SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test: add coverage for image policy and bare filesystems with verity

Browse Source
This commit is contained in:
Luca Boccassi
2025-10-16 16:22:33 +01:00
parent fad01f798d
commit bc019f7c06
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/units/TEST-50-DISSECT.mountfsd.sh
+14
View File
@@ -77,6 +77,20 @@ if [ "$VERITY_SIG_SUPPORTED" -eq 1 ]; then
--property RootImage="$MINIMAL_IMAGE.raw" \
--property ExtensionImages=/tmp/app0.raw \
sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\""
# Without a signature this should not work, as mountfsd should reject it, even if we explicitly ask to
# trust it
mv /tmp/app0.roothash.p7s /tmp/app0.roothash.p7s.bak
(! systemd-run -M testuser@ --user --pipe --wait \
--property RootImage="$MINIMAL_IMAGE.raw" \
--property ExtensionImages=/tmp/app0.raw \
sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\"")
(! systemd-run -M testuser@ --user --pipe --wait \
--property RootImage="$MINIMAL_IMAGE.raw" \
--property ExtensionImages=/tmp/app0.raw \
--property ExtensionImagePolicy=root=verity+signed+absent:usr=verity+signed+absent \
sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\"")
mv /tmp/app0.roothash.p7s.bak /tmp/app0.roothash.p7s
fi
# Install key in keychain