test: add test to make sure that ProtectKernelModules=yes disconnect mount propagation

diff --git a/Makefile.am b/Makefile.am
index 1ea25bb..4a69236 100644 (file)
--- a/Makefile.am
+++ b/Makefile.am
@@ -1641,6 +1641,7 @@ EXTRA_DIST += \
        test/test-execute/exec-privatedevices-yes-capability-mknod.service \
        test/test-execute/exec-protectkernelmodules-no-capabilities.service \
        test/test-execute/exec-protectkernelmodules-yes-capabilities.service \
+       test/test-execute/exec-protectkernelmodules-yes-mount-propagation.service \
        test/test-execute/exec-privatetmp-no.service \
        test/test-execute/exec-privatetmp-yes.service \
        test/test-execute/exec-readonlypaths.service \

diff --git a/src/test/test-execute.c b/src/test/test-execute.c
index 1eade98..e8ff02a 100644 (file)
--- a/src/test/test-execute.c
+++ b/src/test/test-execute.c
@@ -144,7 +144,7 @@ static void test_exec_privatedevices_capabilities(Manager *m) {
         test(m, "exec-privatedevices-no-capability-sys-rawio.service", 0, CLD_EXITED);
 }
 
-static void test_exec_protectkernelmodules_capabilities(Manager *m) {
+static void test_exec_protectkernelmodules(Manager *m) {
         if (detect_container() > 0) {
                 log_notice("testing in container, skipping protectkernelmodules tests");
                 return;
@@ -152,6 +152,7 @@ static void test_exec_protectkernelmodules_capabilities(Manager *m) {
 
         test(m, "exec-protectkernelmodules-no-capabilities.service", 0, CLD_EXITED);
         test(m, "exec-protectkernelmodules-yes-capabilities.service", 0, CLD_EXITED);
+        test(m, "exec-protectkernelmodules-yes-mount-propagation.service", 0, CLD_EXITED);
 }
 
 static void test_exec_readonlypaths(Manager *m) {
@@ -380,7 +381,7 @@ int main(int argc, char *argv[]) {
                 test_exec_privatetmp,
                 test_exec_privatedevices,
                 test_exec_privatedevices_capabilities,
-                test_exec_protectkernelmodules_capabilities,
+                test_exec_protectkernelmodules,
                 test_exec_readonlypaths,
                 test_exec_readwritepaths,
                 test_exec_inaccessiblepaths,

diff --git a/test/test-execute/exec-protectkernelmodules-yes-mount-propagation.service b/test/test-execute/exec-protectkernelmodules-yes-mount-propagation.service
new file mode 100644 (file)
index 0000000..e438783
--- /dev/null
+++ b/test/test-execute/exec-protectkernelmodules-yes-mount-propagation.service
@@ -0,0 +1,7 @@
+[Unit]
+Description=Test to make sure that passing ProtectKernelModules=yes disconnect mount propagation
+
+[Service]
+ProtectKernelModules=yes
+ExecStart=/bin/sh -x -c 'mkdir -p /TEST; mount -t tmpfs tmpfs /TEST; grep TEST /proc/self/mountinfo && ! grep TEST /proc/$${PPID}/mountinfo && ! grep TEST /proc/1/mountinfo'
+Type=oneshot