prepare a fresh disk image IMAGE="$(mktemp /tmp/systemd-cryptsetup-XXX.IMAGE)" truncate -s 20M "$IMAGE" echo -n passphrase >/tmp/passphrase echo -n wrong_passphrase >/tmp/wrong_passphrase # Change file mode to avoid "/tmp/passphrase has 0644 mode that is too permissive" messages chmod 0600 /tmp/passphrase /tmp/wrong_passphrase cryptsetup luksFormat -q --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --use-urandom "$IMAGE" /tmp/passphrase # Unlocking via keyfile systemd-cryptenroll --unlock-key-file=/tmp/passphrase --tpm2-device=auto --tpm2-public-key= --tpm2-pcrs=7 "$IMAGE" # Enroll unlock with SecureBoot (PCR 7) PCR policy PASSWORD=passphrase systemd-cryptenroll --tpm2-device=auto --tpm2-public-key= --tpm2-pcrs=7 "$IMAGE" systemd-cryptsetup attach test-volume "$IMAGE" - tpm2-device=auto,headless=1 systemd-cryptsetup detach test-volume -- systemd-cryptsetup attach test-volume "$IMAGE" - tpm2-device=auto,headless=1 systemd-cryptsetup detach test-volume # Now the interesting part, enrolling using a hash value that doesn't match the current PCR value systemd-cryptenroll --wipe-slot=tpm2 "$IMAGE" tpm2_pcrread -Q -o /tmp/pcr.dat sha256:12 CURRENT_PCR_VALUE=$(cat /sys/class/tpm/tpm0/pcr-sha256/12) EXPECTED_PCR_VALUE=$(cat /tmp/pcr.dat /tmp/pcr.dat | openssl dgst -sha256 -r | cut -d ' ' -f 1) PASSWORD=passphrase systemd-cryptenroll --tpm2-device=auto --tpm2-public-key= --tpm2-pcrs="12:sha256=$EXPECTED_PCR_VALUE" "$IMAGE" (! systemd-cryptsetup attach test-volume "$IMAGE" - tpm2-device=auto,headless=1) tpm2_pcrextend "12:sha256=$CURRENT_PCR_VALUE" systemd-cryptsetup attach test-volume "$IMAGE" - tpm2-device=auto,headless=1 systemd-cryptsetup detach test-volume # enroll TPM using device key instead of direct access, then verify unlock using TPM tpm2_pcrread -Q -o /tmp/pcr.dat sha256:12 CURRENT_PCR_VALUE=$(cat /sys/class/tpm/tpm0/pcr-sha256/12) tpm2_readpublic -c 0x81000001 -o /tmp/srk.pub systemd-analyze srk >/tmp/srk2.pub cmp /tmp/srk.pub /tmp/srk2.pub if [ -f /run/systemd/tpm2-srk-public-key.tpm2b_public ] ; then cmp /tmp/srk.pub /run/systemd/tpm2-srk-public-key.tpm2b_public fi # --tpm2-device-key= requires OpenSSL >= 3 with KDF-SS if openssl_supports_kdf SSKDF; then PASSWORD=passphrase systemd-cryptenroll --tpm2-device-key=/tmp/srk.pub --tpm2-public-key= --tpm2-pcrs="12:sha256=$CURRENT_PCR_VALUE" "$IMAGE" systemd-cryptsetup attach test-volume "$IMAGE" - tpm2-device=auto,headless=1 systemd-cryptsetup detach test-volume fi rm -f /tmp/pcr.dat /tmp/srk.pub fi # Use default (0) seal key handle systemd-cryptenroll --wipe-slot=tpm2 "$IMAGE" PASSWORD=passphrase systemd-cryptenroll --tpm2-device=auto --tpm2-public-key= --tpm2-seal-key-handle=0 "$IMAGE" -- (! PASSWORD=passphrase systemd-cryptenroll --tpm2-device=auto --tpm2-seal-key-handle=0x02000001 "$IMAGE") # HMAC/loaded session (! PASSWORD=passphrase systemd-cryptenroll --tpm2-device=auto --tpm2-seal-key-handle=0x03000001 "$IMAGE") # Policy/saved session (! PASSWORD=passphrase systemd-cryptenroll --tpm2-device=auto --tpm2-seal-key-handle=0x40000001 "$IMAGE") # Permanent # Use non-SRK persistent seal key handle (by creating/persisting new key) PRIMARY=/tmp/primary.ctx tpm2_createprimary -c "$PRIMARY" PERSISTENT_LINE=$(tpm2_evictcontrol -c "$PRIMARY" | grep persistent-handle) PERSISTENT_HANDLE="0x${PERSISTENT_LINE##*0x}" tpm2_flushcontext -t -- systemd-cryptsetup detach test-volume # --tpm2-device-key= requires OpenSSL >= 3 with KDF-SS if openssl_supports_kdf SSKDF; then # Make sure that --tpm2-device-key= also works with systemd-repart tpm2_readpublic -c 0x81000001 -o /tmp/srk.pub mkdir /tmp/dditest cat >/tmp/dditest/50-root.conf < /tmp/empty-pcrsig.json systemd-cryptenroll --wipe-slot=tpm2 "$IMAGE" # Token 1: unknown pubkey, unseal fails at signature lookup (ENXIO) PASSWORD=passphrase systemd-cryptenroll --tpm2-device=auto --tpm2-pcrlock= \ --tpm2-public-key=/tmp/unknown1.pem --tpm2-public-key-pcrs=11 "$IMAGE" # Token 2: unknown pubkey and unknown SRK (EREMOTE) PASSWORD=passphrase systemd-cryptenroll --tpm2-device-key=/tmp/unknown-srk.pub --tpm2-pcrlock= \ --tpm2-public-key=/tmp/unknown2.pem --tpm2-public-key-pcrs=11 "$IMAGE" # Token 3: no pubkey, current-PCR-7 policy, unseals successfully PASSWORD=passphrase systemd-cryptenroll --tpm2-device=auto --tpm2-pcrlock= --tpm2-public-key= --tpm2-pcrs=7 "$IMAGE" # Note: Not covered yet is a plain PCR mismatch, the NV index missing/corrupted, and different PCR masks. # This should iterate over the tokens reporting failures until we reach token 3. # Do it for both the token module and fallback path because iteration differs there. for mod in 1 0; do SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE=$mod \ systemd-cryptsetup attach test-volume "$IMAGE" - \ tpm2-device=auto,tpm2-signature=/tmp/empty-pcrsig.json,headless=1 systemd-cryptsetup detach test-volume done rm -f /tmp/unknown1.priv.pem /tmp/unknown1.pem /tmp/unknown2.priv.pem /tmp/unknown2.pem \ /tmp/unknown-srk.pub /tmp/unknown-srk.ctx /tmp/empty-pcrsig.json fi rm -f "$IMAGE" "$PRIMARY" /tmp/passphrase /tmp/wrong_passphrase Found error in /usr/lib/systemd/tests/testdata/units/TEST-70-TPM2.cryptsetup-measure.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-70-TPM2.cryptsetup-measure.sh systemd-cryptsetup detach test-volume rm -rf /run/systemd/system/systemd-pcrextend.socket.d systemctl daemon-reload systemctl restart systemd-pcrextend.socket rm -f "${IMAGE:-}" /tmp/passphrase /tmp/vk /tmp/vk-hmac.bin \ /tmp/oldpcr15 /tmp/newpcr15 /tmp/measure-bank.log } trap at_exit EXIT # The socket carries ConditionSecurity=measured-os, which does not hold in the -- EOF systemctl daemon-reload systemctl restart systemd-pcrextend.socket # Prepare a fresh LUKS2 volume unlocked by a passphrase keyfile IMAGE="$(mktemp /tmp/systemd-cryptsetup-measure-XXX.IMAGE)" truncate -s 20M "$IMAGE" echo -n passphrase >/tmp/passphrase chmod 0600 /tmp/passphrase cryptsetup luksFormat -q --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --use-urandom "$IMAGE" /tmp/passphrase UUID="$(cryptsetup luksUUID "$IMAGE")" # Extract the raw volume key so we can recompute the expected HMAC below. The # volume key is measured as HMAC(volume_key, prefix) rather than a plain hash # (see cryptsetup_get_volume_key_prefix()/cryptsetup_get_volume_key_id()). cryptsetup luksDump -q --dump-volume-key --volume-key-file=/tmp/vk --key-file=/tmp/passphrase "$IMAGE" VK_HEX="$(od -An -v -tx1 /tmp/vk | tr -d ' \n')" # prefix = "cryptsetup:" ":" ; "test-volume" # contains no ':' so it is unescaped. PREFIX="cryptsetup:test-volume:$UUID" # Expected measured digest for the sha256 bank: HMAC-SHA256(volume_key, prefix) printf '%s' "$PREFIX" | openssl dgst -binary -sha256 -mac HMAC -macopt "hexkey:$VK_HEX" >/tmp/vk-hmac.bin DIGEST_EXPECTED="$(od -An -v -tx1 /tmp/vk-hmac.bin | tr -d ' \n')" # Remember the current event log length so we can index the record we add. # (json-seq: each record is RS(0x1e)-prefixed, LF-suffixed.) The log is created # lazily on the first measurement, and this subtest may be the first thing to # measure (e.g. when run in isolation), so treat an absent log as zero records. RECORD_COUNT=0 if [[ -f /run/log/systemd/tpm2-measure.log ]]; then RECORD_COUNT="$(jq --seq --slurp '. | length' /dev/null Found error in /usr/lib/systemd/tests/testdata/units/TEST-70-TPM2.cryptenroll.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-70-TPM2.cryptenroll.sh set -o pipefail cryptenroll_wipe_and_check() {( set +o pipefail : >/tmp/cryptenroll.out systemd-cryptenroll "$@" |& tee /tmp/cryptenroll.out grep -qE "Wiped slot [[:digit:]]+" /tmp/cryptenroll.out )} at_exit() { rm -f "${IMAGE:-}" "${VL_IMAGE:-}" /tmp/cryptenroll.out /tmp/password } trap at_exit EXIT # There is an external issue with libcryptsetup on ppc64 that hits 95% of Ubuntu ppc64 test runs, so skip it -- echo "Skipping systemd-cryptenroll tests on ppc64le, see https://github.com/systemd/systemd/issues/27716" exit 77 fi export SYSTEMD_LOG_LEVEL=debug IMAGE="$(mktemp /tmp/systemd-cryptenroll-XXX.image)" truncate -s 20M "$IMAGE" echo -n password >/tmp/password # Change file mode to avoid "/tmp/password has 0644 mode that is too permissive" messages chmod 0600 /tmp/password cryptsetup luksFormat -q --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --use-urandom "$IMAGE" /tmp/password # Enroll additional tokens, keys, and passwords to exercise the list and wipe stuff # Use --tpm2-public-key= to suppress auto-loading any PCR public key from the host systemd-cryptenroll --unlock-key-file=/tmp/password --tpm2-device=auto --tpm2-public-key= "$IMAGE" NEWPASSWORD="" systemd-cryptenroll --unlock-key-file=/tmp/password --password "$IMAGE" NEWPASSWORD=foo systemd-cryptenroll --unlock-key-file=/tmp/password --password "$IMAGE" for _ in {0..9}; do systemd-cryptenroll --unlock-key-file=/tmp/password --recovery-key "$IMAGE" done PASSWORD="" NEWPIN=123456 systemd-cryptenroll --tpm2-device=auto --tpm2-public-key= --tpm2-with-pin=true "$IMAGE" # Do some basic checks before we start wiping stuff systemd-cryptenroll "$IMAGE" systemd-cryptenroll "$IMAGE" | grep password -- (! systemd-cryptenroll "$IMAGE" | grep recovery) # We shouldn't be able to wipe all keyslots without enrolling a new key first (! systemd-cryptenroll "$IMAGE" --wipe=all) PASSWORD=foo NEWPASSWORD=foo cryptenroll_wipe_and_check "$IMAGE" --password --wipe=all # Check if the newly (and only) enrolled password works (! systemd-cryptenroll --unlock-key-file=/tmp/password --recovery-key "$IMAGE") (! PASSWORD="" systemd-cryptenroll --recovery-key "$IMAGE") PASSWORD=foo systemd-cryptenroll --recovery-key "$IMAGE" systemd-cryptenroll --fido2-with-client-pin=false "$IMAGE" systemd-cryptenroll --fido2-with-user-presence=false "$IMAGE" -- # Change PIN on TPM2 enrollment PIN=1234 NEWPIN=4321 systemd-cryptenroll --unlock-tpm2-device=auto --tpm2-device=auto --tpm2-public-key= --tpm2-with-pin=yes "$IMAGE" PIN=4321 systemd-cryptenroll --unlock-tpm2-device=auto --recovery-key "$IMAGE" (! systemd-cryptenroll --fido2-with-client-pin=false) (! systemd-cryptenroll --fido2-with-user-presence=f "$IMAGE" /tmp/foo) (! systemd-cryptenroll --fido2-with-client-pin=1234 "$IMAGE") (! systemd-cryptenroll --fido2-with-user-presence=1234 "$IMAGE") (! systemd-cryptenroll --fido2-with-user-verification=1234 "$IMAGE") (! systemd-cryptenroll --tpm2-with-pin=1234 "$IMAGE") (! systemd-cryptenroll --recovery-key --password "$IMAGE") (! systemd-cryptenroll --password --recovery-key "$IMAGE") (! systemd-cryptenroll --password --fido2-device=auto "$IMAGE") (! systemd-cryptenroll --password --pkcs11-token-uri=auto "$IMAGE") (! systemd-cryptenroll --password --tpm2-device=auto "$IMAGE") (! systemd-cryptenroll --unlock-fido2-device=auto --unlock-fido2-device=auto "$IMAGE") (! systemd-cryptenroll --unlock-fido2-device=auto --unlock-key-file=/tmp/unlock "$IMAGE") (! systemd-cryptenroll --fido2-credential-algorithm=es512 "$IMAGE") (! systemd-cryptenroll --tpm2-public-key-pcrs=key "$IMAGE") (! systemd-cryptenroll --tpm2-pcrs=key "$IMAGE") (! systemd-cryptenroll --tpm2-pcrs=44+8 "$IMAGE") (! systemd-cryptenroll --tpm2-pcrs=hello "$IMAGE") -- rm -f "$IMAGE" # Exercise the io.systemd.CryptEnroll Varlink interface with calls equivalent to the command line ones above. CRYPTENROLL="$(command -v systemd-cryptenroll)" VL_ADDRESS="exec:$CRYPTENROLL" VL_IMAGE="$(mktemp /tmp/systemd-cryptenroll-varlink-XXX.image)" truncate -s 20M "$VL_IMAGE" cryptsetup luksFormat -q --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --use-urandom "$VL_IMAGE" /tmp/password # Enroll a recovery key, unlocking via key file (cf. systemd-cryptenroll --unlock-key-file= --recovery-key) varlinkctl call "$VL_ADDRESS" io.systemd.CryptEnroll.Enroll \ "{\"node\":\"$VL_IMAGE\",\"mechanism\":\"recovery\",\"unlockKeyFile\":\"/tmp/password\"}" | grep recoveryKey >/dev/null # Enroll a password, unlocking via key file (cf. NEWPASSWORD=… systemd-cryptenroll --unlock-key-file= --password) varlinkctl call "$VL_ADDRESS" io.systemd.CryptEnroll.Enroll \ "{\"node\":\"$VL_IMAGE\",\"mechanism\":\"password\",\"unlockKeyFile\":\"/tmp/password\",\"password\":\"varlinkpassword\"}" # Enroll a password, unlocking via the key file passed as a file descriptor instead of a path varlinkctl --push-fd=3 call "$VL_ADDRESS" io.systemd.CryptEnroll.Enroll \ "{\"node\":\"$VL_IMAGE\",\"mechanism\":\"password\",\"unlockKeyFileDescriptor\":0,\"password\":\"fdpassword\"}" 3/dev/null varlinkctl call --more "$VL_ADDRESS" io.systemd.CryptEnroll.ListSlots "{\"node\":\"$VL_IMAGE\"}" | grep '"type":"password"' >/dev/null # Enroll combined with a wipe of the recovery key slot (cf. systemd-cryptenroll --wipe-slot=recovery --password). # The recovery key slot just got wiped, so it should be reported back in the (non-empty) wipedSlots output. varlinkctl call "$VL_ADDRESS" io.systemd.CryptEnroll.Enroll \ "{\"node\":\"$VL_IMAGE\",\"mechanism\":\"password\",\"unlockKeyFile\":\"/tmp/password\",\"password\":\"wipepassword\",\"wipeTypes\":[\"recovery\"]}" | grep -E '"wipedSlots":\[[0-9]+(,[0-9]+)*\]' >/dev/null (! varlinkctl call --more "$VL_ADDRESS" io.systemd.CryptEnroll.ListSlots "{\"node\":\"$VL_IMAGE\"}" | grep '"type":"recovery"' >/dev/null) # ListSlots without 'more' is refused (! varlinkctl call "$VL_ADDRESS" io.systemd.CryptEnroll.ListSlots "{\"node\":\"$VL_IMAGE\"}") # PKCS#11 and TPM2 cannot be enrolled via this interface, so the Enroll() handler rejects them as invalid parameters (! varlinkctl call "$VL_ADDRESS" io.systemd.CryptEnroll.Enroll \ "{\"node\":\"$VL_IMAGE\",\"mechanism\":\"tpm2\",\"unlockKeyFile\":\"/tmp/password\"}") (! varlinkctl call "$VL_ADDRESS" io.systemd.CryptEnroll.Enroll \ "{\"node\":\"$VL_IMAGE\",\"mechanism\":\"pkcs11\",\"unlockKeyFile\":\"/tmp/password\"}") rm -f "$VL_IMAGE" Found error in /usr/lib/systemd/tests/testdata/units/TEST-70-TPM2.creds.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-70-TPM2.creds.sh set -o pipefail export SYSTEMD_LOG_LEVEL=debug at_exit() { rm -f /tmp/testdata /tmp/testdata.encrypted } trap at_exit EXIT # Ensure that sandboxing doesn't stop creds from being accessible echo "test" >/tmp/testdata systemd-creds encrypt /tmp/testdata /tmp/testdata.encrypted --with-key=tpm2 # LoadCredentialEncrypted systemd-run -p PrivateDevices=yes -p LoadCredentialEncrypted=testdata.encrypted:/tmp/testdata.encrypted --pipe --wait systemd-creds cat testdata.encrypted | cmp - /tmp/testdata # SetCredentialEncrypted systemd-run -p PrivateDevices=yes -p SetCredentialEncrypted=testdata.encrypted:"$(cat /tmp/testdata.encrypted)" --pipe --wait systemd-creds cat testdata.encrypted | cmp - /tmp/testdata Found error in /usr/lib/systemd/tests/testdata/units/TEST-68-PROPAGATE-EXIT-STATUS.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-68-PROPAGATE-EXIT-STATUS.sh ExecStart=true EOF # Script to check that when an OnSuccess= dependency fires, the correct # MONITOR* env variables are passed. cat >/tmp/check_on_success.sh <<"EOF" #!/usr/bin/env bash set -ex env | sort if [ "$MONITOR_SERVICE_RESULT" != "success" ]; then -- exit 1 fi exit 0 EOF chmod +x /tmp/check_on_success.sh cat >/run/systemd/system/testservice-success-exit-handler-68.service </run/systemd/system/testservice-success-exit-handler-68-template@.service </tmp/check_on_failure.sh <<"EOF" #!/usr/bin/env bash set -ex env | sort if [ "$MONITOR_SERVICE_RESULT" != "exit-code" ]; then -- exit 1 fi exit 0 EOF chmod +x /tmp/check_on_failure.sh cat >/run/systemd/system/testservice-failure-exit-handler-68.service </run/systemd/system/testservice-failure-exit-handler-68-template@.service </tmp/out1 chroot /tmp/root systemd-analyze cat-config systemd/system-preset >/tmp/out2 diff /tmp/out{1,2} fi # verify mkdir -p /tmp/img/usr/lib/systemd/system/ mkdir -p /tmp/img/opt/ touch /tmp/img/opt/script0.sh chmod +x /tmp/img/opt/script0.sh cat </tmp/img/usr/lib/systemd/system/testfile.service [Service] ExecStart = /opt/script0.sh EOF set +e # Default behaviour is to recurse through all dependencies when unit is loaded (! systemd-analyze verify --root=/tmp/img/ testfile.service) # As above, recurses through all dependencies when unit is loaded (! systemd-analyze verify --recursive-errors=yes --root=/tmp/img/ testfile.service) # Recurses through unit file and its direct dependencies when unit is loaded (! systemd-analyze verify --recursive-errors=one --root=/tmp/img/ testfile.service) set -e # zero exit status since dependencies are ignored when unit is loaded systemd-analyze verify --recursive-errors=no --root=/tmp/img/ testfile.service rm /tmp/img/usr/lib/systemd/system/testfile.service cat </tmp/testfile.service [Unit] foo = bar [Service] ExecStart = echo hello EOF cat </tmp/testfile2.service [Unit] Requires = testfile.service [Service] ExecStart = echo hello EOF # Zero exit status since no additional dependencies are recursively loaded when the unit file is loaded systemd-analyze verify --recursive-errors=no /tmp/testfile2.service set +e # Non-zero exit status since all associated dependencies are recursively loaded when the unit file is loaded (! systemd-analyze verify --recursive-errors=yes /tmp/testfile2.service) set -e rm /tmp/testfile.service rm /tmp/testfile2.service cat </tmp/sample.service [Unit] Description = A Sample Service [Service] ExecStart = echo hello Slice=support.slice EOF # Zero exit status since no additional dependencies are recursively loaded when the unit file is loaded systemd-analyze verify --recursive-errors=no /tmp/sample.service cat </tmp/testfile.service [Service] ExecStart = echo hello DeviceAllow=/dev/sda EOF # Prevent regression from #13380 and #20859 where we can't verify hidden files cp /tmp/testfile.service /tmp/.testfile.service systemd-analyze verify /tmp/.testfile.service rm /tmp/.testfile.service # Alias a unit file's name on disk (see #20061) cp /tmp/testfile.service /tmp/testsrvc (! systemd-analyze verify /tmp/testsrvc) systemd-analyze verify /tmp/testsrvc:alias.service # Zero exit status since the value used for comparison determine exposure to security threats is by default 100 systemd-analyze security --offline=true /tmp/testfile.service #The overall exposure level assigned to the unit is greater than the set threshold (! systemd-analyze security --threshold=90 --offline=true /tmp/testfile.service) # Ensure we print the list of ACLs, see https://github.com/systemd/systemd/issues/23185 systemd-analyze security --offline=true /tmp/testfile.service | grep -F "/dev/sda" >/dev/null # Make sure that running generators under systemd-analyze verify works. # Note: sd-analyze spawns generators in a sandbox which makes gcov unhapy, so temporarily override # $GCOV_PREFIX to make it skip generating any coverage reports GCOV_PREFIX=/tmp systemd-analyze verify --generators /tmp/testfile.service rm /tmp/testfile.service cat </tmp/img/usr/lib/systemd/system/testfile.service [Service] ExecStart = echo hello PrivateNetwork = yes PrivateDevices = yes PrivateUsers = yes EOF # The new overall exposure level assigned to the unit is less than the set thresholds # Verifies that the --offline= option works with --root= systemd-analyze security --threshold=90 --offline=true --root=/tmp/img/ testfile.service cat </tmp/foo@.service [Service] ExecStart=ls EOF cat </tmp/hoge@test.service [Service] ExecStart=ls EOF # issue #30357 -- systemd-analyze verify tmp/hoge@test.service (! systemd-analyze verify tmp/hoge@nonexist.service) (! systemd-analyze verify tmp/hoge@.service) popd pushd /usr systemd-analyze verify ../tmp/foo@bar.service systemd-analyze verify ../tmp/foo@.service systemd-analyze verify ../tmp/hoge@test.service (! systemd-analyze verify ../tmp/hoge@nonexist.service) (! systemd-analyze verify ../tmp/hoge@.service) popd systemd-analyze verify /tmp/foo@bar.service systemd-analyze verify /tmp/foo@.service systemd-analyze verify /tmp/hoge@test.service (! systemd-analyze verify /tmp/hoge@nonexist.service) (! systemd-analyze verify /tmp/hoge@.service) # test that all commands are verified. cat </tmp/multi-exec-start.service [Service] Type=oneshot ExecStart=true ExecStart=ls EOF systemd-analyze verify /tmp/multi-exec-start.service echo 'ExecStart=command-should-not-exist' >>/tmp/multi-exec-start.service (! systemd-analyze verify /tmp/multi-exec-start.service) # Prevent regression from #20233 where systemd-analyze will return nonzero exit codes on warnings # Unit file with warning "Unknown key name 'foo' in section 'Unit', ignoring" cat </tmp/testwarnings.service [Unit] Foo=Bar [Service] ExecStart=echo hello EOF # yes/no/one should all return nonzero exit status for warnings in unit file (! systemd-analyze verify --recursive-errors=yes /tmp/testwarnings.service) (! systemd-analyze verify --recursive-errors=no /tmp/testwarnings.service) (! systemd-analyze verify --recursive-errors=one /tmp/testwarnings.service) # zero exit status since no errors and only warnings systemd-analyze verify /tmp/testwarnings.service rm /tmp/testwarnings.service TESTDATA=/usr/lib/systemd/tests/testdata/TEST-65-ANALYZE.units systemd-analyze verify "${TESTDATA}/loopy.service" systemd-analyze verify "${TESTDATA}/loopy2.service" systemd-analyze verify "${TESTDATA}/loopy3.service" -- # The PrivateNetwork id description and weight was changed to verify that 'security' is actually reading in # values from the .json file when required. The default weight for "PrivateNetwork" is 2500, and the new weight # assigned to that id in the .json file is 6000. This increased weight means that when the "PrivateNetwork" key is # set to 'yes' (as above in the case of testfile.service) in the content of the unit file, the overall exposure # level for the unit file should decrease to account for that increased weight. cat </tmp/testfile.json {"UserOrDynamicUser": {"description_bad": "Service runs as root user", "weight": 0, "range": 10 }, -- } EOF # Reads in custom security requirements from the parsed .json file and uses these for comparison systemd-analyze security --threshold=90 --offline=true \ --security-policy=/tmp/testfile.json \ --root=/tmp/img/ testfile.service # The strict profile adds a lot of sandboxing options systemd-analyze security --threshold=25 --offline=true \ --security-policy=/tmp/testfile.json \ --profile=strict \ --root=/tmp/img/ testfile.service # The trusted profile doesn't add any sandboxing options (! systemd-analyze security --threshold=25 --offline=true \ --security-policy=/tmp/testfile.json \ --profile=/usr/lib/systemd/portable/profile/trusted/service.conf \ --root=/tmp/img/ testfile.service) (! systemd-analyze security --threshold=50 --offline=true \ --security-policy=/tmp/testfile.json \ --root=/tmp/img/ testfile.service) rm /tmp/img/usr/lib/systemd/system/testfile.service if systemd-analyze --version | grep -F "+ELFUTILS" >/dev/null; then systemd-analyze inspect-elf /lib/systemd/systemd systemd-analyze inspect-elf --json=short /lib/systemd/systemd | grep -F '"elfType":"executable"' >/dev/null -- [Unit] Description=Test unit for systemd-analyze unit-shell [Service] Type=notify NotifyAccess=all ExecStart=bash -c "echo 'Hello from test unit' >/tmp/testfile; systemd-notify --ready; sleep infinity" PrivateTmp=disconnected EOF # Start the service systemctl start "$UNIT_NAME" # Wait for the service to be active systemctl is-active --quiet "$UNIT_NAME" # Verify the service is active and has a MainPID MAIN_PID=$(systemctl show -p MainPID --value "$UNIT_NAME") [ "$MAIN_PID" -gt 0 ] # Test systemd-analyze unit-shell with a command (cat /tmp/testfile) OUTPUT=$(systemd-analyze unit-shell "$UNIT_NAME" cat /tmp/testfile) assert_in "Hello from test unit" "$OUTPUT" touch /testok Found error in /usr/lib/systemd/tests/testdata/units/TEST-63-PATH.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-63-PATH.sh # shellcheck source=test/units/util.sh . "$(dirname "$0")"/util.sh # Test that a path unit continuously triggering a service that fails condition checks eventually fails with # the trigger-limit-hit error. rm -f /tmp/nonexistent systemctl start test63.path touch /tmp/test63 # Make sure systemd has sufficient time to hit the trigger limit for test63.path. # shellcheck disable=SC2016 timeout 30 bash -c 'until test "$(systemctl show test63.path -P ActiveState)" = failed; do sleep .2; done' test "$(systemctl show test63.service -P ActiveState)" = inactive test "$(systemctl show test63.service -P Result)" = success test "$(systemctl show test63.path -P Result)" = trigger-limit-hit # Test that starting the service manually doesn't affect the path unit. rm -f /tmp/test63 systemctl reset-failed systemctl start test63.path systemctl start test63.service test "$(systemctl show test63.service -P ActiveState)" = inactive test "$(systemctl show test63.service -P Result)" = success test "$(systemctl show test63.path -P ActiveState)" = active test "$(systemctl show test63.path -P Result)" = success # Test that glob matching works too, with $TRIGGER_PATH systemctl start test63-glob.path touch /tmp/test63-glob-foo timeout 60 bash -c 'until systemctl -q is-active test63-glob.service; do sleep .2; done' test "$(systemctl show test63-glob.service -P ActiveState)" = active test "$(systemctl show test63-glob.service -P Result)" = success test "$(busctl --json=short get-property org.freedesktop.systemd1 /org/freedesktop/systemd1/unit/test63_2dglob_2eservice org.freedesktop.systemd1.Unit ActivationDetails)" = '{"type":"a(ss)","data":[["trigger_unit","test63-glob.path"],["trigger_path","/tmp/test63-glob-foo"]]}' systemctl stop test63-glob.path test63-glob.service test "$(busctl --json=short get-property org.freedesktop.systemd1 /org/freedesktop/systemd1/unit/test63_2dglob_2eservice org.freedesktop.systemd1.Unit ActivationDetails)" = '{"type":"a(ss)","data":[]}' # tests for issue https://github.com/systemd/systemd/issues/24577#issuecomment-1522628906 rm -f /tmp/hoge systemctl start test63-issue-24577.path systemctl status -n 0 test63-issue-24577.path systemctl status -n 0 test63-issue-24577.service || : systemctl list-jobs output=$(systemctl list-jobs --no-legend) assert_not_in "test63-issue-24577.service" "$output" assert_not_in "test63-issue-24577-dep.service" "$output" touch /tmp/hoge systemctl status -n 0 test63-issue-24577.path systemctl status -n 0 test63-issue-24577.service || : systemctl list-jobs output=$(systemctl list-jobs --no-legend) assert_in "test63-issue-24577.service" "$output" -- systemctl list-jobs output=$(systemctl list-jobs --no-legend) assert_in "test63-issue-24577.service" "$output" assert_in "test63-issue-24577-dep.service" "$output" rm -f /tmp/hoge systemctl stop test63-issue-24577.service systemctl status -n 0 test63-issue-24577.path systemctl status -n 0 test63-issue-24577.service || : systemctl list-jobs output=$(systemctl list-jobs --no-legend) -- assert_in "test63-issue-24577-dep.service" "$output" # Test for race condition fixed by https://github.com/systemd/systemd/pull/30768 # Here's the schedule of events that we to happen during this test: # (This test) (The service) # .path unit monitors /tmp/copyme for changes # Take lock on /tmp/noexeit ↓ # Write to /tmp/copyme ↓ # Wait for deactivating Started # ↓ Copies /tmp/copyme to /tmp/copied # ↓ Tells manager it's shutting down # Ensure service did the copy Tries to lock /tmp/noexit and blocks # Write to /tmp/copyme ↓ # # Now at this point the test can diverge. If we regress, this second write is # missed and we'll see: # ... (second write) ... (blocked) # Drop lock on /tmp/noexit ↓ # Wait for service to do copy Unblocks and exits # ↓ (dead) # ↓ # (timeout) # Test fails # # Otherwise, we'll see: # ... (second write) ... (blocked) # Drop lock on /tmp/noexit ↓ and .path unit queues a new start job # Wait for service to do copy Unblocks and exits # ↓ Starts again b/c of queued job # ↓ Copies again # Test Passes systemctl start test63-pr-30768.path exec {lock}<>/tmp/noexit flock -e $lock echo test1 >/tmp/copyme # shellcheck disable=SC2016 timeout 30 bash -c 'until test "$(systemctl show test63-pr-30768.service -P ActiveState)" = deactivating; do sleep .2; done' diff /tmp/copyme /tmp/copied echo test2 >/tmp/copyme exec {lock}<&- timeout 30 bash -c 'until diff /tmp/copyme /tmp/copied >/dev/null; do sleep .2; done' touch /testok Found error in /usr/lib/systemd/tests/testdata/units/TEST-55-OOMD.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-55-OOMD.sh systemctl daemon-reload } testcase_duration_analyze() { # Verify memory pressure duration is valid if >= 1 second cat </tmp/TEST-55-OOMD-valid-duration.service [Service] ExecStart=echo hello ManagedOOMMemoryPressureDurationSec=1s EOF # Verify memory pressure duration is invalid if < 1 second cat </tmp/TEST-55-OOMD-invalid-duration.service [Service] ExecStart=echo hello ManagedOOMMemoryPressureDurationSec=0 EOF systemd-analyze --recursive-errors=no verify /tmp/TEST-55-OOMD-valid-duration.service (! systemd-analyze --recursive-errors=no verify /tmp/TEST-55-OOMD-invalid-duration.service) rm -f /tmp/TEST-55-OOMD-valid-duration.service rm -f /tmp/TEST-55-OOMD-invalid-duration.service } testcase_duration_override() { # Verify memory pressure duration can be overridden to non-zero values [[ "$STRESS_NG_BROKEN" == "1" ]] && { echo "stress-ng is broken on this host, skipping ${FUNCNAME[0]}"; return 0; } -- assert_in 'Default Memory Pressure Limit: 60.00%' "$(oomctl)" assert_in 'Default Memory Pressure Duration: 2s' "$(oomctl)" } testcase_kernel_oom() { cat >/tmp/script.sh <<"EOF" #!/usr/bin/env bash set -x choom --adjust '+1000' -- bash -c 'echo f >/proc/sysrq-trigger && exec sleep infinity' choom --adjust '+1000' -p $$ echo f >/proc/sysrq-trigger exec sleep infinity EOF chmod +x /tmp/script.sh (! systemd-run --wait --unit oom-kill -p OOMPolicy=continue /tmp/script.sh) # With OOMPolicy=continue, we shouldn't get the oom-kill result. assert_eq "$(systemctl show oom-kill -P Result)" "signal" # Check that OOMKills reports 2 individual processes killed. assert_eq "$(systemctl show oom-kill -P OOMKills)" "2" systemctl reset-failed (! systemd-run --wait --unit oom-kill -p OOMPolicy=kill /tmp/script.sh) # Check that a regular kernel oom kill with OOMPolicy=kill results in the oom-kill result. assert_eq "$(systemctl show oom-kill -P Result)" "oom-kill" # Check that OOMKills reports 1 oom group kill instead of the number of processes that were killed. assert_eq "$(systemctl show oom-kill -P OOMKills)" "1" systemctl reset-failed cat >/tmp/script.sh <<"EOF" #!/usr/bin/env bash set -x echo '+memory' >/sys/fs/cgroup/system.slice/oom-kill.service/cgroup.subtree_control mkdir /sys/fs/cgroup/system.slice/oom-kill.service/sub echo 1 >/sys/fs/cgroup/system.slice/oom-kill.service/sub/memory.oom.group -- exec sleep infinity ) & wait $! || : exec sleep infinity EOF chmod +x /tmp/script.sh (! systemd-run --wait --unit oom-kill -p OOMPolicy=kill -p Delegate=yes -p DelegateSubgroup=init.scope /tmp/script.sh) # Test that an oom-kill in a delegated unit in a subcgroup with memory.oom.group=1 also results in the # oom-kill exit status. assert_eq "$(systemctl show oom-kill -P Result)" "oom-kill" assert_eq "$(systemctl show oom-kill -P OOMKills)" "1" systemctl reset-failed -- systemctl reload systemd-oomd.service ! systemctl start --wait TEST-55-OOMD-testbloat.service || exit 1 # one hook mkdir -p /run/systemd/oomd.prekill.hook/ socat -u UNIX-LISTEN:/run/systemd/oomd.prekill.hook/althook STDOUT >/tmp/oomd_event.json & ! systemctl start --wait TEST-55-OOMD-testbloat.service || exit 1 [[ $(jq -r .method "/tmp/oomd_event$i.json" & done ! systemctl start --wait TEST-55-OOMD-testbloat.service || exit 1 for j in /tmp/oomd_event*.json; do [[ $(jq -r .method <"$j") = 'io.systemd.oom.Prekill.Notify' ]] done } run_testcases Found error in /usr/lib/systemd/tests/testdata/units/TEST-54-CREDS.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-54-CREDS.sh diff "$log_file" <(echo -ne "$exp") ) test_mount_with_credential() { local credfile tmpdir unit mount_path mount_test credfile="/tmp/mount-cred" tmpdir="/tmp/test-54-mount" unit=$(systemd-escape --suffix mount --path "$tmpdir") echo foo >"$credfile" mkdir -p "$tmpdir" -- # Sanity checks # # Create a dummy "full" disk (similar to /dev/full) to check out-of-space # scenarios mkdir /tmp/full mount -t tmpfs -o size=1,nr_inodes=1 tmpfs /tmp/full # verb: setup # Run this first, otherwise any encrypted credentials wouldn't be decryptable # as we regenerate the host key rm -fv /var/lib/systemd/credential.secret -- echo foo >"$CRED_DIR/insecure" echo foo | systemd-creds --name="encrypted" encrypt - "$ENC_CRED_DIR/encrypted" echo foo | systemd-creds encrypt - "$ENC_CRED_DIR/encrypted-unnamed" chmod -R 0400 "$CRED_DIR" "$ENC_CRED_DIR" chmod -R 0444 "$CRED_DIR/insecure" mkdir /tmp/empty/ systemd-creds --system systemd-creds --no-pager --help systemd-creds --version systemd-creds has-tpm2 || : -- systemd-creds list --system ENCRYPTED_CREDENTIALS_DIRECTORY="$ENC_CRED_DIR" CREDENTIALS_DIRECTORY="$CRED_DIR" systemd-creds list --no-legend ENCRYPTED_CREDENTIALS_DIRECTORY="$ENC_CRED_DIR" CREDENTIALS_DIRECTORY="$CRED_DIR" systemd-creds list --json=pretty | jq ENCRYPTED_CREDENTIALS_DIRECTORY="$ENC_CRED_DIR" CREDENTIALS_DIRECTORY="$CRED_DIR" systemd-creds list --json=short | jq ENCRYPTED_CREDENTIALS_DIRECTORY="$ENC_CRED_DIR" CREDENTIALS_DIRECTORY="$CRED_DIR" systemd-creds list --json=off ENCRYPTED_CREDENTIALS_DIRECTORY="/tmp/empty/" CREDENTIALS_DIRECTORY="/tmp/empty/" systemd-creds list # verb: cat for cred in secure-or-weak insecure encrypted encrypted-unnamed; do ENCRYPTED_CREDENTIALS_DIRECTORY="$ENC_CRED_DIR" CREDENTIALS_DIRECTORY="$CRED_DIR" systemd-creds cat "$cred" done -- run_with_cred_compare "mycred:68656c6c6f0a776f726c64" "hello\nworld" --transcode=unhex cat mycred run_with_cred_compare 'mycred:{ "foo" : "bar", "baz" : [ 3, 4 ] }' '{"foo":"bar","baz":[3,4]}\n' --json=short cat mycred systemd-run -p SetCredential='mycred:{ "foo" : "bar", "baz" : [ 3, 4 ] }' --wait --pipe -- systemd-creds --json=pretty cat mycred | jq # verb: encrypt/decrypt echo "According to all known laws of aviation..." >/tmp/cred.orig systemd-creds --with-key=host encrypt /tmp/cred.orig /tmp/cred.enc systemd-creds decrypt /tmp/cred.enc /tmp/cred.dec diff /tmp/cred.orig /tmp/cred.dec rm -f /tmp/cred.{enc,dec} # --pretty cred_name="fo'''o''bar" cred_option="$(systemd-creds --pretty --name="$cred_name" encrypt /tmp/cred.orig -)" mkdir -p /run/systemd/system cat >/run/systemd/system/test-54-pretty-cred.service </tmp/ts54-concat (cat /etc/passwd /etc/shadow && echo -n wuff) | cmp /tmp/ts54-concat rm /tmp/ts54-concat # Test that SetCredential= acts as fallback for LoadCredential= echo piff >/tmp/ts54-fallback [ "$(systemd-run -p LoadCredential=paff:/tmp/ts54-fallback -p SetCredential=paff:poff --pipe --wait systemd-creds cat paff)" = "piff" ] rm /tmp/ts54-fallback [ "$(systemd-run -p LoadCredential=paff:/tmp/ts54-fallback -p SetCredential=paff:poff --pipe --wait systemd-creds cat paff)" = "poff" ] if systemd-detect-virt -q -c ; then expected_credential=mynspawncredential expected_value=strangevalue elif [ -d /sys/firmware/qemu_fw_cfg/by_name ]; then -- # Verify that creating a user via sysusers via the kernel cmdline worked grep -q ^credtestuser: /etc/passwd # Verify that writing a file via tmpfiles worked [ "$(cat /tmp/sourcedfromcredential)" = "tmpfilessecret" ] [ "$(cat /etc/motd.d/50-provision.conf)" = "hello" ] [ "$(cat /etc/issue.d/50-provision.conf)" = "welcome" ] # Verify that adding a unit and drop-in via credentials worked systemctl start my-service test -f /tmp/unit-cred test -f /tmp/unit-dropin test -f /tmp/unit-named-dropin else echo "qemu_fw_cfg support missing in kernel. Sniff!" expected_credential="" expected_value="" fi -- --unit=test-54-immutable-rm.service \ --wait \ rm '${CREDENTIALS_DIRECTORY}/passwd') # Check directory-based loading mkdir -p /tmp/ts54-creds/sub echo -n a >/tmp/ts54-creds/foo echo -n b >/tmp/ts54-creds/bar echo -n c >/tmp/ts54-creds/baz echo -n d >/tmp/ts54-creds/sub/qux systemd-run -p LoadCredential=cred:/tmp/ts54-creds \ -p DynamicUser=1 \ --unit=test-54-dir.service \ --wait \ --pipe \ cat '${CREDENTIALS_DIRECTORY}/cred_foo' \ '${CREDENTIALS_DIRECTORY}/cred_bar' \ '${CREDENTIALS_DIRECTORY}/cred_baz' \ '${CREDENTIALS_DIRECTORY}/cred_sub_qux' >/tmp/ts54-concat cmp /tmp/ts54-concat <(echo -n abcd) rm /tmp/ts54-concat rm -rf /tmp/ts54-creds # Check that globs work as expected mkdir -p /run/credstore echo -n a >/run/credstore/test.creds.first # Make sure that when multiple credentials of the same name are found, the first one is used (/etc/credstore -- -p DynamicUser=1 \ --wait \ --pipe \ cat '${CREDENTIALS_DIRECTORY}/test.creds.first' \ '${CREDENTIALS_DIRECTORY}/test.creds.second' \ '${CREDENTIALS_DIRECTORY}/test.creds.third' >/tmp/ts54-concat cmp /tmp/ts54-concat <(echo -n abc) # Check that ImportCredential= works without renaming. systemd-run -p "ImportCredential=test.creds.*" \ --unit=test-54-ImportCredential.service \ -p DynamicUser=1 \ --wait \ --pipe \ cat '${CREDENTIALS_DIRECTORY}/test.creds.first' \ '${CREDENTIALS_DIRECTORY}/test.creds.second' \ '${CREDENTIALS_DIRECTORY}/test.creds.third' >/tmp/ts54-concat cmp /tmp/ts54-concat <(echo -n abc) # Check that renaming with globs works as expected. systemd-run -p "ImportCredential=test.creds.*:renamed.creds." \ --unit=test-54-ImportCredential.service \ -p DynamicUser=1 \ --wait \ --pipe \ cat '${CREDENTIALS_DIRECTORY}/renamed.creds.first' \ '${CREDENTIALS_DIRECTORY}/renamed.creds.second' \ '${CREDENTIALS_DIRECTORY}/renamed.creds.third' >/tmp/ts54-concat cmp /tmp/ts54-concat <(echo -n abc) # Check that renaming without globs works as expected. systemd-run -p "ImportCredential=test.creds.first:renamed.creds.first" \ --unit=test-54-ImportCredential.service \ -p DynamicUser=1 \ --wait \ --pipe \ cat '${CREDENTIALS_DIRECTORY}/renamed.creds.first' >/tmp/ts54-concat cmp /tmp/ts54-concat <(echo -n a) # Test that multiple renames are processed in the correct order. systemd-run -p "ImportCredential=test.creds.first:renamed.creds.first" \ -p "ImportCredential=test.creds.second:renamed.creds.first" \ --unit=test-54-ImportCredential.service \ -p DynamicUser=1 \ --wait \ --pipe \ cat '${CREDENTIALS_DIRECTORY}/renamed.creds.first' >/tmp/ts54-concat cmp /tmp/ts54-concat <(echo -n a) # Test that a credential can be imported multiple times with different names. # We use the deprecated name ImportCredentialEx= on purpose to check that it works. systemd-run -p "ImportCredentialEx=test.creds.first" \ -p "ImportCredentialEx=test.creds.first:renamed.creds.first" \ -- -p DynamicUser=1 \ --wait \ --pipe \ cat '${CREDENTIALS_DIRECTORY}/test.creds.first' \ '${CREDENTIALS_DIRECTORY}/renamed.creds.first' \ '${CREDENTIALS_DIRECTORY}/renamed.creds.second' >/tmp/ts54-concat cmp /tmp/ts54-concat <(echo -n aaa) # Now test encrypted credentials (only supported when built with OpenSSL though) if systemctl --version | grep -- +OPENSSL >/dev/null; then echo -n $RANDOM >/tmp/test-54-plaintext systemd-creds encrypt --name=test-54 /tmp/test-54-plaintext /tmp/test-54-ciphertext systemd-creds decrypt --name=test-54 /tmp/test-54-ciphertext | cmp /tmp/test-54-plaintext systemd-run -p LoadCredentialEncrypted=test-54:/tmp/test-54-ciphertext \ --wait \ --pipe \ cat '${CREDENTIALS_DIRECTORY}/test-54' | cmp /tmp/test-54-plaintext echo -n $RANDOM >/tmp/test-54-plaintext systemd-creds encrypt --name=test-54 /tmp/test-54-plaintext /tmp/test-54-ciphertext systemd-creds decrypt --name=test-54 /tmp/test-54-ciphertext | cmp /tmp/test-54-plaintext systemd-run -p SetCredentialEncrypted=test-54:"$(cat /tmp/test-54-ciphertext)" \ --wait \ --pipe \ cat '${CREDENTIALS_DIRECTORY}/test-54' | cmp /tmp/test-54-plaintext rm /tmp/test-54-plaintext /tmp/test-54-ciphertext fi # https://github.com/systemd/systemd/issues/27275 systemd-run -p DynamicUser=yes -p 'LoadCredential=os:/etc/os-release' \ -p 'ExecStartPre=true' \ -- --service-type=oneshot --wait --pipe \ true | cmp /etc/os-release # https://github.com/systemd/systemd/pull/24734#issuecomment-1925440546 # Also ExecStartPre= should be able to update creds dd if=/dev/urandom of=/tmp/cred-huge bs=600K count=1 chmod 777 /tmp/cred-huge systemd-run -p ProtectSystem=full \ -p 'LoadCredential=huge:/tmp/cred-huge' \ -p 'ExecStartPre=true' \ -p 'ExecStartPre=bash -c "echo fresh >/tmp/cred-huge"' \ --unit=test-54-huge-cred.service \ --wait --pipe \ systemd-creds cat huge | cmp - <(echo "fresh") rm /tmp/cred-huge echo stable >/tmp/cred-stable systemd-run -p 'LoadCredential=stable:/tmp/cred-stable' \ -p 'ExecStartPost=systemd-creds cat stable' \ --unit=test-54-stable.service \ --service-type=oneshot --wait --pipe \ bash -c "echo bogus >/tmp/cred-stable" | cmp - <(echo "stable") assert_eq "$(cat /tmp/cred-stable)" "bogus" rm /tmp/cred-stable if ! systemd-detect-virt -q -c ; then # Validate that the credential we inserted via the initrd logic arrived test "$(systemd-creds cat --system myinitrdcred)" = "guatemala" -- fi # Decrypt/encrypt via varlink DATA="Zm9vYmFyCg==" echo "{\"data\":\"$DATA\"}" >/tmp/vlcredsdata varlinkctl call /run/systemd/io.systemd.Credentials io.systemd.Credentials.Encrypt "$(cat /tmp/vlcredsdata)" | \ varlinkctl call --json=short /run/systemd/io.systemd.Credentials io.systemd.Credentials.Decrypt >/tmp/vlcredsdata2 cmp /tmp/vlcredsdata /tmp/vlcredsdata2 rm /tmp/vlcredsdata2 # Pick a key type explicitly varlinkctl call /run/systemd/io.systemd.Credentials io.systemd.Credentials.Encrypt "{\"data\":\"$DATA\",\"withKey\":\"host\"}" | \ varlinkctl call --json=short /run/systemd/io.systemd.Credentials io.systemd.Credentials.Decrypt >/tmp/vlcredsdata2 cmp /tmp/vlcredsdata /tmp/vlcredsdata2 rm /tmp/vlcredsdata2 varlinkctl call /run/systemd/io.systemd.Credentials io.systemd.Credentials.Encrypt "{\"data\":\"$DATA\",\"withKey\":\"null\"}" | \ jq '.["allowNull"] = true' | varlinkctl call --json=short /run/systemd/io.systemd.Credentials io.systemd.Credentials.Decrypt >/tmp/vlcredsdata2 cmp /tmp/vlcredsdata /tmp/vlcredsdata2 rm /tmp/vlcredsdata /tmp/vlcredsdata2 # Ensure allowNull works (! varlinkctl call /run/systemd/io.systemd.Credentials io.systemd.Credentials.Encrypt "{\"data\":\"$DATA\",\"withKey\":\"null\"}" | \ jq '.["allowNull"] = false' | varlinkctl call --json=short /run/systemd/io.systemd.Credentials io.systemd.Credentials.Decrypt ) clean_usertest() { rm -f /tmp/usertest.data /tmp/usertest.data /tmp/brummbaer.data } trap clean_usertest EXIT dd if=/dev/urandom of=/tmp/usertest.data bs=4096 count=1 systemd-creds encrypt --user /tmp/usertest.data /tmp/usertest.cred systemd-creds decrypt --user /tmp/usertest.cred - | cmp /tmp/usertest.data # Decryption must fail if it's not done in user context (! systemd-creds decrypt /tmp/usertest.cred - ) # Decryption must also fail if a different user is used (! systemd-creds decrypt --user --uid=65534 /tmp/usertest.cred - ) # Try the reverse systemd-creds encrypt --user --uid=65534 /tmp/usertest.data /tmp/usertest.cred (! systemd-creds decrypt --user /tmp/usertest.cred - ) systemd-creds decrypt --user --uid=65534 /tmp/usertest.cred - | cmp /tmp/usertest.data systemd-creds encrypt --user /tmp/usertest.data /tmp/usertest.creds --name=mytest # Make sure we actually can decode this in user context systemctl start user@0.service XDG_RUNTIME_DIR=/run/user/0 systemd-run --pipe --user --unit=waldi.service -p LoadCredentialEncrypted=mytest:/tmp/usertest.creds cat /run/user/0/credentials/waldi.service/mytest | cmp /tmp/usertest.data # Test mount unit with credential test_mount_with_credential # Fully unpriv operation dd if=/dev/urandom of=/tmp/brummbaer.data bs=4096 count=1 run0 -u testuser --pipe mkdir -p /home/testuser/.config/credstore.encrypted run0 -u testuser --pipe systemd-creds encrypt --user --name=brummbaer - /home/testuser/.config/credstore.encrypted/brummbaer < /tmp/brummbaer.data run0 -u testuser --pipe systemd-run --user --pipe -p ImportCredential=brummbaer systemd-creds cat brummbaer | cmp /tmp/brummbaer.data # https://github.com/systemd/systemd/pull/40108 run0 -u testuser --pipe systemd-run --user --wait -p ImportCredential=brummbaer -p ExecStartPre='ls -l $CREDENTIALS_DIRECTORY' bash -c 'systemd-creds cat brummbaer | cmp /tmp/brummbaer.data' # https://github.com/systemd/systemd/pull/39651 TESTUSER_CRED_DIR="/run/user/$(id -u testuser)/credentials" PID="$(systemd-notify --fork -- systemd-run -M testuser@ --user --wait --unit=brummbaer.service -p LoadCredential=brummbaer sleep infinity)" -- kill "$PID" # Now test credential refreshing UNIT_NAME="TEST-54-CREDS-refreshing-$RANDOM.service" OUTPUT_FILE="/tmp/$UNIT_NAME.out" POST_FLAG_FILE="/tmp/$UNIT_NAME.post-flag" cat >/run/systemd/system/"$UNIT_NAME" </tmp/unpriv.raw.mtree # Run unpriv, should fail due to lack of privs (! runas testuser systemd-dissect /var/tmp/unpriv.raw) (! runas testuser systemd-dissect --mtree /var/tmp/unpriv.raw) if (SYSTEMD_LOG_TARGET=console varlinkctl call \ /run/systemd/userdb/io.systemd.NamespaceResource \ io.systemd.NamespaceResource.AllocateUserRange \ '{"name":"test-supported","size":65536,"userNamespaceFileDescriptor":0}' 2>&1 || true) | -- io.systemd.NamespaceResource.AllocateUserRange \ '{"name":"test-foreign2","size":65536,"userNamespaceFileDescriptor":0,"mapForeign":true}' \ -- cat /proc/self/uid_map | grep -c 2147352576)" -eq 1 # This should work without the key systemd-dissect --image-policy='root=verity:=absent+unused' --mtree /var/tmp/unpriv.raw >/dev/null systemd-dissect --image-policy='root=verity+signed:=absent+unused' --mtree /var/tmp/unpriv.raw >/dev/null # This should fail before we install the key (! systemd-dissect --image-policy='root=signed:=absent+unused' --mtree /var/tmp/unpriv.raw >/dev/null) # If the kernel support is present unprivileged user units should be able to use verity images too if [ "$VERITY_SIG_SUPPORTED" -eq 1 ]; then systemd-run -M testuser@ --user --pipe --wait \ --property RootImage="$MINIMAL_IMAGE.gpt" \ test -e "/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity" systemd-run -M testuser@ --user --pipe --wait \ --property RootImage="$MINIMAL_IMAGE.raw" \ --property ExtensionImages=/tmp/app0.raw \ bash -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(/etc/polkit-1/rules.d/mountoptions.rules <<'EOF' polkit.addRule(function(action, subject) { -- --property RootImageOptions="root:nosuid" \ sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && mount | grep -F squashfs | grep -F nosuid >/dev/null" systemd-run -M testuser@ --user --pipe --wait \ --property RootImage="$MINIMAL_IMAGE.raw" \ --property ExtensionImages=/tmp/app0.raw \ --property MountImages=/tmp/app0.raw:/var/tmp:nosuid \ sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(/dev/null" rm -f /etc/polkit-1/rules.d/mountoptions.rules systemctl try-reload-or-restart polkit.service fi # Bare squashfs without any verity or signature also should be rejected, even if we ask to trust it (! systemd-run -M testuser@ --user --pipe --wait \ --property ExtensionImages=/tmp/app1.raw \ true) (! systemd-run -M testuser@ --user --pipe --wait \ --property ExtensionImages=/tmp/app1.raw \ --property ExtensionImagePolicy=root=verity+signed+unprotected+absent:usr=verity+signed+unprotected+absent \ true) # Install key in keychain mkdir -p /run/verity.d cp /tmp/test-50-unpriv-cert.crt /run/verity.d/ # This should work now systemd-dissect --image-policy='root=signed:=absent+unused' --mtree /var/tmp/unpriv.raw >/dev/null # This should still work systemd-dissect --image-policy='root=verity:=absent+unused' --mtree /var/tmp/unpriv.raw >/dev/null systemd-dissect --image-policy='root=verity+signed:=absent+unused' --mtree /var/tmp/unpriv.raw >/dev/null # Now run unpriv again, should be OK now. runas testuser systemd-dissect /var/tmp/unpriv.raw runas testuser systemd-dissect --mtree /var/tmp/unpriv.raw >/tmp/unpriv2.raw.mtree # Check that unpriv and priv run yielded same results cmp /tmp/unpriv.raw.mtree /tmp/unpriv2.raw.mtree # Make sure nspawn works unpriv, too (for now do not nest) if ! systemd-detect-virt -c; then systemd-nspawn --pipe -i /var/tmp/unpriv.raw --read-only echo thisisatest >/tmp/unpriv.out echo thisisatest | cmp /tmp/unpriv.out - # The unpriv user has no rights to lock the image or write to it. Let's # turn off both for this test, so that we don't have to copy the image # around. systemd-run -M testuser@ --user --pipe \ -p Environment=SYSTEMD_NSPAWN_LOCK=0 \ -p Delegate=1 \ -p DelegateSubgroup=supervisor \ -p Environment=SYSTEMD_LOG_LEVEL=debug \ --wait -- \ systemd-nspawn --keep-unit --register=no -i /var/tmp/unpriv.raw --read-only --pipe echo thisisatest >/tmp/unpriv.out2 echo thisisatest | cmp /tmp/unpriv.out2 - fi systemd-run -M testuser@ --user --pipe -p RootImage=/var/tmp/unpriv.raw -p PrivateUsers=1 --wait echo thisisatest >/tmp/unpriv.out3 echo thisisatest | cmp /tmp/unpriv.out3 - # make sure MakeDirectory() works correctly assert_eq "$(run0 -u testuser varlinkctl --exec call /run/systemd/io.systemd.MountFileSystem io.systemd.MountFileSystem.MakeDirectory --push-fd=./ '{ "parentFileDescriptor" : 0, "name" : "foreignuidowned" }' -- stat -Lc "%u" /proc/self/fd/3)" 2147352576 assert_eq "$(stat -c "%u" ~testuser/foreignuidowned)" 2147352576 rmdir ~testuser/foreignuidowned Found error in /usr/lib/systemd/tests/testdata/units/TEST-50-DISSECT.dissect.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-50-DISSECT.dissect.sh RemainAfterExit=yes MountAPIVFS=yes PrivateTmp=yes ExecStart=bash -c ' \\ systemd-notify --ready; \\ while [ ! -f /tmp/img/usr/lib/os-release ] || ! grep -q -F MARKER /tmp/img/usr/lib/os-release; do \\ sleep 0.1; \\ done; \\ mount; \\ mount | grep -F "on /tmp/img type squashfs" | grep -F "nosuid" >/dev/null; \\ ' EOF systemctl start testservice-50d.service # Mount twice to exercise mount-beneath (on kernel 6.5+, on older kernels it will just overmount) mkdir -p /tmp/wrong/foo mksquashfs /tmp/wrong/foo /tmp/wrong.raw -noappend systemctl mount-image --mkdir testservice-50d.service /tmp/wrong.raw /tmp/img test "$(systemctl show -P SubState testservice-50d.service)" = "running" systemctl mount-image --mkdir testservice-50d.service "$MINIMAL_IMAGE.raw" /tmp/img root:nosuid # shellcheck disable=SC2016 timeout 30s bash -xec 'while [[ $(systemctl show -P SubState testservice-50d.service) == running ]]; do sleep .2; done' systemctl is-active testservice-50d.service # ExtensionImages will set up an overlay systemd-run -P \ --property ExtensionImages=/tmp/app0.raw \ --property RootImage="$MINIMAL_IMAGE.raw" \ cat /opt/script0.sh | grep -F "extension-release.app0" >/dev/null systemd-run -P \ --property ExtensionImages=/tmp/app0.raw \ --property RootImage="$MINIMAL_IMAGE.raw" \ cat /usr/lib/systemd/system/some_file | grep -F "MARKER=1" >/dev/null systemd-run -P \ --property ExtensionImages="/tmp/app0.raw /tmp/app1.raw" \ --property RootImage="$MINIMAL_IMAGE.raw" \ cat /opt/script0.sh | grep -F "extension-release.app0" >/dev/null systemd-run -P \ --property ExtensionImages="/tmp/app0.raw /tmp/app1.raw" \ --property RootImage="$MINIMAL_IMAGE.raw" \ cat /usr/lib/systemd/system/some_file | grep -F "MARKER=1" >/dev/null systemd-run -P \ --property ExtensionImages="/tmp/app0.raw /tmp/app1.raw" \ --property RootImage="$MINIMAL_IMAGE.raw" \ cat /opt/script1.sh | grep -F "extension-release.app2" >/dev/null systemd-run -P \ --property ExtensionImages="/tmp/app0.raw /tmp/app1.raw" \ --property RootImage="$MINIMAL_IMAGE.raw" \ cat /usr/lib/systemd/system/other_file | grep -F "MARKER=1" >/dev/null systemd-run -P \ --property ExtensionImages=/tmp/app-nodistro.raw \ --property RootImage="$MINIMAL_IMAGE.raw" \ cat /usr/lib/systemd/system/some_file | grep -F "MARKER=1" >/dev/null systemd-run -P \ --property ExtensionImages=/etc/service-scoped-test.raw \ --property RootImage="$MINIMAL_IMAGE.raw" \ cat /etc/systemd/system/some_file | grep -F "MARKER_CONFEXT_123" >/dev/null systemd-run -P \ --property ExtensionImages="/tmp/app0.raw /tmp/conf0.raw" \ veritysetup status "$(cat /tmp/app0.roothash)-verity" | grep "$(cat /tmp/app0.roothash)" >/dev/null systemd-run -P \ --property ExtensionImages="/tmp/app0.raw /tmp/conf0.raw" \ veritysetup status "$(cat /tmp/conf0.roothash)-verity" | grep "$(cat /tmp/conf0.roothash)" >/dev/null # Check that two identical verity images at different paths do not fail with -ELOOP from OverlayFS mkdir -p /tmp/loop cp /tmp/app0.raw /tmp/loop/app0.raw veritysetup format /tmp/loop/app0.raw /tmp/loop/app0.verity --root-hash-file /tmp/loop/app0.roothash cp /tmp/loop/app0.raw /tmp/loop/app0_copy.raw cp /tmp/loop/app0.verity /tmp/loop/app0_copy.verity cp /tmp/loop/app0.roothash /tmp/loop/app0_copy.roothash systemd-run -P \ --property ExtensionImages=/tmp/loop/app0.raw \ --property ExtensionImages=/tmp/loop/app0_copy.raw \ --property RootImage="$MINIMAL_IMAGE.raw" \ "${BIND_LOG_SOCKETS[@]}" \ cat /opt/script0.sh | grep -F "extension-release.app0" >/dev/null rm -rf /tmp/loop/ # Check that using a symlink to NAME-VERSION.raw works as long as the symlink has the correct name NAME.raw mkdir -p /tmp/symlink-test/ cp /tmp/app-nodistro.raw /tmp/symlink-test/app-nodistro-v1.raw ln -fs /tmp/symlink-test/app-nodistro-v1.raw /tmp/symlink-test/app-nodistro.raw systemd-run -P \ --property ExtensionImages=/tmp/symlink-test/app-nodistro.raw \ --property RootImage="$MINIMAL_IMAGE.raw" \ cat /usr/lib/systemd/system/some_file | grep -F "MARKER=1" >/dev/null # Symlink check again but for confext mkdir -p /etc/symlink-test/ -- --property ExtensionImages=/etc/symlink-test/service-scoped-test.raw \ --property RootImage="$MINIMAL_IMAGE.raw" \ cat /etc/systemd/system/some_file | grep -F "MARKER_CONFEXT_123" >/dev/null # And again mixing sysext and confext systemd-run -P \ --property ExtensionImages=/tmp/symlink-test/app-nodistro.raw \ --property ExtensionImages=/etc/symlink-test/service-scoped-test.raw \ --property RootImage="$MINIMAL_IMAGE.raw" \ cat /etc/systemd/system/some_file | grep -F "MARKER_CONFEXT_123" >/dev/null systemd-run -P \ --property ExtensionImages=/tmp/symlink-test/app-nodistro.raw \ --property ExtensionImages=/etc/symlink-test/service-scoped-test.raw \ --property RootImage="$MINIMAL_IMAGE.raw" \ cat /usr/lib/systemd/system/some_file | grep -F "MARKER=1" >/dev/null cat >/run/systemd/system/testservice-50e.service < makes the devices disappear on Ubuntu 24.04/C9S, so set them # up by hand. Don't fail if it's already set up. veritysetup open "$MINIMAL_IMAGE.raw" "$(cat "$MINIMAL_IMAGE.roothash")-verity" "$MINIMAL_IMAGE.verity" --root-hash-file "$MINIMAL_IMAGE.roothash" ||: veritysetup open "$VDIR/${VBASE}_0.raw" "$(cat "$VDIR/${VBASE}_0.roothash")-verity" "$VDIR/${VBASE}_0.verity" --root-hash-file "$VDIR/${VBASE}_0.roothash" ||: mkdir -p /tmp/img /tmp/ext mount -o ro "/dev/mapper/$(cat "$MINIMAL_IMAGE.roothash")-verity" /tmp/img mount -o ro "/dev/mapper/$(cat "$VDIR/${VBASE}_0.roothash")-verity" /tmp/ext journalctl --sync since="$(date '+%H:%M:%S')" systemctl restart testservice-50e-vpick.service systemctl is-active testservice-50e-vpick.service journalctl --sync timeout -v 30 journalctl --since "$since" -n all --follow | grep -m 2 -F 'Reusing pre-existing verity-protected root image' timeout -v 30 journalctl --since "$since" -n all --follow | grep -m 2 -F 'Reusing pre-existing verity-protected image' systemctl stop testservice-50e-vpick.service umount -R /tmp/img umount -R /tmp/ext veritysetup close "$(cat "$MINIMAL_IMAGE.roothash")-verity" ||: veritysetup close "$(cat "$VDIR/${VBASE}_0.roothash")-verity" ||: rm -rf "$VDIR" "$EMPTY_VDIR" -- cat /opt/script0.sh) (! systemd-run -P \ --property ExtensionDirectories="$IMAGE_DIR/app0" \ --property RootImage="$MINIMAL_IMAGE.raw" \ cat /opt/script0.sh) systemd-dissect --mount /tmp/app0.raw "$IMAGE_DIR/app0" systemd-dissect --mount /tmp/app1.raw "$IMAGE_DIR/app1" systemd-dissect --mount /tmp/app-nodistro.raw "$IMAGE_DIR/app-nodistro" systemd-dissect --mount /etc/service-scoped-test.raw "$IMAGE_DIR/service-scoped-test" systemd-run -P \ --property ExtensionDirectories="$IMAGE_DIR/app0" \ --property RootImage="$MINIMAL_IMAGE.raw" \ cat /opt/script0.sh | grep -F "extension-release.app0" >/dev/null -- systemctl start testservice-50f.service systemctl is-active testservice-50f.service # Check vpick support in ExtensionDirectories= VBASE="vtest$RANDOM" VDIR="/tmp/$VBASE.v" EMPTY_VDIR="/tmp/$VBASE-empty.v" NONEXISTENT_VDIR="/tmp/$VBASE-nonexistent.v" mkdir "$VDIR" "$EMPTY_VDIR" ln -s "$IMAGE_DIR/app0" "$VDIR/${VBASE}_0" ln -s "$IMAGE_DIR/app1" "$VDIR/${VBASE}_1" -- systemd-dissect --umount "$IMAGE_DIR/app0" systemd-dissect --umount "$IMAGE_DIR/app1" # Check reloading refreshes vpick extensions VBASE="vtest$RANDOM" VDIR="/tmp/${VBASE}.v" mkdir "$VDIR" rm -rf /tmp/markers/ mkdir /tmp/markers/ CDIR1="/tmp/${VBASE}_confext_a" CDIR2="/tmp/${VBASE}_confext_b" mkdir -p "$CDIR1/etc/extension-release.d/" "$CDIR2/etc/extension-release.d/" echo "ID=_any" >"$CDIR1/etc/extension-release.d/extension-release.${VBASE}_confext_a" touch "$CDIR1/etc/${VBASE}_confext_a.marker" echo "ID=_any" >"$CDIR2/etc/extension-release.d/extension-release.${VBASE}_confext_b" touch "$CDIR2/etc/${VBASE}_confext_b.marker" cat >/run/systemd/system/testservice-50g.service </tmp/markers/50g; \\ systemd-notify --ready; \\ }" SIGHUP; \\ systemd-notify --ready; \\ while true; do sleep 1; done; \\ ' -- touch "$VDIR/${VBASE}_1/etc/${VBASE}_1.marker" systemctl start testservice-50g.service systemctl is-active testservice-50g.service # First reload; at reload time, the marker file in /etc should be picked up. systemctl reload testservice-50g.service grep -q -F "${VBASE}_1.marker" /tmp/markers/50g grep -q -F "${VBASE}_confext_a.marker" /tmp/markers/50g grep -q -F "${VBASE}_confext_b.marker" /tmp/markers/50g # Make a version 2 and reload again; this time we should see the v2 marker mkdir -p "$VDIR/${VBASE}_2/etc/extension-release.d/" echo "ID=_any" >"$VDIR/${VBASE}_2/etc/extension-release.d/extension-release.${VBASE}_2" touch "$VDIR/${VBASE}_2/etc/${VBASE}_2.marker" systemctl reload testservice-50g.service grep -q -F "${VBASE}_2.marker" /tmp/markers/50g grep -q -F "${VBASE}_confext_a.marker" /tmp/markers/50g grep -q -F "${VBASE}_confext_b.marker" /tmp/markers/50g # Do it for a couple more times (to make sure we're tearing down old overlays) for _ in {1..5}; do systemctl reload testservice-50g.service; done systemctl stop testservice-50g.service rm -f /run/systemd/system/testservice-50g.service # Repeat the same vpick notify-reload test with ExtensionImages= (keeping the # same VBASE and reusing VDIR files for convenience, but using .raw extensions # this time) VDIR2="/tmp/${VBASE}.raw.v" mkdir "$VDIR2" CIMG1="/tmp/${VBASE}_confext_a.raw" CIMG2="/tmp/${VBASE}_confext_b.raw" mksquashfs "$CDIR1" "$CIMG1" -noappend mksquashfs "$CDIR2" "$CIMG2" -noappend cat >/run/systemd/system/testservice-50h.service </tmp/markers/50h; \\ systemd-notify --ready; \\ }" SIGHUP; \\ systemd-notify --ready; \\ while true; do sleep 1; done; \\ ' -- mksquashfs "$VDIR/${VBASE}_1" "$VDIR2/${VBASE}_1.raw" -noappend systemctl start testservice-50h.service systemctl is-active testservice-50h.service # First reload should pick up the v1 marker systemctl reload testservice-50h.service grep -q -F "${VBASE}_1.marker" /tmp/markers/50h grep -q -F "${VBASE}_confext_a.marker" /tmp/markers/50h grep -q -F "${VBASE}_confext_b.marker" /tmp/markers/50h # Second reload should pick up the v2 marker mksquashfs "$VDIR/${VBASE}_2" "$VDIR2/${VBASE}_2.raw" -noappend systemctl reload testservice-50h.service grep -q -F "${VBASE}_2.marker" /tmp/markers/50h grep -q -F "${VBASE}_confext_a.marker" /tmp/markers/50h grep -q -F "${VBASE}_confext_b.marker" /tmp/markers/50h # Test that removing all the vpick extensions don't cause any issues rm -rf "${VDIR2:?}"/* systemctl reload testservice-50h.service systemctl is-active testservice-50h.service (! grep -q -F "${VBASE}_2.marker" /tmp/markers/50h) grep -q -F "${VBASE}_confext_a.marker" /tmp/markers/50h grep -q -F "${VBASE}_confext_b.marker" /tmp/markers/50h systemctl stop testservice-50h.service rm -f /run/systemd/system/testservice-50h.service # Test combining vpick reload/restart with RootDirectory= & RootImage= cat >/run/systemd/system/testservice-50i.service </tmp/markers/50i; \ (cat /usr/lib/os-release) >>/tmp/markers/50i; \ echo "READY=1" | socat -t 5 - UNIX-SENDTO:\$\$NOTIFY_SOCKET; \ '"'"' SIGHUP; \ echo "READY=1" | socat -t 5 - UNIX-SENDTO:\$\$NOTIFY_SOCKET; \ while true; do sleep 1; done; \ ' -- systemctl start testservice-50i.service systemctl is-active testservice-50i.service # Move the v2 extension back and reload mv "$VDIR/.${VBASE}_2" "$VDIR/${VBASE}_2/" systemctl reload testservice-50i.service grep -q -F "${VBASE}_2.marker" /tmp/markers/50i grep -q -F "${VBASE}_confext_a.marker" /tmp/markers/50i grep -q -F "${VBASE}_confext_b.marker" /tmp/markers/50i # Ensure that we are also still seeing files exclusive to the root image grep -q -F "MARKER=1" /tmp/markers/50i systemctl stop testservice-50i.service rm -f /run/systemd/system/testservice-50i.service unsquashfs -force -no-xattrs -d /tmp/vpickminimg "$MINIMAL_IMAGE.raw" cat >/run/systemd/system/testservice-50j.service </tmp/markers/50j; \ (cat /usr/lib/os-release) >>/tmp/markers/50j; \ echo "READY=1" | socat -t 5 - UNIX-SENDTO:\$\$NOTIFY_SOCKET; \ '"'"' SIGHUP; \ echo "READY=1" | socat -t 5 - UNIX-SENDTO:\$\$NOTIFY_SOCKET; \ while true; do sleep 1; done; \ ' EOF systemctl start testservice-50j.service systemctl is-active testservice-50j.service systemctl reload testservice-50j.service grep -q -F "${VBASE}_2.marker" /tmp/markers/50j grep -q -F "${VBASE}_confext_a.marker" /tmp/markers/50j grep -q -F "${VBASE}_confext_b.marker" /tmp/markers/50j grep -q -F "MARKER=1" /tmp/markers/50j systemctl stop testservice-50j.service rm -f /run/systemd/system/testservice-50j.service cat >/run/systemd/system/testservice-50k.service </tmp/markers/50k; \ (cat /usr/lib/os-release) >>/tmp/markers/50k; \ echo "READY=1" | socat -t 5 - UNIX-SENDTO:\$\$NOTIFY_SOCKET; \ '"'"' SIGHUP; \ echo "READY=1" | socat -t 5 - UNIX-SENDTO:\$\$NOTIFY_SOCKET; \ while true; do sleep 1; done; \ ' -- veritysetup status "$(cat "$MINIMAL_IMAGE.roothash")-verity" | grep "verified (with signature)" >/dev/null fi # First reload should pick up the v1 marker mksquashfs "$VDIR/${VBASE}_1" "$VDIR2/${VBASE}_1.raw" -noappend systemctl reload testservice-50k.service grep -q -F "${VBASE}_1.marker" /tmp/markers/50k grep -q -F "${VBASE}_confext_a.marker" /tmp/markers/50k grep -q -F "${VBASE}_confext_b.marker" /tmp/markers/50k # Second reload should pick up the v2 marker mksquashfs "$VDIR/${VBASE}_2" "$VDIR2/${VBASE}_2.raw" -noappend systemctl reload testservice-50k.service grep -q -F "${VBASE}_2.marker" /tmp/markers/50k grep -q -F "${VBASE}_confext_a.marker" /tmp/markers/50k grep -q -F "${VBASE}_confext_b.marker" /tmp/markers/50k # Test that removing all the vpick extensions don't cause any issues rm -rf "${VDIR2:?}"/* systemctl reload testservice-50k.service systemctl is-active testservice-50k.service grep -q -F "MARKER=1" /tmp/markers/50k grep -q -F "${VBASE}_confext_a.marker" /tmp/markers/50k grep -q -F "${VBASE}_confext_b.marker" /tmp/markers/50k systemctl stop testservice-50k.service rm -f /run/systemd/system/testservice-50k.service systemctl daemon-reload rm -rf "$VDIR" "$VDIR2" "$CDIR1" "$CDIR2" "$CIMG1" "$CIMG2" /tmp/vpickminimg /tmp/markers/ # Check dissect shortcut for verity images cat >/run/systemd/system/testservice-50m.service < makes the devices disappear on Ubuntu 24.04/C9S, so set them # up by hand. Don't fail if it's already set up. veritysetup open "$MINIMAL_IMAGE.raw" "$(cat "$MINIMAL_IMAGE.roothash")-verity" "$MINIMAL_IMAGE.verity" --root-hash-file "$MINIMAL_IMAGE.roothash" ||: veritysetup open /tmp/app0.raw "$(cat /tmp/app0.roothash)-verity" /tmp/app0.verity --root-hash-file /tmp/app0.roothash ||: mkdir -p /tmp/img /tmp/ext mount -o ro "/dev/mapper/$(cat "$MINIMAL_IMAGE.roothash")-verity" /tmp/img mount -o ro "/dev/mapper/$(cat /tmp/app0.roothash)-verity" /tmp/ext journalctl --sync since="$(date '+%H:%M:%S')" systemctl restart testservice-50m.service systemctl is-active testservice-50m.service journalctl --sync timeout -v 30 journalctl --since "$since" -n all --follow | grep -m 4 -F 'Reusing pre-existing verity-protected root image' timeout -v 30 journalctl --since "$since" -n all --follow | grep -m 8 -F 'Reusing pre-existing verity-protected image' systemctl stop testservice-50m.service umount /tmp/img umount /tmp/ext veritysetup close "$(cat "$MINIMAL_IMAGE.roothash")-verity" ||: veritysetup close "$(cat /tmp/app0.roothash)-verity" ||: # Test that an extension consisting of an empty directory under /etc/extensions/ takes precedence mkdir -p /var/lib/extensions/ ln -s /tmp/app-nodistro.raw /var/lib/extensions/app-nodistro.raw systemd-sysext status systemd-sysext list systemd-sysext merge grep -q -F "MARKER=1" /usr/lib/systemd/system/some_file systemd-sysext unmerge -- rm -rf /run/extensions/app-reject rm /var/lib/extensions/app-nodistro.raw # Some super basic test that RootImage= works with .v/ dirs VBASE="vtest$RANDOM" VDIR="/tmp/$VBASE.v" mkdir "$VDIR" ln -s "$MINIMAL_IMAGE.raw" "$VDIR/${VBASE}_33.raw" ln -s "$MINIMAL_IMAGE.raw" "$VDIR/${VBASE}_34.raw" ln -s "$MINIMAL_IMAGE.raw" "$VDIR/${VBASE}_35.raw" -- rmdir "$VDIR" mkdir -p /run/machines /run/portables /run/extensions touch /run/machines/a.raw /run/portables/b.raw /run/extensions/c.raw systemd-dissect --discover --json=short >/tmp/discover.json grep -q -F '{"name":"a","type":"raw","class":"machine","ro":false,"path":"/run/machines/a.raw"' /tmp/discover.json grep -q -F '{"name":"b","type":"raw","class":"portable","ro":false,"path":"/run/portables/b.raw"' /tmp/discover.json grep -q -F '{"name":"c","type":"raw","class":"sysext","ro":false,"path":"/run/extensions/c.raw"' /tmp/discover.json rm /tmp/discover.json /run/machines/a.raw /run/portables/b.raw /run/extensions/c.raw systemd-dissect --discover --system systemd-dissect --discover --user systemd-dissect --discover --system --user -- cleanup_sysupdate_notify_confext_mutable "$mutable_marker" "$notify_socket_was_active" } test_sysupdate_notify_confext_mutable unsquashfs -force -no-xattrs -d /tmp/img "$MINIMAL_IMAGE.raw" systemd-run --unit=test-root-ephemeral \ -p RootDirectory=/tmp/img \ -p RootEphemeral=yes \ -p Type=exec \ bash -c "touch /abc && sleep infinity" test -n "$(ls -A /var/lib/systemd/ephemeral-trees)" systemctl stop test-root-ephemeral # shellcheck disable=SC2016 timeout 10 bash -c 'until test -z "$(ls -A /var/lib/systemd/ephemeral-trees)"; do sleep .5; done' test ! -f /tmp/img/abc # Test RootDirectoryFileDescriptor= systemd-run --wait --pipe --root-directory=/tmp/img -- grep -q 'MARKER=1' /usr/lib/os-release # Make sure the same root file descriptor can be reused multiple times. systemd-run --wait --pipe --same-root-dir -p ExecStartPre=true true systemd-dissect --mtree /tmp/img >/dev/null systemd-dissect --list /tmp/img >/dev/null read -r SHA256SUM1 _ < <(systemd-dissect --copy-from /tmp/img etc/os-release | sha256sum) test "$SHA256SUM1" != "" echo abc >abc systemd-dissect --copy-to /tmp/img abc /abc test -f /tmp/img/abc # Test --copy-ownership= option rm -rf /tmp/copychown-test mkdir -p /tmp/copychown-test/srcdir echo "test file" >/tmp/copychown-test/srcdir/testfile chown 1234:5678 /tmp/copychown-test/srcdir/testfile chown 1234:5678 /tmp/copychown-test/srcdir # Test --copy-ownership=yes preserves ownership for regular files systemd-dissect --copy-from /tmp/img etc/os-release /tmp/copychown-test/os-release-chown-yes --copy-ownership=yes test "$(stat -c %u:%g /tmp/copychown-test/os-release-chown-yes)" = "0:0" # Test --copy-ownership=no uses current user for regular files systemd-dissect --copy-from /tmp/img etc/os-release /tmp/copychown-test/os-release-chown-no --copy-ownership=no test "$(stat -c %u:%g /tmp/copychown-test/os-release-chown-no)" = "0:0" # Test --copy-ownership=auto (default) does not preserve ownership for regular files systemd-dissect --copy-from /tmp/img etc/os-release /tmp/copychown-test/os-release-chown-auto test "$(stat -c %u:%g /tmp/copychown-test/os-release-chown-auto)" = "0:0" # Test --copy-ownership=yes preserves ownership for directories systemd-dissect --copy-to /tmp/img /tmp/copychown-test/srcdir /copychown-dir-yes --copy-ownership=yes test "$(stat -c %u:%g /tmp/img/copychown-dir-yes)" = "1234:5678" test "$(stat -c %u:%g /tmp/img/copychown-dir-yes/testfile)" = "1234:5678" rm -rf /tmp/img/copychown-dir-yes # Test --copy-ownership=no overrides ownership for directories systemd-dissect --copy-to /tmp/img /tmp/copychown-test/srcdir /copychown-dir-no --copy-ownership=no test "$(stat -c %u:%g /tmp/img/copychown-dir-no)" = "0:0" test "$(stat -c %u:%g /tmp/img/copychown-dir-no/testfile)" = "0:0" rm -rf /tmp/img/copychown-dir-no # Test --copy-ownership=auto (default) preserves ownership for directories systemd-dissect --copy-to /tmp/img /tmp/copychown-test/srcdir /copychown-dir-auto test "$(stat -c %u:%g /tmp/img/copychown-dir-auto)" = "1234:5678" test "$(stat -c %u:%g /tmp/img/copychown-dir-auto/testfile)" = "1234:5678" rm -rf /tmp/img/copychown-dir-auto rm -rf /tmp/copychown-test # Test for dissect tool support with systemd-sysext mkdir -p /run/extensions/ testkit/usr/lib/extension-release.d/ echo "ID=_any" >testkit/usr/lib/extension-release.d/extension-release.testkit echo "ARCHITECTURE=_any" >>testkit/usr/lib/extension-release.d/extension-release.testkit -- systemd-run -P -p RootImage="$MINIMAL_IMAGE.raw" cat /run/host/os-release | cmp "$OS_RELEASE" # Test that systemd-sysext reloads the daemon. mkdir -p /var/lib/extensions/ ln -s /tmp/app-reload.raw /var/lib/extensions/app-reload.raw systemd-sysext merge --no-reload # the service should not be running (! systemctl --quiet is-active foo.service) systemd-sysext unmerge --no-reload systemd-sysext merge -- rm -rf "$mnt" fi } trap cleanup_btrfs_mountimages EXIT img="$(mktemp /var/tmp/test-50-mountimages-btrfs.img.XXXXXXXXXX)" mnt="$(mktemp -d "$IMAGE_DIR/test-50-mountimages-btrfs.mnt.XXXXXXXXXX")" truncate -s 600M "$img" echo -e 'label: gpt\nsize=280MiB, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4, name=data1\ntype=0FC63DAF-8483-4772-8E79-3D69D8477DE4, name=data2' | sfdisk "$img" loop="$(losetup --show -P -f "$img")" udevadm wait --timeout=60 --settle --initialized=no "${loop}p1" "${loop}p2" Found error in /usr/lib/systemd/tests/testdata/units/TEST-50-DISSECT.DDI.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-50-DISSECT.DDI.sh # SPDX-License-Identifier: LGPL-2.1-or-later set -eux set -o pipefail # Check that the /usr/sbin/mount.ddi helper works dir="/tmp/mounthelper.$RANDOM" mount -t ddi "$MINIMAL_IMAGE.gpt" "$dir" -o ro,X-mount.mkdir,discard umount -R "$dir" # Test systemd-repart --make-ddi=: if [[ -z "${OPENSSL_CONFIG:?}" ]] || ! command -v mksquashfs >/dev/null; then -- exit 0 fi openssl req -config "$OPENSSL_CONFIG" -subj="/CN=waldo" \ -x509 -sha256 -nodes -days 365 -newkey rsa:4096 \ -keyout /tmp/test-50-privkey.key -out /tmp/test-50-cert.crt mkdir -p /tmp/test-50-confext/etc/extension-release.d/ echo "foobar50" >/tmp/test-50-confext/etc/waldo { grep -e '^\(ID\|VERSION_ID\)=' /etc/os-release echo IMAGE_ID=waldo echo IMAGE_VERSION=7 } >/tmp/test-50-confext/etc/extension-release.d/extension-release.waldo mkdir -p /run/confexts SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs \ systemd-repart -C \ -s /tmp/test-50-confext \ --certificate=/tmp/test-50-cert.crt \ --private-key=/tmp/test-50-privkey.key \ /run/confexts/waldo.confext.raw rm -rf /tmp/test-50-confext mkdir -p /run/verity.d cp /tmp/test-50-cert.crt /run/verity.d/ systemd-dissect --mtree /run/confexts/waldo.confext.raw systemd-confext refresh test "$(/dev/null 2>&1; then homectl deactivate no-space-update 2>/dev/null wait_for_state no-space-update inactive 2>/dev/null homectl remove no-space-update 2>/dev/null -- homectl remove test-user } testcase_recovery_key_file() ( local KEY_DIR KEY_DIR="$(mktemp -d /tmp/homed-recovery-key-file.XXXXXX)" local KEY_FILE="$KEY_DIR/recovery-key" local KEY_FILE2="$KEY_DIR/recovery-key-update" local DRY_RUN_OUTPUT="$KEY_DIR/dry-run.out" local DRY_RUN_ERROR="$KEY_DIR/dry-run.err" local UPDATE_EXISTING_OUTPUT="$KEY_DIR/update-existing.out" -- testcase_update_auto_resize_mode_without_space() { local blocks bsize create_output fill_mbytes fill_size filler home_size image local fs_stat image_stat image_blocks image_size image_unallocated create_output="/tmp/no-space-update.create" filler="/home/no-space-update.filler" home_size=512M image="/home/no-space-update.home" trap cleanup_update_auto_resize_mode_without_space RETURN ERR EXIT -- diff "/var/cache/systemd/home/blob-user/$1" "$2" diff "/var/cache/systemd/home/blob-user/$1" "/home/blob-user/.identity-blob/$1" } mkdir /tmp/blob1 /tmp/blob2 echo data1 blob1 >/tmp/blob1/test1 echo data1 blob2 >/tmp/blob2/test1 echo data2 blob1 >/tmp/blob1/test2 echo data2 blob2 >/tmp/blob2/test2 echo invalid filename >/tmp/blob1/файл echo data3 >/tmp/external-test3 echo avatardata >/tmp/external-avatar ln -s /tmp/external-avatar /tmp/external-avatar-lnk dd if=/dev/urandom of=/tmp/external-barely-fits bs=1M count=64 dd if=/dev/urandom of=/tmp/external-toobig bs=1M count=65 # create w/ prepopulated blob dir NEWPASSWORD=EMJuc3zQaMibJo \ homectl create blob-user \ --disk-size=min --luks-discard=yes \ --luks-pbkdf-type=pbkdf2 --luks-pbkdf-time-cost=1ms \ --rate-limit-interval=1s --rate-limit-burst=1000 \ --uid=12345 \ --blob=/tmp/blob1 inspect blob-user PASSWORD=EMJuc3zQaMibJo homectl activate blob-user inspect blob-user test -d /var/cache/systemd/home/blob-user stat -c "%u %#a" /var/cache/systemd/home/blob-user | grep "^0 0755" test -d /home/blob-user/.identity-blob stat -c "%u %#a" /home/blob-user/.identity-blob | grep "^12345 0700" checkblob test1 /tmp/blob1/test1 (! checkblob test1 /tmp/blob2/test1 ) checkblob test2 /tmp/blob1/test2 (! checkblob test2 /tmp/blob2/test2 ) (! checkblob фаил /tmp/blob1/фаил ) (! checkblob test3 /tmp/external-test3 ) (! checkblob avatar /tmp/external-avatar ) # append files to existing blob, both well-known and other PASSWORD=EMJuc3zQaMibJo \ homectl update blob-user \ -b test3=/tmp/external-test3 --avatar=/tmp/external-avatar inspect blob-user checkblob test1 /tmp/blob1/test1 (! checkblob test1 /tmp/blob2/test1 ) checkblob test2 /tmp/blob1/test2 (! checkblob test2 /tmp/blob2/test2 ) (! checkblob фаил /tmp/blob1/фаил ) checkblob test3 /tmp/external-test3 checkblob avatar /tmp/external-avatar # delete files from existing blob, both well-known and other PASSWORD=EMJuc3zQaMibJo \ homectl update blob-user \ -b test3= --avatar= inspect blob-user checkblob test1 /tmp/blob1/test1 (! checkblob test1 /tmp/blob2/test1 ) checkblob test2 /tmp/blob1/test2 (! checkblob test2 /tmp/blob2/test2 ) (! checkblob фаил /tmp/blob1/фаил ) (! checkblob test3 /tmp/external-test3 ) (! checkblob avatar /tmp/external-avatar ) # swap entire blob directory PASSWORD=EMJuc3zQaMibJo \ homectl update blob-user \ -b /tmp/blob2 inspect blob-user (! checkblob test1 /tmp/blob1/test1 ) checkblob test1 /tmp/blob2/test1 (! checkblob test2 /tmp/blob1/test2 ) checkblob test2 /tmp/blob2/test2 (! checkblob фаил /tmp/blob1/фаил ) (! checkblob test3 /tmp/external-test3 ) (! checkblob avatar /tmp/external-avatar ) # create and delete files while swapping blob directory. Also symlinks. PASSWORD=EMJuc3zQaMibJo \ homectl update blob-user \ -b /tmp/blob1 -b test2= -b test3=/tmp/external-test3 --avatar=/tmp/external-avatar-lnk inspect blob-user checkblob test1 /tmp/blob1/test1 (! checkblob test1 /tmp/blob2/test1 ) (! checkblob test2 /tmp/blob1/test2 ) (! checkblob test2 /tmp/blob2/test2 ) (! checkblob фаил /tmp/blob1/фаил ) checkblob test3 /tmp/external-test3 checkblob avatar /tmp/external-avatar # target of the link # clear the blob directory PASSWORD=EMJuc3zQaMibJo \ homectl update blob-user \ -b /tmp/blob2 -b test3=/tmp/external-test3 --blob= inspect blob-user (! checkblob test1 /tmp/blob1/test1 ) (! checkblob test1 /tmp/blob2/test1 ) (! checkblob test2 /tmp/blob1/test2 ) (! checkblob test2 /tmp/blob2/test2 ) (! checkblob фаил /tmp/blob1/фаил ) (! checkblob test3 /tmp/external-test3 ) (! checkblob avatar /tmp/external-avatar ) # file that's exactly 64M still fits # FIXME: Figure out why this fails on ext4. if [[ "$FSTYPE" != "ext2/ext3" ]]; then PASSWORD=EMJuc3zQaMibJo \ homectl update blob-user \ -b barely-fits=/tmp/external-barely-fits (! checkblob test1 /tmp/blob1/test1 ) (! checkblob test1 /tmp/blob2/test1 ) (! checkblob test2 /tmp/blob1/test2 ) (! checkblob test2 /tmp/blob2/test2 ) (! checkblob фаил /tmp/blob1/фаил ) (! checkblob test3 /tmp/external-test3 ) (! checkblob avatar /tmp/external-avatar ) checkblob barely-fits /tmp/external-barely-fits fi # error out if the file is too big (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b huge=/tmp/external-toobig ) # error out if filenames are invalid (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b .hidden=/tmp/external-test3 ) (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b "with spaces=/tmp/external-test3" ) (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b with=equals=/tmp/external-test3 ) (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b файл=/tmp/external-test3 ) (! PASSWORD=EMJuc3zQaMibJo homectl update blob-user -b special@chars=/tmp/external-test3 ) # Make sure offline updates to blobs get propagated in homectl deactivate blob-user inspect blob-user homectl update blob-user --offline -b barely-fits= -b propagated=/tmp/external-test3 inspect blob-user PASSWORD=EMJuc3zQaMibJo homectl activate blob-user inspect blob-user (! checkblob barely-fits /tmp/external-barely-fits ) checkblob propagated /tmp/external-test3 homectl deactivate blob-user wait_for_state blob-user inactive homectl remove blob-user } -- varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"uid":2000000,"service":"io.systemd.Multiplexer"}' (! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"","service":"io.systemd.Multiplexer"}') (! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"🐱","service":"io.systemd.Multiplexer"}') (! varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName":"i-do-not-exist","service":"io.systemd.Multiplexer"}') userdbctl ssh-authorized-keys dropinuser | tee /tmp/authorized-keys grep "ssh-ed25519" /tmp/authorized-keys grep "ecdsa-sha2-nistp256" /tmp/authorized-keys echo "my-top-secret-key 🐱" >/tmp/my-top-secret-key userdbctl ssh-authorized-keys dropinuser --chain /usr/bin/cat /tmp/my-top-secret-key | tee /tmp/authorized-keys grep "ssh-ed25519" /tmp/authorized-keys grep "ecdsa-sha2-nistp256" /tmp/authorized-keys grep "my-top-secret-key 🐱" /tmp/authorized-keys (! userdbctl ssh-authorized-keys 🐱) (! userdbctl ssh-authorized-keys dropin-user --chain) (! userdbctl ssh-authorized-keys dropin-user --chain '') (! SYSTEMD_LOG_LEVEL=debug userdbctl ssh-authorized-keys dropin-user --chain /usr/bin/false) -- cleanup_ssh() ( set +e systemctl is-active -q mysshserver.socket && systemctl stop mysshserver.socket rm -f /tmp/homed.id_ecdsa /run/systemd/system/mysshserver{@.service,.socket} systemctl daemon-reload if homectl inspect homedsshtest &>/dev/null; then wait_for_state homedsshtest inactive homectl remove homedsshtest fi -- fi trap cleanup_ssh RETURN ERR EXIT # Test that SSH logins work with delayed unlocking ssh-keygen -N '' -C '' -t ecdsa -f /tmp/homed.id_ecdsa NEWPASSWORD=hunter4711 \ homectl create \ --disk-size=min \ --luks-discard=yes \ --luks-pbkdf-type=pbkdf2 \ --luks-pbkdf-time-cost=1ms \ --rate-limit-interval=1s \ --rate-limit-burst=1000 \ --enforce-password-policy=no \ --ssh-authorized-keys=@/tmp/homed.id_ecdsa.pub \ --stop-delay=0 \ homedsshtest homectl inspect homedsshtest mkdir -p /etc/ssh -- systemctl daemon-reload systemctl start mysshserver.socket userdbctl user -j homedsshtest ssh -t -t -4 -p 4711 -i /tmp/homed.id_ecdsa \ -o "SetEnv PASSWORD=hunter4711" -o "StrictHostKeyChecking no" \ homedsshtest@localhost echo zzz | tr -d '\r' | tee /tmp/homedsshtest.out grep -E "^zzz$" /tmp/homedsshtest.out rm /tmp/homedsshtest.out ssh -t -t -4 -p 4711 -i /tmp/homed.id_ecdsa \ -o "SetEnv PASSWORD=hunter4711" -o "StrictHostKeyChecking no" \ homedsshtest@localhost env } testcase_alias() { -- echo "e2fsprogs not installed, skipping fscrypt test." return 0 fi local IMAGE MNT IMAGE="$(mktemp /tmp/fscrypt.XXXXXX.img)" MNT="$(mktemp -d /tmp/fscrypt-mnt.XXXXXX)" # shellcheck disable=SC2064 trap "homectl deactivate fscrypttest 2>/dev/null || true; homectl remove fscrypttest 2>/dev/null || true; umount '$MNT' 2>/dev/null || true; rm -rf '$MNT' '$IMAGE'" RETURN ERR truncate -s 64M "$IMAGE" if ! mkfs.ext4 -q -O encrypt "$IMAGE"; then -- systemctl try-reload-or-restart polkit.service NEWPASSWORD=foobar homectl create idgrouptest2 --storage=directory --shell=/bin/bash --enforce-password-policy=no --rebalance-weight=off PASSWORD=foobar homectl activate idgrouptest2 cat >/tmp/idgrouptest-add-group.sh <<'EOF' #!/bin/bash set -exuo pipefail loginctl show-session "${XDG_SESSION_ID:?}" -p Active --value | grep '^yes$' >/dev/null RECORD="$(busctl -j call org.freedesktop.home1 /org/freedesktop/home1 org.freedesktop.home1.Manager GetUserRecordByName s "$USER" | jq -r '.data[0]')" -- UPDATE_TS=$((TS + 1)) UPDATE_RECORD="$(printf '%s' "$RECORD" | jq -c --argjson ts "$UPDATE_TS" --arg p foobar 'del(.binding, .status, .signature) | .lastChangeUSec = $ts | .secret = {password: [$p]}')" (! busctl call org.freedesktop.home1 /org/freedesktop/home1 org.freedesktop.home1.Manager UpdateHomeEx "sa{sh}t" "$UPDATE_RECORD" 0 0 ) EOF chmod +x /tmp/idgrouptest-add-group.sh machinectl shell idgrouptest2@ /tmp/idgrouptest-add-group.sh rm -f /tmp/idgrouptest-add-group.sh PASSWORD=foobar homectl authenticate idgrouptest2 local groups groups="$(machinectl shell idgrouptest2@ /usr/bin/groups)" Found error in /usr/lib/systemd/tests/testdata/units/TEST-44-LOG-NAMESPACE.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-44-LOG-NAMESPACE.sh journalctl --namespace=foobar --sync journalctl --namespace=foobaz --sync ls -l /var/log/journal/ journalctl --list-namespaces journalctl -o cat --namespace=foobar >/tmp/hello-world journalctl -o cat >/tmp/no-hello-world journalctl --list-namespaces | grep foobar journalctl --list-namespaces | grep foobaz journalctl --list-namespaces -o json | jq . [[ "$(journalctl --root=/tmp --list-namespaces --quiet)" == "" ]] root="$(mktemp -d /tmp/journal-ns-root.XXXXXX)" mkdir -p "$root/etc" "$root/var/log/journal/11111111111111111111111111111111.testns" printf '11111111111111111111111111111111\n' >"$root/etc/machine-id" [[ "$(journalctl --root="$root" --list-namespaces --quiet)" == "testns" ]] grep "^hello world$" /tmp/hello-world (! grep "^hello world$" /tmp/no-hello-world) touch /testok Found error in /usr/lib/systemd/tests/testdata/units/TEST-29-PORTABLE.directory.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-29-PORTABLE.directory.sh # If we're running under sanitizers, we need to use a less restrictive # profile, otherwise LSan syscall would get blocked by seccomp ARGS+=(--profile=trusted) fi unsquashfs -force -no-xattrs -d /tmp/minimal_0 /usr/share/minimal_0.raw unsquashfs -force -no-xattrs -d /tmp/minimal_1 /usr/share/minimal_1.raw rm -rf /tmp/mismatched-name cp -a /tmp/minimal_0 /tmp/mismatched-name portablectl inspect /tmp/mismatched-name | grep -F "minimal-app0.service" >/dev/null rm -rf /tmp/remove-relative cp -a /tmp/minimal_0 /tmp/remove-relative (cd /tmp && portablectl remove ./remove-relative) test ! -e /tmp/remove-relative rm -rf /tmp/symlink-unit cp -a /tmp/minimal_0 /tmp/symlink-unit printf '[Service]\nExecStart=/bin/true\n' >/tmp/portable-host-unit rm -f /tmp/symlink-unit/usr/lib/systemd/system/minimal-app0.service ln -s /tmp/portable-host-unit /tmp/symlink-unit/usr/lib/systemd/system/minimal-app0.service (! portablectl inspect --cat /tmp/symlink-unit minimal-app0.service) rm -f /tmp/portable-host-unit portablectl "${ARGS[@]}" attach --copy=symlink --now --runtime /tmp/minimal_0 minimal-app0 systemctl is-active minimal-app0.service systemctl is-active minimal-app0-foo.service systemctl is-active minimal-app0-bar.service && exit 1 portablectl "${ARGS[@]}" reattach --now --enable --runtime /tmp/minimal_1 minimal-app0 systemctl is-active minimal-app0.service systemctl is-active minimal-app0-bar.service systemctl is-active minimal-app0-foo.service && exit 1 portablectl list | grep -F "minimal_1" >/dev/null busctl tree org.freedesktop.portable1 --no-pager | grep -F '/org/freedesktop/portable1/image/minimal_5f1' >/dev/null portablectl detach --now --enable --runtime /tmp/minimal_1 minimal-app0 portablectl list | grep -F "No images." >/dev/null busctl tree org.freedesktop.portable1 --no-pager | grep -F '/org/freedesktop/portable1/image/minimal_5f1' && exit 1 >/dev/null mkdir /tmp/rootdir /tmp/app0 /tmp/app1 /tmp/overlay /tmp/os-release-fix /tmp/os-release-fix/etc mount /tmp/app0.raw /tmp/app0 mount /tmp/app1.raw /tmp/app1 mount /usr/share/minimal_0.raw /tmp/rootdir # Fix up os-release to drop the valid PORTABLE_SERVICES field (because we are # bypassing the sysext logic in portabled here it will otherwise not see the # extensions additional valid prefix) grep -v "^PORTABLE_PREFIXES=" /tmp/rootdir/etc/os-release >/tmp/os-release-fix/etc/os-release mount -t overlay overlay -o lowerdir=/tmp/os-release-fix:/tmp/app1:/tmp/rootdir /tmp/overlay grep . /tmp/overlay/usr/lib/extension-release.d/* grep . /tmp/overlay/etc/os-release portablectl "${ARGS[@]}" attach --copy=symlink --now --runtime /tmp/overlay app1 systemctl is-active app1.service portablectl detach --now --runtime overlay app1 -- [Unit] Description=App 1 EOF systemctl daemon-reload portablectl "${ARGS[@]}" attach --force --copy=symlink --now --runtime /tmp/overlay app1 systemctl is-active app1.service portablectl detach --now --runtime overlay app1 umount /tmp/overlay portablectl "${ARGS[@]}" attach --copy=symlink --now --runtime --extension /tmp/app0 --extension /tmp/app1 /tmp/rootdir app0 app1 systemctl is-active app0.service systemctl is-active app1.service portablectl inspect --cat --extension app0 --extension app1 rootdir app0 app1 | grep -f /tmp/rootdir/usr/lib/os-release >/dev/null portablectl inspect --cat --extension app0 --extension app1 rootdir app0 app1 | grep -f /tmp/app0/usr/lib/extension-release.d/extension-release.app0 >/dev/null portablectl inspect --cat --extension app0 --extension app1 rootdir app0 app1 | grep -f /tmp/app1/usr/lib/extension-release.d/extension-release.app2 >/dev/null portablectl inspect --cat --extension app0 --extension app1 rootdir app0 app1 | grep -f /tmp/app1/usr/lib/systemd/system/app1.service >/dev/null portablectl inspect --cat --extension app0 --extension app1 rootdir app0 app1 | grep -f /tmp/app0/usr/lib/systemd/system/app0.service >/dev/null grep -q -F "LogExtraFields=PORTABLE=app0" /run/systemd/system.attached/app0.service.d/20-portable.conf grep -q -F "LogExtraFields=PORTABLE_ROOT=rootdir" /run/systemd/system.attached/app0.service.d/20-portable.conf grep -q -F "LogExtraFields=PORTABLE_EXTENSION=app0" /run/systemd/system.attached/app0.service.d/20-portable.conf grep -q -F "LogExtraFields=PORTABLE_EXTENSION_NAME_AND_VERSION=app" /run/systemd/system.attached/app0.service.d/20-portable.conf -- grep -q -F "LogExtraFields=PORTABLE_EXTENSION=app0" /run/systemd/system.attached/app1.service.d/20-portable.conf grep -q -F "LogExtraFields=PORTABLE_EXTENSION_NAME_AND_VERSION=app" /run/systemd/system.attached/app1.service.d/20-portable.conf grep -q -F "LogExtraFields=PORTABLE_EXTENSION=app1" /run/systemd/system.attached/app1.service.d/20-portable.conf grep -q -F "LogExtraFields=PORTABLE_EXTENSION_NAME_AND_VERSION=app_1" /run/systemd/system.attached/app1.service.d/20-portable.conf portablectl detach --clean --now --runtime --extension /tmp/app0 --extension /tmp/app1 /tmp/rootdir app0 app1 # Ensure --clean remove state and other directories belonging to the portable image being detached test ! -d /var/lib/app0 test ! -d /run/app0 # Ensure that mixed mode copies the images and units (client-owned) but symlinks the profile (OS owned) portablectl "${ARGS[@]}" attach --copy=mixed --runtime --extension /tmp/app0 --extension /tmp/app1 /tmp/rootdir app0 app1 test -d /run/portables/app0 test -d /run/portables/app1 test -d /run/portables/rootdir test -f /run/systemd/system.attached/app0.service test -f /run/systemd/system.attached/app1.service test -L /run/systemd/system.attached/app0.service.d/10-profile.conf test -L /run/systemd/system.attached/app1.service.d/10-profile.conf portablectl detach --runtime --extension /tmp/app0 --extension /tmp/app1 /tmp/rootdir app0 app1 # Ensure that --force works with directory extensions, and that ExtensionDirectories= # is not decorated with :x-systemd.relax-extension-release-check portablectl "${ARGS[@]}" attach --force --copy=symlink --now --runtime --extension /tmp/app0 /tmp/rootdir app0 systemctl is-active app0.service status="$(portablectl is-attached --extension app0 rootdir)" [[ "${status}" == "running-runtime" ]] grep -q -F "ExtensionDirectories=" /run/systemd/system.attached/app0.service.d/20-portable.conf (! grep -q -F "x-systemd.relax-extension-release-check" /run/systemd/system.attached/app0.service.d/20-portable.conf) portablectl detach --now --runtime --extension /tmp/app0 /tmp/rootdir app0 rm -rf /tmp/app10 cp -a /tmp/app0 /tmp/app10 portablectl "${ARGS[@]}" attach --force --copy=symlink --runtime --extension /tmp/app10 /tmp/rootdir app0 portablectl inspect --force --cat --extension /tmp/app10 /tmp/rootdir app0 | grep -f /tmp/app10/usr/lib/extension-release.d/extension-release.app0 >/dev/null portablectl detach --runtime --extension /tmp/app10 /tmp/rootdir app0 rm -rf /tmp/app10 # Attempt to disable the app unit during detaching. Requires --copy=symlink to reproduce. # Provides coverage for https://github.com/systemd/systemd/issues/23481 portablectl "${ARGS[@]}" attach --copy=symlink --now --runtime /tmp/rootdir minimal-app0 portablectl detach --now --runtime --enable /tmp/rootdir minimal-app0 # Attach and detach again to check if drop-in-only leftovers are still recognized and removed. portablectl "${ARGS[@]}" attach --copy=symlink --now --runtime /tmp/rootdir minimal-app0 rm /run/systemd/system.attached/minimal-app0*.service status="$(portablectl is-attached --runtime /tmp/rootdir)" [[ "${status}" == "running-runtime" ]] systemctl stop minimal-app0.service minimal-app0-foo.service status="$(portablectl is-attached --runtime /tmp/rootdir)" [[ "${status}" == "attached-runtime" ]] portablectl detach --now --runtime --enable /tmp/rootdir minimal-app0 [[ ! -d /run/systemd/system.attached/minimal-app0.service.d ]] [[ ! -d /run/systemd/system.attached/minimal-app0-foo.service.d ]] # The wrong file should be ignored, given the right one has the xattr set trap 'rm -rf /var/cache/wrongext' EXIT mkdir -p /var/cache/wrongext/usr/lib/extension-release.d /var/cache/wrongext/usr/lib/systemd/system/ echo "[Service]" >/var/cache/wrongext/usr/lib/systemd/system/app0.service touch /var/cache/wrongext/usr/lib/extension-release.d/extension-release.wrongext_somethingwrong.txt cp /tmp/rootdir/usr/lib/os-release /var/cache/wrongext/usr/lib/extension-release.d/extension-release.app0 setfattr -n user.extension-release.strict -v "false" /var/cache/wrongext/usr/lib/extension-release.d/extension-release.app0 portablectl "${ARGS[@]}" attach --runtime --extension /var/cache/wrongext /tmp/rootdir app0 status="$(portablectl is-attached --extension wrongext rootdir)" [[ "${status}" == "attached-runtime" ]] portablectl detach --runtime --extension /var/cache/wrongext /tmp/rootdir app0 umount /tmp/rootdir umount /tmp/app0 umount /tmp/app1 Found error in /usr/lib/systemd/tests/testdata/units/TEST-24-CRYPTSETUP.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-24-CRYPTSETUP.sh at_exit() { set +e mountpoint -q /proc/cmdline && umount /proc/cmdline rm -f /etc/crypttab [[ -e /tmp/crypttab.bak ]] && cp -fv /tmp/crypttab.bak /etc/crypttab [[ -n "${STORE_LOOP:-}" ]] && losetup -d "$STORE_LOOP" [[ -n "${WORKDIR:-}" ]] && rm -rf "$WORKDIR" systemctl daemon-reload } -- cp "$IMAGE_DETACHED_HEADER" "$TMPFS_DETACHED_HEADER/header" udevadm settle --timeout=60 # Prepare our test crypttab [[ -e /etc/crypttab ]] && cp -fv /etc/crypttab /tmp/crypttab.bak cat >/etc/crypttab </tmp/cmdline.tmp mount --bind /tmp/cmdline.tmp /proc/cmdline # Run the systemd-cryptsetup-generator once explicitly, to collect coverage, # as during daemon-reload we run generators in a sandbox mkdir -p /tmp/systemd-cryptsetup-generator.out /usr/lib/systemd/system-generators/systemd-cryptsetup-generator /tmp/systemd-cryptsetup-generator.out/ systemctl daemon-reload systemctl list-unit-files "systemd-cryptsetup@*" cryptsetup_start_and_check empty_key test -e "$IMAGE_EMPTY_KEYFILE_ERASE" Found error in /usr/lib/systemd/tests/testdata/units/TEST-23-UNIT-FILE.ExtraFileDescriptors.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-23-UNIT-FILE.ExtraFileDescriptors.sh . "$(dirname "$0")"/util.sh at_exit() { set +e rm -rf /tmp/test-extra-fd/ } trap at_exit EXIT mkdir /tmp/test-extra-fd echo "Hello" >/tmp/test-extra-fd/1.txt echo "Extra" >/tmp/test-extra-fd/2.txt # Open files and assign FD to variables exec {TEST_FD1}/tmp/forking1.sh </tmp/forking2.sh </tmp/notify1.sh </dev/null | grep -v '^[\?\-]$' >/dev/null; then TEST_TMPFILES_AGEBY_BTIME=1 fi touch -a --date "2 minutes ago" /tmp/ageby/d1/f1 touch -m --date "4 minutes ago" /tmp/ageby/d2/f1 # Create a bunch of other files. touch /tmp/ageby/d{1,2}/f{2..4} # For "ctime". touch /tmp/ageby/d3/f1 chmod +x /tmp/ageby/d3/f1 sleep 1 # For "btime". touch /tmp/ageby/d4/f1 sleep 1 # More files with recent "{a,b}time" values. touch /tmp/ageby/d{3,4}/f{2..4} # Check for cleanup of "f1" in each of "/tmp/d{1..4}". systemd-tmpfiles --dry-run --clean - <<-EOF d /tmp/ageby/d1 - - - a:1m - e /tmp/ageby/d2 - - - m:3m - D /tmp/ageby/d3 - - - c:2s - EOF for d in d{1..3}; do test -f "/tmp/ageby/${d}/f1" done systemd-tmpfiles --clean - <<-EOF d /tmp/ageby/d1 - - - a:1m - e /tmp/ageby/d2 - - - m:3m - D /tmp/ageby/d3 - - - c:2s - EOF for d in d{1..3}; do test ! -f "/tmp/ageby/${d}/f1" done if [[ $TEST_TMPFILES_AGEBY_BTIME -gt 0 ]]; then systemd-tmpfiles --clean - <<-EOF d /tmp/ageby/d4 - - - b:1s - EOF test ! -f "/tmp/ageby/d4/f1" else # Remove the file manually. rm "/tmp/ageby/d4/f1" fi # Check for an invalid "age" and "age-by" arguments. for a in ':' ':1s' '2:1h' 'nope:42h' '" :7m"' 'm:' '::' '"+r^w-x:2/h"' '"b ar::64"'; do systemd-tmpfiles --clean - <&1 | grep -F 'Invalid age' >/dev/null d /tmp/ageby - - - ${a} - EOF done for d in d{1..4}; do for f in f{2..4}; do test -f "/tmp/ageby/${d}/${f}" done done # Check for parsing with whitespace, repeated values # for "age-by" (valid arguments). for a in '" a:24h"' 'cccaab:2h' '" aa : 4h"' '" a A B C c:1h"'; do systemd-tmpfiles --clean - </tmp/ageby-remove/locked-file exec {recursive_lock_fd}<>/tmp/ageby-remove/locked-recursive-file flock --exclusive "$lock_fd" flock --exclusive "$recursive_lock_fd" systemd-tmpfiles --clean - <<-EOF r /tmp/ageby-remove/locked-file - - - m:1m - R /tmp/ageby-remove/locked-recursive-file - - - m:1m - EOF test -e /tmp/ageby-remove/locked-file test -e /tmp/ageby-remove/locked-recursive-file exec {lock_fd}>&- exec {recursive_lock_fd}>&- systemd-tmpfiles --clean - <<-EOF r /tmp/ageby-remove/locked-file - - - m:1m - R /tmp/ageby-remove/locked-recursive-file - - - m:1m - EOF test ! -e /tmp/ageby-remove/locked-file test ! -e /tmp/ageby-remove/locked-recursive-file # Aged r cleanup skips locked directories. mkdir -p /tmp/ageby-remove/locked-r-dir touch --date "3 minutes ago" /tmp/ageby-remove/locked-r-dir flock --exclusive /tmp/ageby-remove/locked-r-dir systemd-tmpfiles --clean --inline \ "r /tmp/ageby-remove/locked-r-dir - - - M:1m -" test -d /tmp/ageby-remove/locked-r-dir systemd-tmpfiles --clean --inline "r /tmp/ageby-remove/locked-r-dir - - - M:1m -" test ! -e /tmp/ageby-remove/locked-r-dir # Aged R cleanup skips locked directories and everything below them. mkdir -p /tmp/ageby-remove/locked-dir/child touch --date "3 minutes ago" /tmp/ageby-remove/locked-dir /tmp/ageby-remove/locked-dir/child flock --exclusive /tmp/ageby-remove/locked-dir systemd-tmpfiles --clean --inline \ "R /tmp/ageby-remove/locked-dir - - - M:1m -" test -d /tmp/ageby-remove/locked-dir/child systemd-tmpfiles --clean --inline "R /tmp/ageby-remove/locked-dir - - - M:1m -" test ! -e /tmp/ageby-remove/locked-dir rm -rf /tmp/ageby-remove # X entries inherit the parent cleanup age and its age-by fields. rm -rf /tmp/ageby-x-inherit mkdir -p /tmp/ageby-x-inherit/parent/child /tmp/ageby-x-inherit/parent/other printf old >/tmp/ageby-x-inherit/parent/child/file printf old >/tmp/ageby-x-inherit/parent/other/file touch --date "3 days ago" /tmp/ageby-x-inherit/parent/child/file /tmp/ageby-x-inherit/parent/other/file systemd-tmpfiles --clean - <<-EOF d /tmp/ageby-x-inherit/parent - - - m:1d X /tmp/ageby-x-inherit/parent/child - - - - EOF test ! -e /tmp/ageby-x-inherit/parent/child/file test ! -e /tmp/ageby-x-inherit/parent/other/file rm -rf /tmp/ageby-x-inherit Found error in /usr/lib/systemd/tests/testdata/units/TEST-22-TMPFILES.03.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-22-TMPFILES.03.sh set -o pipefail # shellcheck source=test/units/util.sh . "$(dirname "$0")"/util.sh rm -fr /tmp/{f,F,w} mkdir /tmp/{f,F,w} touch /tmp/file-owned-by-root # # 'f' # systemd-tmpfiles --dry-run --create - </tmp/F/truncated echo "This should be truncated" >/tmp/F/truncated-with-content systemd-tmpfiles --create - </tmp/F/rw-fs/foo (! systemd-tmpfiles --create -) </tmp/F/rw-fs/foo (! systemd-tmpfiles --create -) </tmp/C-copy-failure-src/file chmod 555 /tmp/C-copy-failure-dst (! runas nobody systemd-tmpfiles --create - < fails. (! systemd-tmpfiles --create -) </tmp/C/3/f1 systemd-tmpfiles --create - </tmp/config.conf ret=0 systemd-tmpfiles --remove /tmp/config.conf || ret=$? test "$ret" -eq 65 # EX_DATAERR ret=0 systemd-tmpfiles --remove /tmp/config-missing.conf || ret=$? test "$ret" -eq 1 Found error in /usr/lib/systemd/tests/testdata/units/TEST-19-CGROUP.ExitType-cgroup.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-19-CGROUP.ExitType-cgroup.sh echo "Skipping $0 as we're not running with the unified cgroup hierarchy" exit 77 fi # Multiple level process tree, parent process stays up cat >/tmp/test19-exit-cgroup.sh < sleep sleep infinity & -- (sleep 1; \$1) & # process tree: systemd -> bash -> sleep sleep infinity EOF chmod +x /tmp/test19-exit-cgroup.sh # service should be stopped cleanly systemd-run --wait \ --unit=one \ --property="Type=notify" \ --property="ExitType=cgroup" \ /tmp/test19-exit-cgroup.sh 'systemctl stop one' # same thing with a truthy exec condition systemd-run --wait \ --unit=two \ --property="Type=notify" \ --property="ExitType=cgroup" \ --property="ExecCondition=true" \ /tmp/test19-exit-cgroup.sh 'systemctl stop two' # false exec condition: systemd-run should exit immediately with status code: 1 (! systemd-run --wait \ --unit=three \ --property="Type=notify" \ --property="ExitType=cgroup" \ --property="ExecCondition=false" \ /tmp/test19-exit-cgroup.sh) # service should exit uncleanly (main process exits with SIGKILL) (! systemd-run --wait \ --unit=four \ --property="Type=notify" \ --property="ExitType=cgroup" \ /tmp/test19-exit-cgroup.sh 'systemctl kill --signal 9 four') # Multiple level process tree, parent process exits quickly cat >/tmp/test19-exit-cgroup-parentless.sh < sleep sleep infinity & -- systemd-notify --ready # Run the stop/kill command after this bash process exits (sleep 1; \$1) & EOF chmod +x /tmp/test19-exit-cgroup-parentless.sh # service should be stopped cleanly systemd-run --wait \ --unit=five \ --property="Type=notify" \ --property="ExitType=cgroup" \ /tmp/test19-exit-cgroup-parentless.sh 'systemctl stop five' # service should still exit cleanly despite SIGKILL (the main process already exited cleanly) systemd-run --wait \ --unit=six \ --property="Type=notify" \ --property="ExitType=cgroup" \ /tmp/test19-exit-cgroup-parentless.sh 'systemctl kill --signal 9 six' Found error in /usr/lib/systemd/tests/testdata/units/TEST-17-UDEV.queued-events-serialization.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-17-UDEV.queued-events-serialization.sh ACTION=="remove", GOTO="end" IMPORT{db}="INVOCATIONS" IMPORT{program}="/bin/bash -c 'systemctl show --property=InvocationID systemd-udevd.service'" ENV{INVOCATIONS}+="%E{ACTION}_%E{SEQNUM}_%E{InvocationID}" ACTION=="add", RUN+="/bin/bash -c ': >/tmp/marker'", RUN+="/usr/bin/sleep 10" LABEL="end" EOF udevadm control --reload udevadm settle --timeout 30 rm -f /tmp/marker # Save the current invocation ID of udevd. INVOCATION_BEFORE="$(systemctl show --property=InvocationID --value systemd-udevd.service)" # Trigger several actions. -- done # While processing the first 'add' event, request restarting udevd. # Hence, the queued subsequent 'change' events should be serialized, # then deserialized, requeued, and processed in the next invocation. timeout 10 bash -c 'until test -e /tmp/marker; do sleep .1; done' systemctl restart systemd-udevd.service udevadm settle --timeout 30 # Get the invocation ID of the restarted udevd. INVOCATION_AFTER="$(systemctl show --property=InvocationID --value systemd-udevd.service)" -- done < <(udevadm info -q property --property=INVOCATIONS --value /dev/null | sed -e 's/ /\n/g; s/_/ /g') # Check the total number of events processed by the udevd. assert_eq "$count" "5" rm -f "$rules" /tmp/marker udevadm control --reload exit 0 Found error in /usr/lib/systemd/tests/testdata/units/TEST-17-UDEV.SYSTEMD_WANTS-escape.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-17-UDEV.SYSTEMD_WANTS-escape.sh IFNAME=test-netif-foo at_exit() { set +e rm -f /tmp/output-i /tmp/output-I rm -rf /run/udev/rules.d/ udevadm control --reload rm -f /run/systemd/system/test@.service -- mkdir -p /run/systemd/system/ cat >/run/systemd/system/test@.service </tmp/output-i; echo "I=/%I" >/tmp/output-I' RemainAfterExit=yes EOF systemctl daemon-reload -- udevadm wait --timeout=30 --settle "/sys/class/net/${IFNAME}" assert_eq "$(udevadm info --query=property --property SYSTEMD_WANTS --value "/sys/class/net/${IFNAME}")" "test@${ESCAPED}.service" # The value shown by systemctl is doubly escaped and quoted. assert_eq "$(systemctl show -p Wants --value "${ESCAPED}.device")" "\"test@${SHELL_ESCAPED}.service\"" timeout 30 bash -c 'until [[ -s /tmp/output-i ]] && [[ -s /tmp/output-I ]]; do sleep .5; done' assert_eq "$(cat /tmp/output-i)" "i=${ESCAPED}" assert_eq "$(cat /tmp/output-I)" "I=${SYSPATH}" exit 0 Found error in /usr/lib/systemd/tests/testdata/units/TEST-15-DROPIN.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-15-DROPIN.sh testcase_symlink_dropin_directory() { # For issue #21920. echo "Testing symlink drop-in directory..." create_services test15-a rmdir /{etc,run,usr/lib}/systemd/system/test15-a.service.d mkdir -p /tmp/TEST-15-DROPIN-test15-a-dropin-directory ln -s /tmp/TEST-15-DROPIN-test15-a-dropin-directory /etc/systemd/system/test15-a.service.d cat >/tmp/TEST-15-DROPIN-test15-a-dropin-directory/override.conf </tmp/foo chmod 600 /tmp/foo run0 -u testuser \ systemd-run --unit exfiltrate.service --service-type notify --property NotifyAccess=all --user \ unshare --map-root-user --user --mount \ bash -c 'mount --bind /tmp/foo /usr/lib/os-release; systemd-notify --ready; exec sleep infinity' exfiltrate_pid="$(systemctl --machine testuser@.host show --user -P MainPID exfiltrate.service)" run0 -u testuser \ varlinkctl \ call \ /run/systemd/machine/io.systemd.Machine \ -- "{\"name\":\"exfiltrate\",\"acquireMetadata\":\"graceful\"}" 2>&1)" || true (! echo "$exfiltrate_output" | grep '"name".*"exfiltrate"' >/dev/null) (! echo "$exfiltrate_output" | grep "FOO=bar" >/dev/null) systemctl --user --machine testuser@ stop exfiltrate.service run0 -u testuser mkdir /var/tmp/image-tar run0 -u testuser importctl --user export-tar zurps /var/tmp/image-tar/kurps.tar.gz -m run0 -u testuser importctl --user import-tar /var/tmp/image-tar/kurps.tar.gz -m run0 -u testuser -i "echo -e \"[Exec]\nKillSignal=SIGKILL\n\" >.config/systemd/nspawn/kurps.nspawn" run0 -u testuser systemctl start --user systemd-nspawn@kurps.service machinectl terminate kurps run0 -u testuser -D /var/tmp/image-tar/ bash -c 'sha256sum kurps.tar.gz >SHA256SUMS' run0 -u testuser importctl --user pull-tar file:///var/tmp/image-tar/kurps.tar.gz nurps --verify=checksum -m run0 -u testuser -i "echo -e \"[Exec]\nKillSignal=SIGKILL\n\" >.config/systemd/nspawn/nurps.nspawn" run0 -u testuser systemctl start --user systemd-nspawn@nurps.service machinectl terminate nurps run0 -u testuser rm -r /var/tmp/image-tar run0 -u testuser importctl --user list-images run0 -u testuser machinectl --user list-images assert_in 'zurps' "$(run0 --pipe -u testuser machinectl --user list-images)" -- run0 -u testuser machinectl --user remove inodetest run0 -u testuser machinectl --user remove inodetest2 # Test tree mangling (i.e. moving the root dir one level up on extract) mkdir -p /var/tmp/mangletest/mangletest-0.1/usr/lib echo "ID=brumm" >/var/tmp/mangletest/mangletest-0.1/usr/lib/os-release tar -C /var/tmp/mangletest/ -cvzf /var/tmp/mangletest.tar.gz mangletest-0.1 run0 --pipe -u testuser importctl -m --user import-tar /var/tmp/mangletest.tar.gz cmp /var/tmp/mangletest/mangletest-0.1/usr/lib/os-release /home/testuser/.local/state/machines/mangletest/usr/lib/os-release # Verify the fd-store preservation chain works end-to-end across: # payload (inside container) -> systemd-nspawn (user manager) -> user manager # -> system PID 1 (user@.service fd store) # Then restart the nspawn service and verify the inner payload actually Found error in /usr/lib/systemd/tests/testdata/units/TEST-13-NSPAWN.nspawn.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-13-NSPAWN.nspawn.sh set +e mountpoint -q /var/lib/machines && umount --recursive /var/lib/machines rm -f /run/systemd/nspawn/*.nspawn rm -fr /var/tmp/TEST-13-NSPAWN.* rm -f /run/verity.d/test-13-nspawn-*.crt } trap at_exit EXIT -- testcase_sanity() { local template root image uuid tmpdir tmpdir="$(mktemp -d)" template="$(mktemp -d /tmp/nspawn-template.XXX)" create_dummy_container "$template" # Create a simple image from the just created container template image="$(mktemp /var/lib/machines/TEST-13-NSPAWN.image-XXX.img)" truncate -s 384M "$image" mkfs.ext4 "$image" -- --port=udp:53 \ --port=tcp:22:2222 \ bash -xec 'ip addr add dev host0 10.0.0.10/24; ip a; ip addr del dev host0 10.0.0.10/24' # --load-credential=, --set-credential= echo "foo bar" >/tmp/cred.path systemd-nspawn --register=no \ --directory="$root" \ --load-credential=cred.path:/tmp/cred.path \ --set-credential="cred.set:hello world" \ bash -xec '[[ "$(/tmp/bind systemd-nspawn --register=no \ --directory="$root" \ --bind=/tmp/bind \ bash -c 'test -e /tmp/bind' rm -fr "$root" /tmp/bind } testcase_norbind() { # https://github.com/systemd/systemd/issues/13170 local root root="$(mktemp -d /var/lib/machines/TEST-13-NSPAWN.norbind-path.XXX)" mkdir -p /tmp/binddir/subdir echo -n "outer" >/tmp/binddir/subdir/file mount -t tmpfs tmpfs /tmp/binddir/subdir echo -n "inner" >/tmp/binddir/subdir/file create_dummy_container "$root" systemd-nspawn --register=no \ --directory="$root" \ --bind=/tmp/binddir:/mnt:norbind \ bash -c 'CONTENT=$(cat /mnt/subdir/file); if [[ $CONTENT != "outer" ]]; then echo "*** unexpected content: $CONTENT"; exit 1; fi' umount /tmp/binddir/subdir rm -fr "$root" /tmp/binddir/ } rootidmap_cleanup() { local dir="${1:?}" -- local root cmd permissions local owner=1000 root="$(mktemp -d /var/lib/machines/TEST-13-NSPAWN.rootidmap-path.XXX)" # Create ext4 image, as ext4 supports idmapped-mounts. mkdir -p /tmp/rootidmap/bind truncate -s $((4096*2048)) /tmp/rootidmap/ext4.img mkfs.ext4 /tmp/rootidmap/ext4.img mount /tmp/rootidmap/ext4.img /tmp/rootidmap/bind trap "rootidmap_cleanup /tmp/rootidmap/" RETURN touch /tmp/rootidmap/bind/file chown -R "$owner:$owner" /tmp/rootidmap/bind create_dummy_container "$root" cmd='PERMISSIONS=$(stat -c "%u:%g" /mnt/file); if [[ $PERMISSIONS != "0:0" ]]; then echo "*** wrong permissions: $PERMISSIONS"; return 1; fi; touch /mnt/other_file' if ! SYSTEMD_LOG_TARGET=console \ systemd-nspawn --register=no \ --directory="$root" \ --bind=/tmp/rootidmap/bind:/mnt:rootidmap \ bash -c "$cmd" |& tee nspawn.out; then if grep -q "Failed to map ids for bind mount.*: Function not implemented" nspawn.out; then echo "idmapped mounts are not supported, skipping the test..." return 0 fi return 1 fi permissions=$(stat -c "%u:%g" /tmp/rootidmap/bind/other_file) if [[ $permissions != "$owner:$owner" ]]; then echo "*** wrong permissions: $permissions" [[ "$IS_USERNS_SUPPORTED" == "yes" ]] && return 1 fi } -- local root cmd permissions local owner=1000 root="$(mktemp -d /var/lib/machines/TEST-13-NSPAWN.owneridmap-path.XXX)" # Create ext4 image, as ext4 supports idmapped-mounts. mkdir -p /tmp/owneridmap/bind truncate -s $((4096*2048)) /tmp/owneridmap/ext4.img mkfs.ext4 /tmp/owneridmap/ext4.img mount /tmp/owneridmap/ext4.img /tmp/owneridmap/bind trap "owneridmap_cleanup /tmp/owneridmap/" RETURN touch /tmp/owneridmap/bind/file chown -R "$owner:$owner" /tmp/owneridmap/bind # Allow users to read and execute / in order to execute binaries chmod o+rx "$root" create_dummy_container "$root" -- if ! SYSTEMD_LOG_TARGET=console \ systemd-nspawn --register=no \ --directory="$root" \ -U \ --uid=testuser \ --bind=/tmp/owneridmap/bind:/home/testuser:owneridmap \ ${COVERAGE_BUILD_DIR:+--bind="$COVERAGE_BUILD_DIR"} \ bash -c "$cmd" |& tee nspawn.out; then if grep -q "Failed to map ids for bind mount.*: Function not implemented" nspawn.out; then echo "idmapped mounts are not supported, skipping the test..." return 0 fi return 1 fi permissions=$(stat -c "%u:%g" /tmp/owneridmap/bind/other_file) if [[ $permissions != "$owner:$owner" ]]; then echo "*** wrong permissions: $permissions" [[ "$IS_USERNS_SUPPORTED" == "yes" ]] && return 1 fi } -- entrypoint="$root/entrypoint.sh" cat >"$entrypoint" <<\EOF #!/usr/bin/env bash set -ex . /tmp/os-release [[ -n "${ID:-}" && "$ID" != "$container_host_id" ]] && exit 1 [[ -n "${VERSION_ID:-}" && "$VERSION_ID" != "$container_host_version_id" ]] && exit 1 [[ -n "${BUILD_ID:-}" && "$BUILD_ID" != "$container_host_build_id" ]] && exit 1 [[ -n "${VARIANT_ID:-}" && "$VARIANT_ID" != "$container_host_variant_id" ]] && exit 1 -- echo MARKER=1 >>/etc/os-release fi systemd-nspawn --register=no \ --directory="$root" \ --bind="$os_release_source:/tmp/os-release" \ "${entrypoint##"$root"}" if grep -q MARKER /etc/os-release; then ln -svrf /usr/lib/os-release /etc/os-release fi -- rm -fr "$root" } testcase_machinectl_bind() { local service_path service_name root container_name ec local cmd="timeout 10 bash -c 'until [[ -f /tmp/marker ]] && [[ -f /tmp/marker-varlink ]]; do sleep .5; done'; sleep 3" root="$(mktemp -d /var/lib/machines/TEST-13-NSPAWN.machinectl-bind.XXX)" create_dummy_container "$root" container_name="$(basename "$root")" -- ExecStart=systemd-nspawn --directory="$root" --notify-ready=no bash -xec "$cmd" EOF systemctl daemon-reload systemctl start "$service_name" touch /tmp/marker machinectl bind --mkdir "$container_name" /tmp/marker touch /tmp/marker-varlink varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.BindMount "{\"name\": \"$container_name\", \"source\": \"/tmp/marker-varlink\", \"mkdir\": true}" timeout 10 bash -c "while [[ '\$(systemctl show -P SubState $service_name)' == running ]]; do sleep .2; done" ec="$(systemctl show -P ExecMainStatus "$service_name")" systemctl stop "$service_name" -- mkdir -p /run/systemd/nspawn/ rm -f "/etc/systemd/nspawn/$container_name.nspawn" cat >"/run/systemd/nspawn/$container_name.nspawn" <"/var/lib/machines/$NSPAWN_FRAGMENT" </tmp/fragment.nspawn </tmp/expected varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.List "{\"pid\":$pid}" | diff /tmp/expected - varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.List "{\"name\":\"long-running\", \"pid\":$pid}" | diff /tmp/expected - (! varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.List "{\"name\":\"non-existent\", \"pid\":$pid}") (! varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.List '{"name":""}') (! varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.List '{"name":"ah@??.hmm"}') # test io.systemd.Machine.Kill -- varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.Open '{"name": ".host", "mode": "tty"}' varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.Open '{"name": ".host", "mode": "login"}' varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.Open '{"name": ".host", "mode": "shell"}' rm -f /tmp/none-existent-file # We need to make sure the acquired pty fd stays open if we invoke a command # server side, to not generate early SIGHUP. Hence, let's just invoke "sleep # infinity" client side, once we acquired the fd (passing it to it), and kill # it once we verified everything worked. PID=$(systemd-notify --fork -- varlinkctl --exec call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.Open '{"name": ".host", "mode": "shell", "user": "root", "path": "/bin/bash", "args": ["bash", "-c", "echo $FOO >/tmp/none-existent-file"], "environment": ["FOO=BAR"]}' -- sleep infinity) timeout 30 bash -c "until test -e /tmp/none-existent-file; do sleep .5; done" grep -q "BAR" /tmp/none-existent-file kill "$PID" # Test varlinkctl's --exec fd passing logic properly assert_eq "$(varlinkctl --exec call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.Open '{"name": ".host", "mode": "shell", "user": "root", "path": "/bin/bash", "args": ["bash", "-c", "echo $((7 + 8))"], "environment": ["TERM=dumb"]}' -- bash -c 'read -r -N 2 x <&3 ; echo "$x"')" 15 -- (! varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.MapTo '{"gid": 0}') # io.systemd.Machine.BindMount is covered by testcase_check_machinectl_bind() in nspawn tests # test io.systemd.Machine.CopyTo rm -f /tmp/foo /var/lib/machines/long-running/root/foo cp /etc/machine-id /tmp/foo varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.CopyTo '{"name": "long-running", "source": "/tmp/foo", "destination": "/root/foo"}' diff /tmp/foo /var/lib/machines/long-running/root/foo (! varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.CopyTo '{"name": "long-running", "source": "/tmp/foo", "destination": "/root/foo"}') # FileExists varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.CopyTo '{"name": "long-running", "source": "/tmp/foo", "destination": "/root/foo", "replace": true}' echo "sample-test-output" >/tmp/foo varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.CopyTo '{"name": "long-running", "source": "/tmp/foo", "destination": "/root/foo", "replace": true}' diff /tmp/foo /var/lib/machines/long-running/root/foo rm -f /tmp/foo /var/lib/machines/long-running/root/foo # test io.systemd.Machine.CopyFrom cp /etc/machine-id /var/lib/machines/long-running/foo varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.CopyFrom '{"name": "long-running", "source": "/foo"}' diff /var/lib/machines/long-running/foo /foo Found error in /usr/lib/systemd/tests/testdata/units/TEST-07-PID1.socket-max-connection.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-07-PID1.socket-max-connection.sh systemctl daemon-reload systemctl start per-source-limit.socket systemctl status per-source-limit.socket # So these two should take up the first two connection slots socat -U - UNIX-CONNECT:/run/per-source-limit.sk | tee /tmp/foo.conn1 & J1="$!" socat -U - UNIX-CONNECT:/run/per-source-limit.sk | tee /tmp/foo.conn2 & J2="$!" waitfor() { local file="${1:?}" -- echo >&2 "Timeout while waiting for the expected output" return 1 } # Wait until the word "waldo" shows in the output files waitfor /tmp/foo.conn1 waitfor /tmp/foo.conn2 # The next connection should fail, because the limit is hit socat -U - UNIX-CONNECT:/run/per-source-limit.sk | tee /tmp/foo.conn3 & J3="$!" # But this one should work, because done under a different UID setpriv --reuid=1 socat -U - UNIX-CONNECT:/run/per-source-limit.sk | tee /tmp/foo.conn4 & J4="$!" waitfor /tmp/foo.conn4 # The third job should fail quickly, wait for it wait "$J3" # The other jobs will hang forever, since we run "sleep infinity" on the server side. Let's kill the jobs now. kill "$J1" kill "$J2" kill "$J4" # The 3rd connection should not have seen "waldo", since it should have been refused too early (! grep -q "waldo" /tmp/foo.conn3 ) Found error in /usr/lib/systemd/tests/testdata/units/TEST-07-PID1.private-pids.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-07-PID1.private-pids.sh # Unmount any file systems if [[ "$HAS_EXISTING_SCSI_MOUNT" == "no" ]]; then umount /proc/scsi fi umount /tmp/TEST-07-PID1-private-pids-proc rm -rf /tmp/TEST-07-PID1-private-pids-proc # Remove any test files rm -rf /tmp/TEST-07-PID1-private-pids-services rm -rf /tmp/TEST-07-PID1-private-pids-root # Stop any test services systemctl kill --signal=KILL TEST-07-PID1-private-pid.service # Remove any failed transient units systemctl reset-failed } -- assert_eq "$(systemctl show -P ExecMainStatus TEST-07-PID1-private-pid.service)" "9" systemctl reset-failed } testcase_analyze() { mkdir -p /tmp/TEST-07-PID1-private-pids-services # Verify other services are compatible with PrivatePIDs=yes cat </tmp/TEST-07-PID1-private-pids-services/oneshot-valid.service [Service] ExecStart=echo hello PrivatePIDs=yes Type=oneshot EOF # Verify Type=forking services are not compatible with PrivatePIDs=yes cat </tmp/TEST-07-PID1-private-pids-services/forking-invalid.service [Service] ExecStart=echo hello PrivatePIDs=yes Type=forking EOF systemd-analyze --recursive-errors=no verify /tmp/TEST-07-PID1-private-pids-services/oneshot-valid.service (! systemd-analyze --recursive-errors=no verify /tmp/TEST-07-PID1-private-pids-services/forking-invalid.service) rm -rf /tmp/TEST-07-PID1-private-pids-services } testcase_multiple_features() { unsquashfs -force -no-xattrs -d /tmp/TEST-07-PID1-private-pids-root /usr/share/minimal_0.raw systemd-run \ -p PrivatePIDs=yes \ -p RootDirectory=/tmp/TEST-07-PID1-private-pids-root \ -p ProcSubset=pid \ -p BindReadOnlyPaths=/usr/share \ -p NoNewPrivileges=yes \ -p ProtectSystem=strict \ -p User=testuser \ -- -p Environment=ABC=QED \ --wait \ --pipe \ grep MARKER=1 /etc/os-release rm -rf /tmp/TEST-07-PID1-private-pids-root } testcase_unpriv() { if [ ! -f /usr/lib/systemd/user/dbus.socket ] && [ ! -f /etc/systemd/user/dbus.socket ]; then echo "Per-user instances are not supported, skipping unprivileged PrivatePIDs=yes test" -- # be at least 1 unmasked procfs mount in ANY directory. Otherwise, if /proc/ is masked (e.g. /proc/scsi is # over-mounted with tmpfs), then mounting a new /proc/ will fail. # # Thus, to guarantee PrivatePIDs=yes tests for unprivileged users pass, we mount a new procfs on a temporary # directory with no masking. This will guarantee an unprivileged user can mount a new /proc/ successfully. mkdir -p /tmp/TEST-07-PID1-private-pids-proc mount -t proc proc /tmp/TEST-07-PID1-private-pids-proc # Verify running as unprivileged user can unshare PID namespace and mounts /proc properly. assert_eq "$(systemd-run --machine=testuser@.host --wait --user --pipe -p PrivatePIDs=yes readlink /proc/self)" "1" assert_eq "$(systemd-run --machine=testuser@.host --wait --user --pipe -p PrivatePIDs=yes ps aux --no-heading | wc -l)" "1" umount /tmp/TEST-07-PID1-private-pids-proc rm -rf /tmp/TEST-07-PID1-private-pids-proc # Now we will mask /proc/ by mounting tmpfs over /proc/scsi. This will guarantee that mounting /proc/ will fail # for unprivileged users when using PrivatePIDs=yes. Now units should fail as PrivatePIDs=yes has no graceful # fallback. # Found error in /usr/lib/systemd/tests/testdata/units/TEST-07-PID1.prefix-shell.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-07-PID1.prefix-shell.sh # shellcheck source=test/units/util.sh . "$(dirname "$0")"/util.sh systemd-run --wait --uid=nobody \ -p ExecStartPre="|true" \ -p ExecStartPre="|@echo a >/tmp/TEST-07-PID1.prefix-shell.flag" \ true assert_eq "$(cat /tmp/TEST-07-PID1.prefix-shell.flag)" "a" rm /tmp/TEST-07-PID1.prefix-shell.flag # If the service exits too early, journald cannot find the source process of the log message. # Hence, we cannot use 'journalctl -u' below. Instead, let's use --since=. journalctl --sync TS="$(date '+%H:%M:%S')" systemctl start prefix-shell.service assert_eq "$(cat /tmp/TEST-07-PID1.prefix-shell.flag)" "YAY!" journalctl --sync journalctl --since "$TS" --grep "with login shell .*: lvl 101" journalctl --since "$TS" --grep "with normal shell" Found error in /usr/lib/systemd/tests/testdata/units/TEST-07-PID1.main-PID-change.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-07-PID1.main-PID-change.sh # Update it back to our own PID, this should also work systemd-notify --uid=1000 MAINPID="$MAINPID" test "$(systemctl show -P MainPID TEST-07-PID1.service)" -eq "$MAINPID" cat >/tmp/test-mainpid.sh <<\EOF #!/usr/bin/env bash set -eux set -o pipefail -- sleep infinity & disown echo $MAINPID >/run/mainpidsh/pid EOF chmod +x /tmp/test-mainpid.sh systemd-run --unit=test-mainpidsh.service \ -p StandardOutput=tty \ -p StandardError=tty \ -p Type=forking \ -p RuntimeDirectory=mainpidsh \ -p PIDFile=/run/mainpidsh/pid \ /tmp/test-mainpid.sh test "$(systemctl show -P MainPID test-mainpidsh.service)" -eq "$(cat /run/mainpidsh/pid)" cat >/tmp/test-mainpid2.sh <<\EOF #!/usr/bin/env bash set -eux set -o pipefail -- disown echo $MAINPID >/run/mainpidsh2/pid chown 1001:1001 /run/mainpidsh2/pid EOF chmod +x /tmp/test-mainpid2.sh systemd-run --unit=test-mainpidsh2.service \ -p StandardOutput=tty \ -p StandardError=tty \ -p Type=forking \ -p RuntimeDirectory=mainpidsh2 \ -p PIDFile=/run/mainpidsh2/pid \ /tmp/test-mainpid2.sh test "$(systemctl show -P MainPID test-mainpidsh2.service)" -eq "$(cat /run/mainpidsh2/pid)" cat >/dev/shm/test-mainpid3.sh </tmp/output [[ $(wc -l /dev/null # -b always behaves like -b0 journalctl -q -b-1 -b0 -n+1 >/tmp/expected journalctl -q -b-1 -b -n+1 >/tmp/output diff /tmp/expected /tmp/output # ... even when another option follows (both of these should fail due to -m) { journalctl -ball -b0 -n+1 -m 2>&1 || :; } >/tmp/expected { journalctl -ball -b -n+1 -m 2>&1 || :; } >/tmp/output diff /tmp/expected /tmp/output # https://github.com/systemd/systemd/issues/13708 ID=$(systemd-id128 new) systemd-cat -t "$ID" bash -c 'echo parent; (echo child) & wait' & PID=$! wait $PID journalctl --sync # We can drop this grep when https://github.com/systemd/systemd/issues/13937 # has a fix. journalctl -b -o export -t "$ID" --output-fields=_PID | grep '^_PID=' >/tmp/output [[ $(wc -l /tmp/expected systemd-cat -t "$ID" bash -c 'env echo -n "This will"; echo; env echo -n "usually fail"; echo; env echo -n "and be truncated"; echo;' journalctl --sync journalctl -b -o cat -t "$ID" >/tmp/output diff /tmp/expected /tmp/output [[ $(journalctl -b -o cat -t "$ID" --output-fields=_TRANSPORT | grep -Pc "^stdout$") -eq 3 ]] [[ $(journalctl -b -o cat -t "$ID" --output-fields=_LINE_BREAK | grep -Pc "^pid-change$") -eq 3 ]] [[ $(journalctl -b -o cat -t "$ID" --output-fields=_PID | sort -u | grep -c "^.*$") -eq 3 ]] [[ $(journalctl -b -o cat -t "$ID" --output-fields=MESSAGE | grep -Pc "^(This will|usually fail|and be truncated)$") -eq 3 ]] -- systemctl start forever-print-hola sleep 3 systemctl restart systemd-journald sleep 3 systemctl stop forever-print-hola [[ ! -f "/tmp/i-lose-my-logs" ]] # https://github.com/systemd/systemd/issues/4408 rm -f /tmp/i-lose-my-logs systemctl start forever-print-hola sleep 3 systemctl kill --signal=SIGKILL systemd-journald sleep 3 [[ ! -f "/tmp/i-lose-my-logs" ]] systemctl stop forever-print-hola # https://github.com/systemd/systemd/issues/15528 journalctl --follow --file=/var/log/journal/*/* | head -n1 | grep . # https://github.com/systemd/systemd/issues/24565 journalctl --follow --merge | head -n1 | grep . # https://github.com/systemd/systemd/issues/26746 rm -f /tmp/issue-26746-log /tmp/issue-26746-cursor ID="$(systemd-id128 new)" journalctl -t "$ID" --follow --cursor-file=/tmp/issue-26746-cursor | tee /tmp/issue-26746-log & systemd-cat -t "$ID" bash -c 'echo hogehoge' # shellcheck disable=SC2016 timeout 10 bash -c 'until [[ -f /tmp/issue-26746-log && "$(cat /tmp/issue-26746-log)" =~ hogehoge ]]; do sleep .5; done' pkill -TERM journalctl timeout 10 bash -c 'until test -f /tmp/issue-26746-cursor; do sleep .5; done' CURSOR_FROM_FILE="$(cat /tmp/issue-26746-cursor)" CURSOR_FROM_JOURNAL="$(journalctl -t "$ID" --output=export MESSAGE=hogehoge | sed -n -e '/__CURSOR=/ { s/__CURSOR=//; p }')" test "$CURSOR_FROM_FILE" = "$CURSOR_FROM_JOURNAL" # Check that the seqnum field at least superficially works systemd-cat echo "ya" -- while read -r file; do filename="${file##*/}" unzstd "$file" -o "$JOURNAL_DIR/${filename%*.zst}" done < <(find /usr/lib/systemd/tests/testdata/test-journals/no-rtc -name "*.zst") journalctl --directory="$JOURNAL_DIR" --list-boots --output=json >/tmp/lb1 diff -u /tmp/lb1 - <<'EOF' [{"index":-3,"boot_id":"5ea5fc4f82a14186b5332a788ef9435e","first_entry":1666569600994371,"last_entry":1666584266223608},{"index":-2,"boot_id":"bea6864f21ad4c9594c04a99d89948b0","first_entry":1666569601005945,"last_entry":1666584347230411},{"index":-1,"boot_id":"4c708e1fd0744336be16f3931aa861fb","first_entry":1666569601017222,"last_entry":1666584354649355},{"index":0,"boot_id":"35e8501129134edd9df5267c49f744a4","first_entry":1666569601009823,"last_entry":1666584438086856}] EOF rm -rf "$JOURNAL_DIR" /tmp/lb1 # Check that using --after-cursor/--cursor-file= together with journal filters doesn't # skip over entries matched by the filter # See: https://github.com/systemd/systemd/issues/30288 UNIT_NAME="test-cursor-$RANDOM.service" Found error in /usr/lib/systemd/tests/testdata/units/TEST-04-JOURNAL.journal-remote.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/units/TEST-04-JOURNAL.journal-remote.sh # Generate a self-signed certificate for systemd-journal-remote # # Note: older OpenSSL requires a config file with some extra options, unfortunately # Note2: /run here is used on purpose, since the systemd-journal-remote service uses PrivateTmp=yes mkdir -pZ /run/systemd/journal-remote-tls cat >/tmp/openssl.conf <"$LOG_FILE" awk '!/^(data: \{.+\}|)$/ { exit 1; }' "$LOG_FILE" # Same thing as journalctl --output=export mkdir /tmp/remote-journal curl -LSfs --header "Accept: application/vnd.fdo.journal" http://localhost:19531/entries >"$LOG_FILE" /usr/lib/systemd/systemd-journal-remote --output=/tmp/remote-journal/system.journal --split-mode=none "$LOG_FILE" journalctl --directory=/tmp/remote-journal -t "$TEST_TAG" --grep "$TEST_MESSAGE" rm -rf /tmp/remote-journal/* # Let's do the same thing again, but let systemd-journal-remote spawn curl itself /usr/lib/systemd/systemd-journal-remote --url=http://localhost:19531/entries \ --output=/tmp/remote-journal/system.journal \ --split-mode=none journalctl --directory=/tmp/remote-journal -t "$TEST_TAG" --grep "$TEST_MESSAGE" rm -rf /tmp/remote-journal # /machine curl -LSfs http://localhost:19531/machine >"$LOG_FILE" jq . "$LOG_FILE" -- fi # Generate a self-signed certificate for systemd-journal-gatewayd # # Note: older OpenSSL requires a config file with some extra options, unfortunately cat >/tmp/openssl.conf </tmp/syncfifo1 } export SYSTEMD_LOG_LEVEL=debug echo "toplevel PID: $BASHPID" Found error in /usr/lib/systemd/tests/testdata/TEST-80-NOTIFYACCESS.units/reload-timeout.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/TEST-80-NOTIFYACCESS.units/reload-timeout.sh set -o pipefail COUNTER=0 sync_in() { read -r x < /tmp/syncfifo2 test "$x" = "$1" } wait_for_signal() { local notify="${1:?}" -- wait "$p" || : fi } sighup_handler() { echo "hup$(( ++COUNTER ))" >/tmp/syncfifo1 } trap sighup_handler SIGHUP export SYSTEMD_LOG_LEVEL=debug Found error in /usr/lib/systemd/tests/testdata/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-short-lived.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/testdata/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-short-lived.sh #!/usr/bin/env bash # SPDX-License-Identifier: LGPL-2.1-or-later set -ex if [ -f /tmp/TEST-23-UNIT-FILE.counter ] ; then read -r counter < /tmp/TEST-23-UNIT-FILE.counter counter=$((counter + 1)) else counter=0 fi echo "$counter" >/tmp/TEST-23-UNIT-FILE.counter if [ "$counter" -eq 5 ] ; then systemctl kill --kill-whom=main -sUSR1 TEST-23-UNIT-FILE.service fi Found error in /usr/lib/systemd/tests/integration-tests/TEST-80-NOTIFYACCESS/TEST-80-NOTIFYACCESS.units/test.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/integration-tests/TEST-80-NOTIFYACCESS/TEST-80-NOTIFYACCESS.units/test.sh # shellcheck disable=SC2016 set -eux set -o pipefail sync_in() { read -r x < /tmp/syncfifo2 test "$x" = "$1" } sync_out() { echo "$1" >/tmp/syncfifo1 } export SYSTEMD_LOG_LEVEL=debug echo "toplevel PID: $BASHPID" Found error in /usr/lib/systemd/tests/integration-tests/TEST-80-NOTIFYACCESS/TEST-80-NOTIFYACCESS.units/reload-timeout.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/integration-tests/TEST-80-NOTIFYACCESS/TEST-80-NOTIFYACCESS.units/reload-timeout.sh set -o pipefail COUNTER=0 sync_in() { read -r x < /tmp/syncfifo2 test "$x" = "$1" } wait_for_signal() { local notify="${1:?}" -- wait "$p" || : fi } sighup_handler() { echo "hup$(( ++COUNTER ))" >/tmp/syncfifo1 } trap sighup_handler SIGHUP export SYSTEMD_LOG_LEVEL=debug Found error in /usr/lib/systemd/tests/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-short-lived.sh: $ grep -A5 -B5 /tmp/ /usr/lib/systemd/tests/integration-tests/TEST-23-UNIT-FILE/TEST-23-UNIT-FILE.units/TEST-23-UNIT-FILE-short-lived.sh #!/usr/bin/env bash # SPDX-License-Identifier: LGPL-2.1-or-later set -ex if [ -f /tmp/TEST-23-UNIT-FILE.counter ] ; then read -r counter < /tmp/TEST-23-UNIT-FILE.counter counter=$((counter + 1)) else counter=0 fi echo "$counter" >/tmp/TEST-23-UNIT-FILE.counter if [ "$counter" -eq 5 ] ; then systemctl kill --kill-whom=main -sUSR1 TEST-23-UNIT-FILE.service fi |
|
shaba |
systemd-tmpfiles-common-262-alt1.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/systemd-tmpfiles-common-262-alt1.noarch.rpm: Invalid path names: /usr/lib/tmpfiles.d/home.conf /usr/lib/tmpfiles.d/legacy.conf /usr/lib/tmpfiles.d/tmp.conf /usr/lib/tmpfiles.d/var.conf /usr/lib/tmpfiles.d/x11.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
talos-devel-1.13.11-alt1.noarch |
unsafe-tmp-usage-in-scripts |
fail |
The test discovered scripts with errors which may be used by a user for damaging important system files. For example if a script uses in its work a temp file which is created in /tmp directory, then every user can create symlinks with the same name (pattern) in this directory in order to destroy or rewrite some system or another user's files. Scripts _must_ _use_ mktemp/tempfile or must use $TMPDIR. mktemp/tempfile is safest. $TMPDIR is safer than /tmp/ because libpam-tmpdir creates a subdirectory of /tmp that is only accessible by that user, and then sets TMPDIR and other variables to that. Hence, it doesn't matter nearly as much if you create a non-random filename, because nobody but you can access it. Found error in /usr/share/gocode/src/github.com/siderolabs/talos/hack/test/e2e-qemu.sh: $ grep /tmp/ /usr/share/gocode/src/github.com/siderolabs/talos/hack/test/e2e-qemu.sh QEMU_FLAGS+=("--image-cache-path=${TMP}/image-cache") QEMU_FLAGS+=("--image-cache-tls-cert-file=${TMP}/image-cache-tls.crt") QEMU_FLAGS+=("--image-cache-tls-key-file=${TMP}/image-cache-tls.key") ;; http-proxy) "${TALOSCTL}" debug-tool air-gapped 172.20.1.1 > /tmp/airgapped.log 2>&1 & sleep 5 # wait for the air-gapped server to start cat air-gapped-patch.yaml mv air-gapped-patch.yaml "${TMP}/air-gapped-patch.yaml" QEMU_FLAGS+=("--config-patch=@${TMP}/air-gapped-patch.yaml") ;; secure-http-proxy) "${TALOSCTL}" debug-tool air-gapped 172.20.1.1 > /tmp/airgapped-secure.log 2>&1 & sleep 5 # wait for the air-gapped server to start cat air-gapped-patch.yaml mv air-gapped-patch.yaml "${TMP}/air-gapped-patch.yaml" QEMU_FLAGS+=("--config-patch=@${TMP}/air-gapped-patch.yaml") ;; https-reverse-proxy) "${TALOSCTL}" debug-tool air-gapped 172.20.1.1 > /tmp/airgapped-reverse-proxy.log 2>&1 & sleep 5 # wait for the air-gapped server to start cat air-gapped-patch.yaml mv air-gapped-patch.yaml "${TMP}/air-gapped-patch.yaml" QEMU_FLAGS+=("--config-patch=@${TMP}/air-gapped-patch.yaml") jobs -p | xargs -r kill "${TALOSCTL}" cluster destroy \ --name "${CLUSTER_NAME}" \ --provisioner "${PROVISIONER}" \ --save-cluster-logs-archive-path="/tmp/logs-${LOG_ARCHIVE_SUFFIX}.tar.gz" \ --save-support-archive-path="/tmp/support-${LOG_ARCHIVE_SUFFIX}.zip" } trap destroy_cluster SIGINT EXIT create_cluster |
|
shaba |
targetcli-3.0.2-alt1.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
telegraf-1.38.3-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/telegraf-1.38.3-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/telegraf.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shaba |
telegraf-1.38.3-alt1.x86_64 |
subdir-in-var-run |
info |
Found a subdir in /var/run or /var/lock. /var/run and /var/lock may be mounted as temporary filesystems, so the init.d scripts must handle this correctly. This will typically amount to creating any required subdirectories dynamically when the init.d script is run, rather than including them in the package and relying on rpm to create them. |
|
shaba |
traefik-3.7.13-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
transcribe-server-0.0.4-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
trivy-0.75.0-alt1.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
trivy-server-0.75.0-alt1.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
udev-262-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/udev-262-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/static-nodes-permissions.conf sisyphus_check: check-fhs ERROR: FHS violation /ALT/Sisyphus/files/x86_64/RPMS/udev-262-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/50-udev-default.rules /usr/lib/udev/rules.d/60-autosuspend.rules /usr/lib/udev/rules.d/60-block.rules /usr/lib/udev/rules.d/60-cdrom_id.rules /usr/lib/udev/rules.d/60-dmi-id.rules /usr/lib/udev/rules.d/60-drm.rules /usr/lib/udev/rules.d/60-evdev.rules /usr/lib/udev/rules.d/60-fido-id.rules /usr/lib/udev/rules.d/60-gpiochip.rules /usr/lib/udev/rules.d/60-infiniband.rules /usr/lib/udev/rules.d/60-input-id.rules /usr/lib/udev/rules.d/60-persistent-alsa.rules /usr/lib/udev/rules.d/60-persistent-hidraw.rules /usr/lib/udev/rules.d/60-persistent-input.rules /usr/lib/udev/rules.d/60-persistent-media-controller.rules /usr/lib/udev/rules.d/60-persistent-storage-mtd.rules /usr/lib/udev/rules.d/60-persistent-storage-tape.rules /usr/lib/udev/rules.d/60-persistent-storage.rules /usr/lib/udev/rules.d/60-persistent-v4l.rules /usr/lib/udev/rules.d/60-sensor.rules /usr/lib/udev/rules.d/60-serial.rules /usr/lib/udev/rules.d/60-tpm2-id.rules /usr/lib/udev/rules.d/64-btrfs.rules /usr/lib/udev/rules.d/65-integration.rules /usr/lib/udev/rules.d/70-camera.rules /usr/lib/udev/rules.d/70-joystick.rules /usr/lib/udev/rules.d/70-memory.rules /usr/lib/udev/rules.d/70-mouse.rules /usr/lib/udev/rules.d/70-power-switch.rules /usr/lib/udev/rules.d/70-touchpad.rules /usr/lib/udev/rules.d/75-net-description.rules /usr/lib/udev/rules.d/75-probe_mtd.rules /usr/lib/udev/rules.d/78-sound-card.rules /usr/lib/udev/rules.d/80-drivers.rules /usr/lib/udev/rules.d/80-net-setup-link.rules /usr/lib/udev/rules.d/81-net-bridge.rules /usr/lib/udev/rules.d/81-net-dhcp.rules /usr/lib/udev/rules.d/82-net-auto-link-local.rules /usr/lib/udev/rules.d/90-image-dissect.rules /usr/lib/udev/rules.d/90-iocost.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
udev-262-alt1.x86_64 |
sisyphus_check-check-dirlist |
warn |
sisyphus_check --check-dirlist failed: package contains a directory /etc/udev/rules.d that exclusively belongs to package udev-rules |
|
shaba |
udev-rules-sgutils-1.48-alt2.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/udev-rules-sgutils-1.48-alt2.noarch.rpm: invalid udev rules path: /usr/lib/udev/rules.d/00-scsi-sg3_config.rules /usr/lib/udev/rules.d/40-usb-blacklist.rules /usr/lib/udev/rules.d/54-before-scsi-sg3_id.rules /usr/lib/udev/rules.d/55-scsi-sg3_id.rules /usr/lib/udev/rules.d/58-scsi-sg3_symlink.rules /usr/lib/udev/rules.d/59-fc-wwpn-id.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
uki-direct-26.2-alt1.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
urbackup-client-2.5.25-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
urbackup-server-2.5.33-alt1.x86_64 |
arch-dep-package-has-big-usr-share |
info |
The package has a significant amount of architecture-independent data in /usr/share, while it is an architecture-dependent package. This is wasteful of mirror space and bandwidth, as we then end up with multiple copies of this data, one for each architecture. If the data in /usr/share is not architecture-independent, it is a policy violation, and in this case, you should move that data elsewhere. |
|
shaba |
urbackup-server-2.5.33-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
valkey-9.0.5-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
vdsm-4.50.6-alt3.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/vdsm-4.50.6-alt3.noarch.rpm: Invalid path names: /usr/lib/tmpfiles.d/vdsm.conf sisyphus_check: check-fhs ERROR: FHS violation /ALT/Sisyphus/files/noarch/RPMS/vdsm-4.50.6-alt3.noarch.rpm: invalid udev rules path: /usr/lib/udev/rules.d/12-vdsm-lvm.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
vdsm-4.50.6-alt3.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
vdsm-hook-checkips-4.50.6-alt3.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
vdsm-hook-localdisk-4.50.6-alt3.noarch |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/noarch/RPMS/vdsm-hook-localdisk-4.50.6-alt3.noarch.rpm: invalid udev rules path: /usr/lib/udev/rules.d/12-vdsm-localdisk.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
vhostmd-1.1-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
victorialogs-1.47.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
victorialogs-vlagent-1.47.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
victoriametrics-1.142.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
victoriametrics-cluster-vminsert-1.142.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
victoriametrics-cluster-vmselect-1.142.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
victoriametrics-cluster-vmstorage-1.142.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
victoriametrics-vmagent-1.142.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
victoriametrics-vmalert-1.142.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
victoriametrics-vmauth-1.142.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
vitastor-mon-3.2.2-alt1.noarch |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
vitastor-osd-3.2.2-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/vitastor-osd-3.2.2-alt1.x86_64.rpm: license not found in '/usr/share/license' directory: VNPL-1.1 /ALT/Sisyphus/files/x86_64/RPMS/vitastor-osd-3.2.2-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/90-vitastor.rules sisyphus_check: check-udev ERROR: udev rules path violation |
|
shaba |
vitastor-osd-3.2.2-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
vmango-0.12.1-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shaba |
vpnc-0.5.3-alt7.x86_64 |
subdir-in-var-run |
info |
Found a subdir in /var/run or /var/lock. /var/run and /var/lock may be mounted as temporary filesystems, so the init.d scripts must handle this correctly. This will typically amount to creating any required subdirectories dynamically when the init.d script is run, rather than including them in the package and relying on rpm to create them. |
|
shaba |
vsftpd-3.0.5-alt1.src |
specfile-useradd-n |
warn |
-n in useradd is compat option and can be removed any time. Use -N instead. |
|
shaba |
whisper.cpp-1.9.3-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shrek |
polkit-127-alt1.src |
specfile-useradd-n |
warn |
-n in useradd is compat option and can be removed any time. Use -N instead. |
|
shrek |
polkit-127-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/polkit-127-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/polkit-tmpfiles.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shrek |
polkit-127-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shrek |
polkit-127-alt1.x86_64 |
systemd-check-socket-name |
experimental |
in polkit-127-alt1.x86_64: there is a socket polkit-agent-helper.socket but no service polkit-agent-helper.service. Ask ildar@ why it is not right. |
|
shrek |
pve-lxc-syscalld-2.0.2-alt2.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/pve-lxc-syscalld-2.0.2-alt2.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/pve-lxc-syscalld.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
shrek |
pve-lxc-syscalld-2.0.2-alt2.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
shrek |
rtkit-0.13-alt1.x86_64 |
dbus-xml-not-in-devel |
info |
file /usr/share/dbus-1/interfaces/org.freedesktop.RealtimeKit1.xml is not used in run time. Move it to the -devel subpackage. |
|
sin |
libsss_autofs-2.12.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
sin |
libsss_sudo-2.12.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
sin |
sssd-2.12.0-alt1.src |
specfile-useradd-n |
warn |
-n in useradd is compat option and can be removed any time. Use -N instead. |
|
sin |
sssd-2.12.0-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/sssd-2.12.0-alt1.x86_64.rpm: Invalid path names: /usr/lib/tmpfiles.d/sssd.conf sisyphus_check: check-fhs ERROR: FHS violation |
|
sin |
sssd-2.12.0-alt1.x86_64 |
subdir-in-var-run |
info |
Found a subdir in /var/run or /var/lock. /var/run and /var/lock may be mounted as temporary filesystems, so the init.d scripts must handle this correctly. This will typically amount to creating any required subdirectories dynamically when the init.d script is run, rather than including them in the package and relying on rpm to create them. |
|
sin |
sssd-kcm-2.12.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
sin |
sssd-pac-2.12.0-alt1.x86_64 |
systemd-but-no-native-init |
experimental |
The package have native systemd file(s) but no SysV init scripts. |
|
sin |
sssd-passkey-2.12.0-alt1.x86_64 |
sisyphus_check |
fail |
sisyphus_check failed: /ALT/Sisyphus/files/x86_64/RPMS/sssd-passkey-2.12.0-alt1.x86_64.rpm: invalid udev rules path: /usr/lib/udev/rules.d/90-sssd-token-access.rules sisyphus_check: check-udev ERROR: udev rules path violation |