Allow SupplementaryGroups and DynamicUser

Support `service_entries` for `DynamicUser` and `SupplementaryGroups` * https://www.freedesktop.org/software/systemd/man/systemd.exec.html#DynamicUser= * https://www.freedesktop.org/software/systemd/man/systemd.exec.html#SupplementaryGroups=
voxpupuli · Jul 3, 2023 · 1d59b15 · 1d59b15
1 parent 4b01a51
commit 1d59b15
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 0 deletions.
diff --git a/REFERENCE.md b/REFERENCE.md
@@ -2329,6 +2329,8 @@ Struct[{
     Optional['AmbientCapabilities']       => Variant[Pattern[/^CAP_[A-Z_]+$/],Array[Pattern[/^CAP_[A-Z_]+$/],1]],
     Optional['User']                      => String[1],
     Optional['Group']                     => String[1],
+    Optional['DynamicUser']               => Boolean,
+    Optional['SupplementaryGroups']       => Variant[String[0],Array[String[0],1]],
     Optional['WorkingDirectory']          => String[0],
     Optional['Type']                      => Enum['simple', 'exec', 'forking', 'oneshot', 'dbus', 'notify', 'idle'],
     Optional['ExitType']                  => Enum['main', 'cgroup'],

diff --git a/spec/type_aliases/systemd_unit_service_spec.rb b/spec/type_aliases/systemd_unit_service_spec.rb
@@ -45,6 +45,17 @@
   it { is_expected.to allow_value({ 'StandardOutput' => 'null' }) }
   it { is_expected.to allow_value({ 'StandardError' => 'null' }) }
 
+  it { is_expected.to allow_value({ 'DynamicUser' => false }) }
+  it { is_expected.to allow_value({ 'DynamicUser' => true }) }
+  it { is_expected.not_to allow_value({ 'DynamicUser' => 'maybe' }) }
+
+  it { is_expected.to allow_value({ 'SupplementaryGroups' => 'one' }) }
+  it { is_expected.to allow_value({ 'SupplementaryGroups' => %w[one two] }) }
+  it { is_expected.to allow_value({ 'SupplementaryGroups' => '' }) }
+  it { is_expected.to allow_value({ 'SupplementaryGroups' => [''] }) }
+  it { is_expected.to allow_value({ 'SupplementaryGroups' => ['', 'reset'] }) }
+  it { is_expected.not_to allow_value({ 'SupplementaryGroups' => [] }) }
+
   it { is_expected.to allow_value({ 'WorkingDirectory' => '/var/lib/here' }) }
   it { is_expected.to allow_value({ 'WorkingDirectory' => '-/var/lib/here' }) }
   it { is_expected.to allow_value({ 'WorkingDirectory' => '~' }) }

diff --git a/types/unit/service.pp b/types/unit/service.pp
@@ -7,6 +7,8 @@
     Optional['AmbientCapabilities']       => Variant[Pattern[/^CAP_[A-Z_]+$/],Array[Pattern[/^CAP_[A-Z_]+$/],1]],
     Optional['User']                      => String[1],
     Optional['Group']                     => String[1],
+    Optional['DynamicUser']               => Boolean,
+    Optional['SupplementaryGroups']       => Variant[String[0],Array[String[0],1]],
     Optional['WorkingDirectory']          => String[0],
     Optional['Type']                      => Enum['simple', 'exec', 'forking', 'oneshot', 'dbus', 'notify', 'idle'],
     Optional['ExitType']                  => Enum['main', 'cgroup'],