Merge lp:~jamesodhunt/ubuntu/oneiric/upstart/fixes-for-user-sessions into lp:ubuntu/oneiric/upstart

[James Hunt]

Quite a bit of change wrt user sessions. If someone could check my fixup for <email address hidden> and <email address hidden>, that'd be great! Thanks.

The details:

  * init/man/init.5: Explain that symbolic links are not supported.
  * init/session.c: session_from_dbus(): Handle case where a users
    home directory is changed or where a uid is re-used for a
    different username.
  * init/session.h: Updated comments for Session object.
  * TESTING.sessions: Updated with information on user sessions.
  * init/job_process.c:
    - job_process_spawn():
      - Change group before user and do it as early as possible.
      - Ensure non-priv user is able to read script fd. Default system
        behaviour is seemingly not consistent/defined, so force it
        to be (LP: #813052)
      - Ensure cwd for user job is home directory by default.
    - job_process_error_read():
      - Added handling for JOB_PROCESS_ERROR_SETUID and
        JOB_PROCESS_ERROR_SETGID (LP: #807293).
      - Added new entry for JOB_PROCESS_ERROR_CHOWN.
  * init/job_process.h:
    - Added entry for JOB_PROCESS_ERROR_CHOWN in JobProcessErrorType.
  * init/man/init.5: Update for user jobs explaining behaviour of stanzas
    which manipulate system resource limits and when the init
    daemon reads the users job directory.
  * util/tests/test_user_sessions.sh: New script for testing user sessions
    (NOTE: this is *NOT* run automatically).

[Michael Vogt (mvo)]

Looks good, I do a testbuild now and install it.

As for the <email address hidden> fixups this looks ok. Usually it should be enough to just
refresh the po files. The .gmo stuff is autogenerated and not part of the bzr tree.

review: Approve

[Sebastien Bacher (seb128)]

setting to merged since that got approved, the ubuntu Vcs seems outdated for some reason, I pointed it to slangasek

=== modified file 'ChangeLog'
--- ChangeLog	2011-07-20 11:28:25 +0000
+++ ChangeLog	2011-07-25 16:29:00 +0000
@@ -1,3 +1,37 @@
[phone]  James Hunt  <[e-mail]>
+
+	* init/job_process.c: job_process_spawn():
+	  - Added dup2() return check.
+	* TESTING.sessions: Updated with information on user sessions.
+	* init/job_process.c:
+	  - job_process_spawn():
+	    - Change group before user and do it as early as possible.
+	    - Ensure non-priv user is able to read script fd. Default system
+	      behaviour is seemingly not consistent/defined, so force it
+	      to be (LP: #813052)
+	    - Ensure cwd for user job is home directory by default.
+	  - job_process_error_read():
+	    - Added handling for JOB_PROCESS_ERROR_SETUID and
+	      JOB_PROCESS_ERROR_SETGID (LP: #807293).
+	    - Added new entry for JOB_PROCESS_ERROR_CHOWN.
+	* init/job_process.h:
+	  - Added entry for JOB_PROCESS_ERROR_CHOWN in JobProcessErrorType.
+	* init/man/init.5: Update for user jobs explaining behaviour of stanzas
+	  which manipulate system resource limits and when the init
+	  daemon reads the users job directory.
+	* util/tests/test_user_sessions.sh: New script for testing user sessions
+	  (NOTE: this is *NOT* run automatically).
+	* init/session.c: session_from_dbus(): Handle case where a users
+	  home directory is changed or where a uid is re-used for a
+	  different username.
+	* init/session.h: Updated comments for Session object.
+	* init/man/init.5: Explain that symbolic links are not supported.
+
[phone]  James Hunt  <[e-mail]>
+
+	* util/man/initctl.8: Clarify semantics of restart(8)
+	  command (LP: #731225).
+
 2011-07-20  James Hunt  <[e-mail]>
 
 	* util/tests/test_initctl.c:

=== modified file 'TESTING.sessions'
--- TESTING.sessions	2011-06-14 14:16:04 +0000
+++ TESTING.sessions	2011-07-25 16:29:00 +0000
@@ -4,25 +4,51 @@
 Testing Sessions with Upstart
 =============================
 
-Upstart now has support for chroots which are implemented by creating a
-separate session for every user within each chroot. It also has partial
-support for user sessions, but since this is experimental (and disabled
-in Ubuntu), this document does not cover testing this feature.
+Upstart now has support for two types of "sessions":
+
+* user sessions
+
+* chroots sessions
+
+Such sessions are implemented by asociating a separate Upstart session
+with every chroot environment and every non-privileged user.
 
 The session support does not yet provide full tests (as would be run by
-"``make check``"). This is partly due to the complexity of automatically
+"``make check``"). This is mostly due to the complexity of automatically
 testing some of the scenarios below.
 
 This document attempts to outline the minimum set of tests that should
-be performed to ensure that chroot support works as expected.
+be performed to ensure that session support works as expected.
 
 Assumptions
 ===========
 
 You are running an Ubuntu or Debian system.
 
+User Sessions
+=============
+
+User sessions can be minimally tested using the script provided::
+
+  util/tests/test_user_sessions.sh
+
+Notes:
+
+- Run "``test_user_sessions.sh -h``" to understand what this script does.
+
+- that this script needs to be run on a system where the version of
+  ``/sbin/init`` has session support since the ``/sbin/init`` binary
+  itself will be tested. For this reason, the script cannot be run as part
+  of the "``make check``" run.
+
+- The script will complain loudly if any of the tests fail and tell you
+  how to raise a bug.
+
+Chroot Sessions
+===============
+
 Setup
-=====
+-----
 
 #. Install a chroot environement (such as ``schroot(1)``) and configure it.
 #. run, "``debootstrap(8)``" to install the same release as you are running into your chroot.
@@ -80,7 +106,7 @@
 
    
 Run as non-``root`` with no chroot
-==================================
+----------------------------------
 
 - ``initctl list``
 
@@ -118,7 +144,7 @@
   Should fail ("``initctl: Rejected send message``").
 
 Run as ``root`` with no chroot
-==============================
+------------------------------
 
 - ``initctl list``
 
@@ -183,7 +209,7 @@
   - Ensure ``/path/to/chroot/etc/init/in_chroot.conf`` does *NOT* run.
 
 Run as ``root`` inside a chroot
-===============================
+-------------------------------
 
 - ``initctl list``
 
@@ -247,12 +273,12 @@
   - Ensure ``/etc/init/outside_chroot.conf`` does *NOT* run.
 
 Run as non-root inside a chroot
-===============================
+-------------------------------
 
 Not supported.
 
 Run with ``--no-sessions``
-==========================
+--------------------------
 
 The "``--no-sessions``" option makes Upstart behave as it used to prior to
 the introduction of session support.

=== modified file 'debian/changelog'
--- debian/changelog	2011-07-20 13:52:23 +0000
+++ debian/changelog	2011-07-25 16:29:00 +0000
@@ -1,3 +1,10 @@
+upstart (1.3-0ubuntu5) oneiric; urgency=low
+
+  * Upstream cherry-pick for user session fixes
+    ("bzr merge -r 1318..1324 lp:upstart").
+
+ -- James Hunt <[e-mail]>  Mon, 25 Jul 2011 17:09:47 +0100
+
 upstart (1.3-0ubuntu4) oneiric; urgency=low
 
   * init/main.c: main(): Add support for "/run" directory with fallback to

=== modified file 'init/job_process.c'
--- init/job_process.c	2011-06-16 14:39:55 +0000
+++ init/job_process.c	2011-07-25 16:29:00 +0000
@@ -373,14 +373,20 @@
 		   int           trace,
 		   int           script_fd)
 {
-	sigset_t  child_set, orig_set;
-	pid_t     pid;
-	int       i, fds[2];
-	char      filename[PATH_MAX];
-	FILE     *fd;
+	sigset_t        child_set, orig_set;
+	pid_t           pid;
+	int             i, fds[2];
+	char            filename[PATH_MAX];
+	FILE           *fd;
+	int             user_job = FALSE;
+	nih_local char *user_dir = NULL;
+
 
 	nih_assert (class != NULL);
 
+	if (class && class->session && class->session->user)
+		user_job = TRUE;
+
 	/* Create a pipe to communicate with the child process until it
 	 * execs so we know whether that was successful or an error occurred.
 	 */
@@ -440,6 +446,8 @@
 	if (fds[1] == JOB_PROCESS_SCRIPT_FD) {
 		int tmp = dup2 (fds[1], fds[0]);
 		close (fds[1]);
+		if (tmp < 0)
+			nih_return_system_error (-1);
 		fds[1] = tmp;
 	}
 	nih_io_set_cloexec (fds[1]);
@@ -460,6 +468,84 @@
 	 */
 	setsid ();
 
+	/* Set the process environment from the function paramters. */
+	environ = (char **)env;
+
+	/* Handle unprivileged user job by dropping privileges to
+	 * their level as soon as possible to avoid privilege
+	 * escalations when we set resource limits.
+	 */
+	if (user_job) {
+		uid_t uid = class->session->user;
+		struct passwd *pw = NULL;
+
+		/* D-Bus does not expose a public API call to allow
+		 * us to query a users primary group.
+		 * _dbus_user_info_fill_uid () seems to exist for this
+		 * purpose, but is a "secret" API. It is unclear why
+		 * D-Bus neglects the gid when it allows the uid
+		 * to be queried directly.
+		 *
+		 * Our only recourse is to disallow user sessions in a
+		 * chroot and assume that all other user sessions
+		 * originate from the local system. In this way, we can
+		 * bypass D-Bus and use getpwuid ().
+		 */
+
+		if (class->session->chroot) {
+			/* We cannot determine the group id of the user
+			 * session in the chroot via D-Bus, so disallow
+			 * all jobs in such an environment.
+			 */
+			nih_return_error (-1, EPERM, "user jobs not supported in chroots");
+		}
+
+		pw = getpwuid (uid);
+
+		if (!pw)
+			nih_return_system_error (-1);
+
+		nih_assert (pw->pw_uid == uid);
+
+		if (! pw->pw_dir) {
+			nih_local char *message = NIH_MUST (nih_sprintf (NULL,
+						"no home directory for user with uid %d",
+						uid));
+
+			nih_return_error (-1, ENOENT, message);
+
+		}
+
+		/* Note we don't use NIH_MUST since this could result in a
+		 * DOS for a (low priority) user job in low-memory scenarios.
+		 */
+		user_dir = nih_strdup (NULL, pw->pw_dir);
+
+		if (!user_dir)
+			nih_return_no_memory_error (-1);
+
+		/* Ensure the file associated with fd 9
+		 * (/proc/self/fd/9) is owned by the user we're about to
+		 * become to avoid EPERM.
+		 */
+		if (script_fd != -1 && fchown (script_fd, pw->pw_uid, pw->pw_gid) < 0) {
+			nih_error_raise_system ();
+			job_process_error_abort (fds[1], JOB_PROCESS_ERROR_CHOWN, 0);
+		}
+
+		if (pw->pw_gid && setgid (pw->pw_gid) < 0) {
+			nih_error_raise_system ();
+			job_process_error_abort (fds[1], JOB_PROCESS_ERROR_SETGID, 0);
+		}
+
+		if (pw->pw_uid && setuid (pw->pw_uid) < 0) {
+			nih_error_raise_system ();
+			job_process_error_abort (fds[1], JOB_PROCESS_ERROR_SETUID, 0);
+		}
+
+
+	}
+
 	/* Set the standard file descriptors to an output of our chosing;
 	 * any other open descriptor must be intended for the child, or have
 	 * the FD_CLOEXEC flag so it's automatically closed when we exec()
@@ -480,6 +566,7 @@
 			job_process_error_abort (fds[1], JOB_PROCESS_ERROR_CONSOLE, 0);
 	}
 
+
 	/* Set resource limits for the process, skipping over any that
 	 * aren't set in the job class such that they inherit from
 	 * ourselves (and we inherit from kernel defaults).
@@ -495,9 +582,6 @@
 		}
 	}
 
-	/* Set the process environment from the function paramters. */
-	environ = (char **)env;
-
 	/* Set the file mode creation mask; this is one of the few operations
 	 * that can never fail.
 	 */
@@ -565,12 +649,11 @@
 	 * configured in the job, or to the root directory of the filesystem
 	 * (or at least relative to the chroot).
 	 */
-	if (chdir (class->chdir ? class->chdir : "/") < 0) {
+	if (chdir (class->chdir ? class->chdir : user_job ? user_dir : "/") < 0) {
 		nih_error_raise_system ();
 		job_process_error_abort (fds[1], JOB_PROCESS_ERROR_CHDIR, 0);
 	}
 
-
 	/* Reset all the signal handlers back to their default handling so
 	 * the child isn't unexpectedly ignoring any, and so we won't
 	 * surprisingly handle them before we've exec()d the new process.
@@ -604,54 +687,6 @@
 		}
 	}
 
-	/* Handle unprivileged user job by dropping privileges to
-	 * their level.
-	 */
-	if (class->session && class->session->user) {
-		uid_t uid = class->session->user;
-		struct passwd *pw = NULL;
-
-		/* D-Bus does not expose a public API call to allow
-		 * us to query a users primary group.
-		 * _dbus_user_info_fill_uid () seems to exist for this
-		 * purpose, but is a "secret" API. It is unclear why
-		 * D-Bus neglects the gid when it allows the uid
-		 * to be queried directly.
-		 *
-		 * Our only recourse is to disallow user sessions in a
-		 * chroot and assume that all other user sessions
-		 * originate from the local system. In this way, we can
-		 * bypass D-Bus and use getpwuid ().
-		 */
-
-		if (class->session->chroot) {
-			/* We cannot determine the group id of the user
-			 * session in the chroot via D-Bus, so disallow
-			 * all jobs in such an environment.
-			 */
-			_nih_error_raise (__FILE__, __LINE__, __FUNCTION__,
-					EPERM, strerror (EPERM));
-		}
-
-		pw = getpwuid (uid);
-
-		if (!pw)
-			nih_return_system_error (-1);
-
-		nih_assert (pw->pw_uid == uid);
-
-		if (uid && setuid (uid) < 0) {
-			nih_error_raise_system ();
-			job_process_error_abort (fds[1], JOB_PROCESS_ERROR_SETUID, 0);
-		}
-
-		if (pw->pw_gid && setgid (pw->pw_gid) < 0) {
-			nih_error_raise_system ();
-			job_process_error_abort (fds[1], JOB_PROCESS_ERROR_SETGID, 0);
-		}
-	}
-
-
 	/* Execute the process, if we escape from here it failed */
 	if (execvp (argv[0], argv) < 0) {
 		nih_error_raise_system ();
@@ -845,6 +880,21 @@
 				  err, _("unable to execute: %s"),
 				  strerror (err->errnum)));
 		break;
+	case JOB_PROCESS_ERROR_SETUID:
+		err->error.message = NIH_MUST (nih_sprintf (
+				  err, _("unable to setuid: %s"),
+				  strerror (err->errnum)));
+		break;
+	case JOB_PROCESS_ERROR_SETGID:
+		err->error.message = NIH_MUST (nih_sprintf (
+				  err, _("unable to setgid: %s"),
+				  strerror (err->errnum)));
+		break;
+	case JOB_PROCESS_ERROR_CHOWN:
+		err->error.message = NIH_MUST (nih_sprintf (
+				  err, _("unable to chown: %s"),
+				  strerror (err->errnum)));
+		break;
 	default:
 		nih_assert_not_reached ();
 	}

=== modified file 'init/job_process.h'
--- init/job_process.h	2011-06-16 14:39:55 +0000
+++ init/job_process.h	2011-07-25 16:29:00 +0000
@@ -59,6 +59,7 @@
 	JOB_PROCESS_ERROR_EXEC,
 	JOB_PROCESS_ERROR_SETUID,
 	JOB_PROCESS_ERROR_SETGID,
+	JOB_PROCESS_ERROR_CHOWN
 } JobProcessErrorType;
 
 /**

=== modified file 'init/man/init.5'
--- init/man/init.5	2011-06-16 14:39:55 +0000
+++ init/man/init.5	2011-07-25 16:29:00 +0000
@@ -77,8 +77,12 @@
 A User Job is a job configuration file created by a non\-privileged user
 in their
 .B $HOME/.init/
-directory. Job configuration files in this directory have
-the same syntax as system job configuration files.
+directory. Job configuration files in this directory have the same
+syntax as system job configuration files.
+Files in this directory will be read and an
+.BR inotify (7)
+watch created the first time a user runs 
+.BR initctl (8) "."
 
 Any user can create user jobs, but that user can control
 .I only
@@ -88,6 +92,10 @@
 .BR initctl (8)
 facility.
 
+Note that stanzas which manipulate resources limits may cause a job to
+fail to start should the value provided to such a stanza attempt to
+exceed the maximum value the users privilege level allows.
+
 Note that a user job configuration file cannot have the same name as a
 system job configuration file.
 .\"
@@ -749,6 +757,12 @@
 is unable to supervise forking processes and will believe them to have
 stopped as soon as they fork on startup.
 .\"
+.SH RESTRICTIONS
+The use of symbolic links in job configuration file directories is not
+supported since it can lead to unpredicable behaviour resulting from
+broken or inaccessible links (such as would be caused by a link crossing
+a filesystem boundary to a filesystem that has not yet been mounted).
+.\"
 .SH BUGS
 The 
 .B and

=== modified file 'init/session.c'
--- init/session.c	2011-06-16 14:39:55 +0000
+++ init/session.c	2011-07-25 16:29:00 +0000
@@ -124,12 +124,14 @@
 session_from_dbus (const void     *parent,
 		   NihDBusMessage *message)
 {
-	const char   *sender;
-	DBusError     dbus_error;
-	unsigned long unix_user;
-	unsigned long unix_process_id;
-	char          root[PATH_MAX];
-	Session      *session;
+	const char     *sender;
+	DBusError       dbus_error;
+	unsigned long   unix_user;
+	unsigned long   unix_process_id;
+	char            root[PATH_MAX];
+	Session        *session;
+	struct passwd  *pwd;
+	nih_local char *conf_path = NULL;
 
 	nih_assert (message != NULL);
 
@@ -192,11 +194,25 @@
 	} else if (! unix_user) {
 		/* No process id or user id found, return the NULL session */
 		return NULL;
-
-	}
+	}
+
+	if (unix_user) {
+		pwd = getpwuid (unix_user);
+
+		if (! pwd || ! pwd->pw_dir) {
+			nih_error ("%lu: %s: %s", unix_user,
+				   _("Unable to lookup home directory"),
+				   strerror (errno));
+			return NULL;
+		}
+
+		NIH_MUST (nih_strcat_sprintf (&conf_path, NULL, "%s/%s",
+					pwd->pw_dir, USERCONFDIR));
+	}
+
 
 	/* Now find in the existing Sessions list */
-	NIH_LIST_FOREACH (sessions, iter) {
+	NIH_LIST_FOREACH_SAFE (sessions, iter) {
 		Session *session = (Session *)iter;
 
 		if (unix_process_id) {
@@ -212,6 +228,31 @@
 		if (unix_user != session->user)
 			continue;
 
+		/* Found a user with the same uid but different
+		 * conf_dir to the existing session user. Either the
+		 * original user has been deleted and a new user created
+		 * with the same uid, or the original users home
+		 * directory has changed since they first started
+		 * running jobs. Whatever the reason, we (can only) honour
+		 * the new value.
+		 *
+		 * Since multiple users with the same uid are considered
+		 * to be "the same user", invalidate the old path,
+		 * allowing the correct new path to be set below.
+		 *
+		 * Note that there may be a possibility of trouble if
+		 * the scenario relates to a deleted user and that original
+		 * user still has jobs running. However, if that were the
+		 * case, those jobs would likely fail anyway since they
+		 * would have no working directory due to the original
+		 * users home directory being deleted/changed/made inaccessible.
+		 */
+		if (unix_user && conf_path && session->conf_path &&
+				strcmp (conf_path, session->conf_path)) {
+			nih_free (session->conf_path);
+			session->conf_path = NULL;
+		}
+
 		if (! session->conf_path)
 			session_create_conf_source (session);
 

=== modified file 'init/session.h'
--- init/session.h	2011-06-16 14:39:55 +0000
+++ init/session.h	2011-07-25 16:29:00 +0000
@@ -33,23 +33,25 @@
  * @entry: list header,
  * @chroot: path all jobs are chrooted to,
  * @user: uid all jobs are switched to,
- * @conf_path: configuration path.
+ * @conf_path: configuration path (either full path to chroot root, or
+ * full path to users job directory (which may itself be prepended
+ * with a chroot path)).
  *
  * This structure is used to identify collections of jobs
  * that share either a common @chroot and/or common @user.
  *
  * Summary of Session values for different environments:
  *
- * +-------------+---------------------------------------+
- * |    D-Bus    |             Session                   |
- * +------+------+--------+-----+------------------------+
- * | user | PID  | chroot | uid | Object contents        |
- * +------+------+--------+-----+------------------------+
- * | 0    | >0   | no     | 0   | NULL (*1)              |
- * | >0   | "0"  | no     | >0  | only uid set.          |
- * | 0    | >0   | yes    | 0   | chroot + conf_path set |
- * | >0   | ??   | yes    | >0  | XXX: fails (*2)        |
- * +------+------+--------+-----+------------------------+
+ * +-------------+--------------------------------------------------+
+ * |    D-Bus    |             Session                              |
+ * +------+------+--------+-----+-----------------------------------+
+ * | user | PID  | chroot | uid | Object contents                   |
+ * +------+------+--------+-----+-----------------------------------+
+ * | 0    | >0   | no     | 0   | NULL (*1)                         |
+ * | >0   | "0"  | no     | >0  | uid + conf_path set to "~/.init". |
+ * | 0    | >0   | yes    | 0   | chroot + conf_path set            |
+ * | >0   | ??   | yes    | >0  | XXX: fails (*2)                   |
+ * +------+------+--------+-----+-----------------------------------+
  *
  * Notes:
  *

=== modified file 'po/[e-mail]'
--- po/[e-mail]	2011-06-16 14:39:55 +0000
+++ po/[e-mail]	2011-07-25 16:29:00 +0000
@@ -32,7 +32,7 @@
 msgstr ""
 "Project-Id-Version: upstart 1.3\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2011-06-16 15:04+0100\n"
+"POT-Creation-Date: 2011-07-25 17:06+0100\n"
 "PO-Revision-Date: 2011-06-16 15:04+0100\n"
 "Last-Translator: Automatically generated\n"
 "Language-Team: none\n"
@@ -88,7 +88,7 @@
 msgid "Disconnected from system bus"
 msgstr "Disconnected from system bus"
 
-#: init/control.c:370 init/main.c:744
+#: init/control.c:370 init/main.c:754
 msgid "Reloading configuration"
 msgstr "Reloading configuration"
 
@@ -298,152 +298,167 @@
 msgid "%s %s process (%d)"
 msgstr "%s %s process (%d)"
 
-#: init/job_process.c:403
+#: init/job_process.c:409
 #, c-format
 msgid "Pausing %s (%d) [pre-exec] for debug"
 msgstr "Pausing %s (%d) [pre-exec] for debug"
 
-#: init/job_process.c:473
+#: init/job_process.c:559
 #, c-format
 msgid "Failed to open system console: %s"
 msgstr "Failed to open system console: %s"
 
-#: init/job_process.c:755
+#: init/job_process.c:790
 #, c-format
 msgid "unable to move script fd: %s"
 msgstr "unable to move script fd: %s"
 
-#: init/job_process.c:760
+#: init/job_process.c:795
 #, c-format
 msgid "unable to open console: %s"
 msgstr "unable to open console: %s"
 
-#: init/job_process.c:815
+#: init/job_process.c:850
 #, c-format
 msgid "unable to set \"%s\" resource limit: %s"
 msgstr "unable to set “%s” resource limit: %s"
 
-#: init/job_process.c:820
+#: init/job_process.c:855
 #, c-format
 msgid "unable to set priority: %s"
 msgstr "unable to set priority: %s"
 
-#: init/job_process.c:825
+#: init/job_process.c:860
 #, c-format
 msgid "unable to set oom adjustment: %s"
 msgstr "unable to set oom adjustment: %s"
 
-#: init/job_process.c:830
+#: init/job_process.c:865
 #, c-format
 msgid "unable to change root directory: %s"
 msgstr "unable to change root directory: %s"
 
-#: init/job_process.c:835
+#: init/job_process.c:870
 #, c-format
 msgid "unable to change working directory: %s"
 msgstr "unable to change working directory: %s"
 
-#: init/job_process.c:840
+#: init/job_process.c:875
 #, c-format
 msgid "unable to set trace: %s"
 msgstr "unable to set trace: %s"
 
-#: init/job_process.c:845
+#: init/job_process.c:880
 #, c-format
 msgid "unable to execute: %s"
 msgstr "unable to execute: %s"
 
-#: init/job_process.c:876 init/job_process.c:926
+#: init/job_process.c:885
+#, fuzzy, c-format
+msgid "unable to setuid: %s"
+msgstr "unable to set trace: %s"
+
+#: init/job_process.c:890
+#, fuzzy, c-format
+msgid "unable to setgid: %s"
+msgstr "unable to set trace: %s"
+
+#: init/job_process.c:895
+#, fuzzy, c-format
+msgid "unable to chown: %s"
+msgstr "unable to open console: %s"
+
+#: init/job_process.c:926 init/job_process.c:976
 #, c-format
 msgid "Sending %s signal to %s %s process (%d)"
 msgstr "Sending %s signal to %s %s process (%d)"
 
-#: init/job_process.c:885 init/job_process.c:935
+#: init/job_process.c:935 init/job_process.c:985
 #, c-format
 msgid "Failed to send %s signal to %s %s process (%d): %s"
 msgstr "Failed to send %s signal to %s %s process (%d): %s"
 
-#: init/job_process.c:996
+#: init/job_process.c:1046
 #, c-format
 msgid "%s %s process (%d) terminated with status %d"
 msgstr "%s %s process (%d) terminated with status %d"
 
-#: init/job_process.c:1001
+#: init/job_process.c:1051
 #, c-format
 msgid "%s %s process (%d) exited normally"
 msgstr "%s %s process (%d) exited normally"
 
-#: init/job_process.c:1016
+#: init/job_process.c:1066
 #, c-format
 msgid "%s %s process (%d) killed by %s signal"
 msgstr "%s %s process (%d) killed by %s signal"
 
-#: init/job_process.c:1020
+#: init/job_process.c:1070
 #, c-format
 msgid "%s %s process (%d) killed by signal %d"
 msgstr "%s %s process (%d) killed by signal %d"
 
-#: init/job_process.c:1034
+#: init/job_process.c:1084
 #, c-format
 msgid "%s %s process (%d) stopped by %s signal"
 msgstr "%s %s process (%d) stopped by %s signal"
 
-#: init/job_process.c:1038
+#: init/job_process.c:1088
 #, c-format
 msgid "%s %s process (%d) stopped by signal %d"
 msgstr "%s %s process (%d) stopped by signal %d"
 
-#: init/job_process.c:1052
+#: init/job_process.c:1102
 #, c-format
 msgid "%s %s process (%d) continued by %s signal"
 msgstr "%s %s process (%d) continued by %s signal"
 
-#: init/job_process.c:1056
+#: init/job_process.c:1106
 #, c-format
 msgid "%s %s process (%d) continued by signal %d"
 msgstr "%s %s process (%d) continued by signal %d"
 
-#: init/job_process.c:1191
+#: init/job_process.c:1241
 #, c-format
 msgid "%s respawning too fast, stopped"
 msgstr "%s respawning too fast, stopped"
 
-#: init/job_process.c:1197
+#: init/job_process.c:1247
 #, c-format
 msgid "%s %s process ended, respawning"
 msgstr "%s %s process ended, respawning"
 
-#: init/job_process.c:1437
+#: init/job_process.c:1487
 #, c-format
 msgid "Failed to set ptrace options for %s %s process (%d): %s"
 msgstr "Failed to set ptrace options for %s %s process (%d): %s"
 
-#: init/job_process.c:1450 init/job_process.c:1645
+#: init/job_process.c:1500 init/job_process.c:1695
 #, c-format
 msgid "Failed to continue traced %s %s process (%d): %s"
 msgstr "Failed to continue traced %s %s process (%d): %s"
 
-#: init/job_process.c:1490 init/job_process.c:1581 init/job_process.c:1636
+#: init/job_process.c:1540 init/job_process.c:1631 init/job_process.c:1686
 #, c-format
 msgid "Failed to detach traced %s %s process (%d): %s"
 msgstr "Failed to detach traced %s %s process (%d): %s"
 
-#: init/job_process.c:1530
+#: init/job_process.c:1580
 #, c-format
 msgid "Failed to deliver signal to traced %s %s process (%d): %s"
 msgstr "Failed to deliver signal to traced %s %s process (%d): %s"
 
-#: init/job_process.c:1565
+#: init/job_process.c:1615
 #, c-format
 msgid "Failed to obtain child process id for %s %s process (%d): %s"
 msgstr "Failed to obtain child process id for %s %s process (%d): %s"
 
-#: init/job_process.c:1572
+#: init/job_process.c:1622
 #, c-format
 msgid "%s %s process (%d) became new process (%d)"
 msgstr "%s %s process (%d) became new process (%d)"
 
-#: init/job_process.c:1631
+#: init/job_process.c:1681
 #, c-format
 msgid "%s %s process (%d) executable changed"
 msgstr "%s %s process (%d) executable changed"
@@ -490,7 +505,7 @@
 msgid "Not being executed as init"
 msgstr "Not being executed as init"
 
-#: init/main.c:238 init/main.c:601
+#: init/main.c:238 init/main.c:611
 msgid "Unable to set root directory"
 msgstr "Unable to set root directory"
 
@@ -506,31 +521,31 @@
 msgid "Unable to listen for private connections"
 msgstr "Unable to listen for private connections"
 
-#: init/main.c:618
+#: init/main.c:628
 #, c-format
 msgid "Caught %s, core dumped"
 msgstr "Caught %s, core dumped"
 
-#: init/main.c:622
+#: init/main.c:632
 #, c-format
 msgid "Caught %s, unable to dump core"
 msgstr "Caught %s, unable to dump core"
 
-#: init/main.c:651
+#: init/main.c:661
 #, c-format
 msgid "Re-executing %s"
 msgstr "Re-executing %s"
 
-#: init/main.c:676
+#: init/main.c:686
 #, c-format
 msgid "Failed to re-execute %s: %s"
 msgstr "Failed to re-execute %s: %s"
 
-#: init/main.c:761
+#: init/main.c:771
 msgid "Reconnecting to system bus"
 msgstr "Reconnecting to system bus"
 
-#: init/main.c:767
+#: init/main.c:777
 msgid "Unable to connect to the system bus"
 msgstr "Unable to connect to the system bus"
 

=== modified file 'po/[e-mail]'
--- po/[e-mail]	2011-06-16 14:39:55 +0000
+++ po/[e-mail]	2011-07-25 16:29:00 +0000
@@ -29,7 +29,7 @@
 msgstr ""
 "Project-Id-Version: upstart 1.3\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2011-06-16 15:04+0100\n"
+"POT-Creation-Date: 2011-07-25 17:06+0100\n"
 "PO-Revision-Date: 2011-06-16 15:04+0100\n"
 "Last-Translator: Automatically generated\n"
 "Language-Team: none\n"
@@ -85,7 +85,7 @@
 msgid "Disconnected from system bus"
 msgstr "Disconnected from system bus"
 
-#: init/control.c:370 init/main.c:744
+#: init/control.c:370 init/main.c:754
 msgid "Reloading configuration"
 msgstr "Reloading configuration"
 
@@ -295,152 +295,167 @@
 msgid "%s %s process (%d)"
 msgstr "%s %s process (%d)"
 
-#: init/job_process.c:403
+#: init/job_process.c:409
 #, c-format
 msgid "Pausing %s (%d) [pre-exec] for debug"
 msgstr "Pausing %s (%d) [pre-exec] for debug"
 
-#: init/job_process.c:473
+#: init/job_process.c:559
 #, c-format
 msgid "Failed to open system console: %s"
 msgstr "Failed to open system console: %s"
 
-#: init/job_process.c:755
+#: init/job_process.c:790
 #, c-format
 msgid "unable to move script fd: %s"
 msgstr "unable to move script fd: %s"
 
-#: init/job_process.c:760
+#: init/job_process.c:795
 #, c-format
 msgid "unable to open console: %s"
 msgstr "unable to open console: %s"
 
-#: init/job_process.c:815
+#: init/job_process.c:850
 #, c-format
 msgid "unable to set \"%s\" resource limit: %s"
 msgstr "unable to set “%s” resource limit: %s"
 
-#: init/job_process.c:820
+#: init/job_process.c:855
 #, c-format
 msgid "unable to set priority: %s"
 msgstr "unable to set priority: %s"
 
-#: init/job_process.c:825
+#: init/job_process.c:860
 #, c-format
 msgid "unable to set oom adjustment: %s"
 msgstr "unable to set oom adjustment: %s"
 
-#: init/job_process.c:830
+#: init/job_process.c:865
 #, c-format
 msgid "unable to change root directory: %s"
 msgstr "unable to change root directory: %s"
 
-#: init/job_process.c:835
+#: init/job_process.c:870
 #, c-format
 msgid "unable to change working directory: %s"
 msgstr "unable to change working directory: %s"
 
-#: init/job_process.c:840
+#: init/job_process.c:875
 #, c-format
 msgid "unable to set trace: %s"
 msgstr "unable to set trace: %s"
 
-#: init/job_process.c:845
+#: init/job_process.c:880
 #, c-format
 msgid "unable to execute: %s"
 msgstr "unable to execute: %s"
 
-#: init/job_process.c:876 init/job_process.c:926
+#: init/job_process.c:885
+#, fuzzy, c-format
+msgid "unable to setuid: %s"
+msgstr "unable to set trace: %s"
+
+#: init/job_process.c:890
+#, fuzzy, c-format
+msgid "unable to setgid: %s"
+msgstr "unable to set trace: %s"
+
+#: init/job_process.c:895
+#, fuzzy, c-format
+msgid "unable to chown: %s"
+msgstr "unable to open console: %s"
+
+#: init/job_process.c:926 init/job_process.c:976
 #, c-format
 msgid "Sending %s signal to %s %s process (%d)"
 msgstr "Sending %s signal to %s %s process (%d)"
 
-#: init/job_process.c:885 init/job_process.c:935
+#: init/job_process.c:935 init/job_process.c:985
 #, c-format
 msgid "Failed to send %s signal to %s %s process (%d): %s"
 msgstr "Failed to send %s signal to %s %s process (%d): %s"
 
-#: init/job_process.c:996
+#: init/job_process.c:1046
 #, c-format
 msgid "%s %s process (%d) terminated with status %d"
 msgstr "%s %s process (%d) terminated with status %d"
 
-#: init/job_process.c:1001
+#: init/job_process.c:1051
 #, c-format
 msgid "%s %s process (%d) exited normally"
 msgstr "%s %s process (%d) exited normally"
 
-#: init/job_process.c:1016
+#: init/job_process.c:1066
 #, c-format
 msgid "%s %s process (%d) killed by %s signal"
 msgstr "%s %s process (%d) killed by %s signal"
 
-#: init/job_process.c:1020
+#: init/job_process.c:1070
 #, c-format
 msgid "%s %s process (%d) killed by signal %d"
 msgstr "%s %s process (%d) killed by signal %d"
 
-#: init/job_process.c:1034
+#: init/job_process.c:1084
 #, c-format
 msgid "%s %s process (%d) stopped by %s signal"
 msgstr "%s %s process (%d) stopped by %s signal"
 
-#: init/job_process.c:1038
+#: init/job_process.c:1088
 #, c-format
 msgid "%s %s process (%d) stopped by signal %d"
 msgstr "%s %s process (%d) stopped by signal %d"
 
-#: init/job_process.c:1052
+#: init/job_process.c:1102
 #, c-format
 msgid "%s %s process (%d) continued by %s signal"
 msgstr "%s %s process (%d) continued by %s signal"
 
-#: init/job_process.c:1056
+#: init/job_process.c:1106
 #, c-format
 msgid "%s %s process (%d) continued by signal %d"
 msgstr "%s %s process (%d) continued by signal %d"
 
-#: init/job_process.c:1191
+#: init/job_process.c:1241
 #, c-format
 msgid "%s respawning too fast, stopped"
 msgstr "%s respawning too fast, stopped"
 
-#: init/job_process.c:1197
+#: init/job_process.c:1247
 #, c-format
 msgid "%s %s process ended, respawning"
 msgstr "%s %s process ended, respawning"
 
-#: init/job_process.c:1437
+#: init/job_process.c:1487
 #, c-format
 msgid "Failed to set ptrace options for %s %s process (%d): %s"
 msgstr "Failed to set ptrace options for %s %s process (%d): %s"
 
-#: init/job_process.c:1450 init/job_process.c:1645
+#: init/job_process.c:1500 init/job_process.c:1695
 #, c-format
 msgid "Failed to continue traced %s %s process (%d): %s"
 msgstr "Failed to continue traced %s %s process (%d): %s"
 
-#: init/job_process.c:1490 init/job_process.c:1581 init/job_process.c:1636
+#: init/job_process.c:1540 init/job_process.c:1631 init/job_process.c:1686
 #, c-format
 msgid "Failed to detach traced %s %s process (%d): %s"
 msgstr "Failed to detach traced %s %s process (%d): %s"
 
-#: init/job_process.c:1530
+#: init/job_process.c:1580
 #, c-format
 msgid "Failed to deliver signal to traced %s %s process (%d): %s"
 msgstr "Failed to deliver signal to traced %s %s process (%d): %s"
 
-#: init/job_process.c:1565
+#: init/job_process.c:1615
 #, c-format
 msgid "Failed to obtain child process id for %s %s process (%d): %s"
 msgstr "Failed to obtain child process id for %s %s process (%d): %s"
 
-#: init/job_process.c:1572
+#: init/job_process.c:1622
 #, c-format
 msgid "%s %s process (%d) became new process (%d)"
 msgstr "%s %s process (%d) became new process (%d)"
 
-#: init/job_process.c:1631
+#: init/job_process.c:1681
 #, c-format
 msgid "%s %s process (%d) executable changed"
 msgstr "%s %s process (%d) executable changed"
@@ -487,7 +502,7 @@
 msgid "Not being executed as init"
 msgstr "Not being executed as init"
 
-#: init/main.c:238 init/main.c:601
+#: init/main.c:238 init/main.c:611
 msgid "Unable to set root directory"
 msgstr "Unable to set root directory"
 
@@ -503,31 +518,31 @@
 msgid "Unable to listen for private connections"
 msgstr "Unable to listen for private connections"
 
-#: init/main.c:618
+#: init/main.c:628
 #, c-format
 msgid "Caught %s, core dumped"
 msgstr "Caught %s, core dumped"
 
-#: init/main.c:622
+#: init/main.c:632
 #, c-format
 msgid "Caught %s, unable to dump core"
 msgstr "Caught %s, unable to dump core"
 
-#: init/main.c:651
+#: init/main.c:661
 #, c-format
 msgid "Re-executing %s"
 msgstr "Re-executing %s"
 
-#: init/main.c:676
+#: init/main.c:686
 #, c-format
 msgid "Failed to re-execute %s: %s"
 msgstr "Failed to re-execute %s: %s"
 
-#: init/main.c:761
+#: init/main.c:771
 msgid "Reconnecting to system bus"
 msgstr "Reconnecting to system bus"
 
-#: init/main.c:767
+#: init/main.c:777
 msgid "Unable to connect to the system bus"
 msgstr "Unable to connect to the system bus"
 

=== modified file 'po/upstart.pot'
--- po/upstart.pot	2011-06-16 14:39:55 +0000
+++ po/upstart.pot	2011-07-25 16:29:00 +0000
@@ -8,7 +8,7 @@
 msgstr ""
 "Project-Id-Version: upstart 1.3\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2011-06-16 15:04+0100\n"
+"POT-Creation-Date: 2011-07-25 17:06+0100\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <[e-mail]>\n"
@@ -63,7 +63,7 @@
 msgid "Disconnected from system bus"
 msgstr ""
 
-#: init/control.c:370 init/main.c:744
+#: init/control.c:370 init/main.c:754
 msgid "Reloading configuration"
 msgstr ""
 
@@ -273,152 +273,167 @@
 msgid "%s %s process (%d)"
 msgstr ""
 
-#: init/job_process.c:403
+#: init/job_process.c:409
 #, c-format
 msgid "Pausing %s (%d) [pre-exec] for debug"
 msgstr ""
 
-#: init/job_process.c:473
+#: init/job_process.c:559
 #, c-format
 msgid "Failed to open system console: %s"
 msgstr ""
 
-#: init/job_process.c:755
+#: init/job_process.c:790
 #, c-format
 msgid "unable to move script fd: %s"
 msgstr ""
 
-#: init/job_process.c:760
+#: init/job_process.c:795
 #, c-format
 msgid "unable to open console: %s"
 msgstr ""
 
-#: init/job_process.c:815
+#: init/job_process.c:850
 #, c-format
 msgid "unable to set \"%s\" resource limit: %s"
 msgstr ""
 
-#: init/job_process.c:820
+#: init/job_process.c:855
 #, c-format
 msgid "unable to set priority: %s"
 msgstr ""
 
-#: init/job_process.c:825
+#: init/job_process.c:860
 #, c-format
 msgid "unable to set oom adjustment: %s"
 msgstr ""
 
-#: init/job_process.c:830
+#: init/job_process.c:865
 #, c-format
 msgid "unable to change root directory: %s"
 msgstr ""
 
-#: init/job_process.c:835
+#: init/job_process.c:870
 #, c-format
 msgid "unable to change working directory: %s"
 msgstr ""
 
-#: init/job_process.c:840
+#: init/job_process.c:875
 #, c-format
 msgid "unable to set trace: %s"
 msgstr ""
 
-#: init/job_process.c:845
+#: init/job_process.c:880
 #, c-format
 msgid "unable to execute: %s"
 msgstr ""
 
-#: init/job_process.c:876 init/job_process.c:926
+#: init/job_process.c:885
+#, c-format
+msgid "unable to setuid: %s"
+msgstr ""
+
+#: init/job_process.c:890
+#, c-format
+msgid "unable to setgid: %s"
+msgstr ""
+
+#: init/job_process.c:895
+#, c-format
+msgid "unable to chown: %s"
+msgstr ""
+
+#: init/job_process.c:926 init/job_process.c:976
 #, c-format
 msgid "Sending %s signal to %s %s process (%d)"
 msgstr ""
 
-#: init/job_process.c:885 init/job_process.c:935
+#: init/job_process.c:935 init/job_process.c:985
 #, c-format
 msgid "Failed to send %s signal to %s %s process (%d): %s"
 msgstr ""
 
-#: init/job_process.c:996
+#: init/job_process.c:1046
 #, c-format
 msgid "%s %s process (%d) terminated with status %d"
 msgstr ""
 
-#: init/job_process.c:1001
+#: init/job_process.c:1051
 #, c-format
 msgid "%s %s process (%d) exited normally"
 msgstr ""
 
-#: init/job_process.c:1016
+#: init/job_process.c:1066
 #, c-format
 msgid "%s %s process (%d) killed by %s signal"
 msgstr ""
 
-#: init/job_process.c:1020
+#: init/job_process.c:1070
 #, c-format
 msgid "%s %s process (%d) killed by signal %d"
 msgstr ""
 
-#: init/job_process.c:1034
+#: init/job_process.c:1084
 #, c-format
 msgid "%s %s process (%d) stopped by %s signal"
 msgstr ""
 
-#: init/job_process.c:1038
+#: init/job_process.c:1088
 #, c-format
 msgid "%s %s process (%d) stopped by signal %d"
 msgstr ""
 
-#: init/job_process.c:1052
+#: init/job_process.c:1102
 #, c-format
 msgid "%s %s process (%d) continued by %s signal"
 msgstr ""
 
-#: init/job_process.c:1056
+#: init/job_process.c:1106
 #, c-format
 msgid "%s %s process (%d) continued by signal %d"
 msgstr ""
 
-#: init/job_process.c:1191
+#: init/job_process.c:1241
 #, c-format
 msgid "%s respawning too fast, stopped"
 msgstr ""
 
-#: init/job_process.c:1197
+#: init/job_process.c:1247
 #, c-format
 msgid "%s %s process ended, respawning"
 msgstr ""
 
-#: init/job_process.c:1437
+#: init/job_process.c:1487
 #, c-format
 msgid "Failed to set ptrace options for %s %s process (%d): %s"
 msgstr ""
 
-#: init/job_process.c:1450 init/job_process.c:1645
+#: init/job_process.c:1500 init/job_process.c:1695
 #, c-format
 msgid "Failed to continue traced %s %s process (%d): %s"
 msgstr ""
 
-#: init/job_process.c:1490 init/job_process.c:1581 init/job_process.c:1636
+#: init/job_process.c:1540 init/job_process.c:1631 init/job_process.c:1686
 #, c-format
 msgid "Failed to detach traced %s %s process (%d): %s"
 msgstr ""
 
-#: init/job_process.c:1530
+#: init/job_process.c:1580
 #, c-format
 msgid "Failed to deliver signal to traced %s %s process (%d): %s"
 msgstr ""
 
-#: init/job_process.c:1565
+#: init/job_process.c:1615
 #, c-format
 msgid "Failed to obtain child process id for %s %s process (%d): %s"
 msgstr ""
 
-#: init/job_process.c:1572
+#: init/job_process.c:1622
 #, c-format
 msgid "%s %s process (%d) became new process (%d)"
 msgstr ""
 
-#: init/job_process.c:1631
+#: init/job_process.c:1681
 #, c-format
 msgid "%s %s process (%d) executable changed"
 msgstr ""
@@ -462,7 +477,7 @@
 msgid "Not being executed as init"
 msgstr ""
 
-#: init/main.c:238 init/main.c:601
+#: init/main.c:238 init/main.c:611
 msgid "Unable to set root directory"
 msgstr ""
 
@@ -478,31 +493,31 @@
 msgid "Unable to listen for private connections"
 msgstr ""
 
-#: init/main.c:618
+#: init/main.c:628
 #, c-format
 msgid "Caught %s, core dumped"
 msgstr ""
 
-#: init/main.c:622
+#: init/main.c:632
 #, c-format
 msgid "Caught %s, unable to dump core"
 msgstr ""
 
-#: init/main.c:651
+#: init/main.c:661
 #, c-format
 msgid "Re-executing %s"
 msgstr ""
 
-#: init/main.c:676
+#: init/main.c:686
 #, c-format
 msgid "Failed to re-execute %s: %s"
 msgstr ""
 
-#: init/main.c:761
+#: init/main.c:771
 msgid "Reconnecting to system bus"
 msgstr ""
 
-#: init/main.c:767
+#: init/main.c:777
 msgid "Unable to connect to the system bus"
 msgstr ""
 

=== modified file 'util/man/initctl.8'
--- util/man/initctl.8	2011-06-16 14:39:55 +0000
+++ util/man/initctl.8	2011-07-25 16:29:00 +0000
@@ -169,8 +169,15 @@
 
 Requests that an instance of the named
 .I JOB
-be restarted (stopped and then started), outputting the status of the
-job to standard output when the command completes.
+be restarted, outputting the status of the job to standard output when
+the command completes.
+
+The job instance being restarted will retain its original configuration.
+To have the new instance run with the latest job configuration,
+.B stop
+the job and then
+.B start
+it again instead.
 
 See
 .B status

=== added file 'util/tests/test_user_sessions.sh'
--- util/tests/test_user_sessions.sh	1970-01-01 00:00:00 +0000
+++ util/tests/test_user_sessions.sh	2011-07-25 16:29:00 +0000
@@ -0,0 +1,553 @@
+#!/bin/sh -u
+#---------------------------------------------------------------------
+# Script to run minimal Upstart user session tests.
+#
+# Note that this script _cannot_ be run as part of the "make check"
+# tests since those tests stimulate functions and features of the
+# as-yet-uninstalled version of Upstart. However, this script needs to
+# run on a system where the version of Upstart under test has _already_
+# been fully installed.
+#---------------------------------------------------------------------
+#
+# Copyright (C) 2011 Canonical Ltd.
+#
+# Author: James Hunt <[e-mail]>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+#---------------------------------------------------------------------
+
+script_name=${0##*/}
+user_job_dir="$HOME/.init"
+bug_url="https://bugs.launchpad.net/upstart/+filebug"
+test_dir=
+test_dir_suffix=
+user_to_create=
+uid=
+gid=
+opt=
+OPTARG=
+
+# allow non-priv users to find 'initctl'
+export PATH=$PATH:/sbin
+
+# for assertions
+die()
+{
+  msg="$*"
+  echo "ERROR: $msg" >&2
+  exit 1
+}
+
+TEST_FAILED()
+{
+  args="$*"
+
+  [ -z "$args" ] && die "need args"
+
+  printf "BAD: %s\n" "$args"
+  printf "\nPlease report a bug at $bug_url including the following details:\n"
+  printf "\nUpstart:\n"
+  /sbin/init --version|head -n1
+  /sbin/initctl --version|head -n1
+  echo
+  printf "cmdline:\n"
+  cat /proc/cmdline
+  echo
+  printf "Upstart Env:\n"
+  set|grep UPSTART_
+  echo
+  printf "lsb:\n"
+  lsb_release -a
+  printf "\nuname:\n"
+  uname -a
+  echo
+  sync
+  exit 1
+}
+
+TEST_GROUP()
+{
+  name="$1"
+
+  [ -z "$name" ] && die "need name"
+
+  printf "Testing %s\n", "$name"
+}
+
+TEST_FEATURE()
+{
+  feature="$1"
+
+  [ -z "$feature" ] && die "need feature"
+
+  printf "...%s\n" "$feature"
+}
+
+TEST_NE()
+{
+  cmd="$1"
+  value="$2"
+  expected="$3"
+
+  # XXX: no checks on value or expected since they might be blank
+  [ -z "$cmd" ] && die "need cmd"
+
+  [ "$value" = "$expected" ] && TEST_FAILED \
+  "wrong value for '$cmd', expected $expected got $value"
+}
+
+TEST_EQ()
+{
+  cmd="$1"
+  value="$2"
+  expected="$3"
+
+  # XXX: no checks on value or expected since they might be blank
+  [ -z "$cmd" ] && die "need cmd"
+
+  [ "$value" != "$expected" ] && TEST_FAILED \
+  "wrong value for '$cmd', expected '$expected' got '$value'"
+}
+
+setup()
+{
+  uid=$(id -u)
+  gid=$(id -g)
+
+  if [ "$uid" = 0 ]
+  then
+    [ -z "$user_to_create" ] && die "need '-u' option when running as root"
+
+    getent passwd "$user_to_create" && \
+      die "user '$user_to_create' already exists"
+
+    echo "Creating user '$user_to_create'"
+    cmd="useradd -mU -c 'Upstart Test User' $user_to_create"
+    eval "$cmd"
+    TEST_EQ "$cmd" $? 0
+
+    echo "Locking account for user '$user_to_create'"
+    cmd="usermod -L $user_to_create"
+    eval "$cmd"
+    TEST_EQ "$cmd" $? 0
+
+    # Run ourselves again as the new user
+    su -c "$0 -a" "$user_to_create"
+    test_run_rc=$?
+
+    if [ $test_run_rc -eq 0 ]
+    then
+      echo "Deleting user '$user_to_create'"
+      cmd="userdel -r \"$user_to_create\""
+      eval "$cmd"
+      TEST_EQ "$cmd" $? 0
+    fi
+
+    exit $test_run_rc
+  fi
+
+  # setup
+  if [ ! -d "$user_job_dir" ]
+  then
+    cmd="mkdir -p \"$user_job_dir\""
+    eval $cmd
+    TEST_EQ "$cmd" $? 0
+
+    cmd="chmod 755 \"$user_job_dir\""
+    eval "$cmd"
+    TEST_EQ "$cmd" $? 0
+  fi
+  
+  # create somewhere to store user jobs
+  cmd="mktemp -d --tmpdir=\"$user_job_dir\""
+  test_dir=$(eval "$cmd")
+  TEST_EQ "$cmd" $? 0
+  TEST_NE "$test_dir" "$test_dir" ""
+  test_dir_suffix=${test_dir#${user_job_dir}/}
+
+  # ensure files in this directory are accessible since
+  # mktemp sets directory perms to 0700 regardless of umask.
+  cmd="chmod 755 \"$test_dir\""
+  eval "$cmd"
+  TEST_EQ "$cmd" $? 0
+
+  TEST_NE "HOME" "$HOME" ""
+}
+
+cleanup()
+{
+  if [ -d "$test_dir" ]
+  then
+    echo "Removing test directory '$test_dir'"
+    cmd="rmdir \"$test_dir\""
+    eval "$cmd"
+    TEST_EQ "$cmd" $? 0
+  fi
+}
+
+ensure_job_known()
+{
+  job="$1"
+  job_name="$2"
+
+  [ -z "$job" ] && die "no job"
+  [ -z "$job_name" ] && die "no job name"
+
+  TEST_FEATURE "ensure 'initctl' recognises job"
+  initctl list|grep -q "^$job " || \
+    TEST_FAILED "job $job_name not known to initctl"
+
+  TEST_FEATURE "ensure 'status' recognises job"
+  cmd="status ${job}"
+  eval "$cmd"
+  rc=$?
+  TEST_EQ "$cmd" $rc 0
+}
+
+run_user_job_tests()
+{
+  job_name="$1"
+  job_file="$2"
+  task="$3"
+  env="$4"
+
+  # XXX: env can be empty
+  [ -z "$job_name" ] && die "no job name"
+  [ -z "$job_file" ] && die "no job file"
+  [ -z "$task" ] && die "no task value"
+
+  job="${test_dir_suffix}/${job_name}"
+
+  [ -f "$job_file" ] || TEST_FAILED "job file '$job_file' does not exist"
+
+  ensure_job_known "$job" "$job_name"
+
+  TEST_FEATURE "ensure job can be started"
+  cmd="start ${job} ${env}"
+  output=$(eval "$cmd")
+  rc=$?
+  TEST_EQ "$cmd" $rc 0
+
+  if [ "$task" = no ]
+  then
+    TEST_FEATURE "ensure 'start' shows job pid"
+    pid=$(echo "$output"|awk '{print $4}')
+    TEST_NE "pid" "$pid" ""
+  
+    TEST_FEATURE "ensure 'initctl' shows job is running with pid"
+    initctl list|grep -q "^$job start/running, process $pid" || \
+      TEST_FAILED "job $job_name did not start"
+  
+    TEST_FEATURE "ensure 'status' shows job is running with pid"
+    cmd="status ${job}"
+    output=$(eval "$cmd")
+    echo "$output"|while read job_tmp state ignored status_pid
+    do
+      state=$(echo $state|tr -d ',')
+      TEST_EQ "job name"  "$job_tmp" "$job"
+      TEST_EQ "job state" "$state" "start/running"
+      TEST_EQ "job pid"   "$status_pid" "$pid"
+    done
+  
+    TEST_FEATURE "ensure job pid is running with correct uids"
+    pid_uids=$(ps --no-headers -p $pid -o euid,ruid)
+    for pid_uid in $pid_uids
+    do
+      TEST_EQ "pid uid" "$pid_uid" "$uid"
+    done
+  
+    TEST_FEATURE "ensure job pid is running with correct gids"
+    pid_gids=$(ps --no-headers -p $pid -o egid,rgid)
+    for pid_gid in $pid_gids
+    do
+      TEST_EQ "pid gid" "$pid_gid" "$gid"
+    done
+  
+    TEST_FEATURE "ensure process is running in correct directory"
+    cwd=$(readlink /proc/$pid/cwd)
+    TEST_EQ "cwd" "$cwd" "$HOME"
+  
+    TEST_FEATURE "ensure job can be stopped"
+    cmd="stop ${job}"
+    output=$(eval "$cmd")
+    rc=$?
+    TEST_EQ "$cmd" $rc 0
+  
+    TEST_FEATURE "ensure job pid no longer exists"
+    pid_ids=$(ps --no-headers -p $pid -o euid,ruid,egid,rgid)
+    TEST_EQ "pid uids+gids" "$pid_ids" ""
+  fi
+
+  remove_job_file "$job_file"
+  ensure_job_gone "$job" "$job_name" "$env"
+}
+
+remove_job_file()
+{
+  job_file="$1"
+
+  [ -z "$job_file" ] && die "no job file"
+  [ ! -f "$job_file" ] && TEST_FAILED "job file '$job_file' does not exist"
+
+  cmd="rm $job_file"
+  eval "$cmd"
+  TEST_EQ "$cmd" $? 0
+}
+
+ensure_job_gone()
+{
+  job="$1"
+  job_name="$2"
+  env="$3"
+
+  # XXX: no check on env since it can be empty
+  [ -z "$job" ] && die "no job"
+  [ -z "$job_name" ] && die "no job name"
+
+  TEST_FEATURE "ensure 'initctl' no longer recognises job"
+  initctl list|grep -q "^$job " && \
+    TEST_FAILED "deleted job $job_name still known to initctl"
+
+  TEST_FEATURE "ensure 'status' no longer recognises job"
+  cmd="status ${job}"
+  eval "$cmd"
+  rc=$?
+  TEST_NE "$cmd" $rc 0
+}
+
+test_user_job()
+{
+  test_group="$1"
+  job_name="$2"
+  script="$3"
+  task="$4"
+  env="$5"
+
+  # XXX: no test on script or env since they might be empty
+  [ -z "$test_group" ] && die "no test group"
+  [ -z "$job_name" ] && die "no job name"
+  [ -z "$task" ] && die "no task"
+
+  TEST_GROUP "$test_group"
+
+  job_file="${test_dir}/${job_name}.conf"
+  
+  echo "$script" > $job_file
+
+  run_user_job_tests "$job_name" "$job_file" "$task" "$env"
+}
+
+test_user_job_binary()
+{
+  group="user job running a binary"
+  job_name="binary_test"
+  script="exec sleep 999"
+  test_user_job "$group" "$job_name" "$script" no ""
+}
+
+test_user_job_binary_task()
+{
+  group="user job running a binary task"
+  job_name="binary_task_test"
+  OUTFILE=$(mktemp)
+
+  script="\
+task
+exec true > $OUTFILE"
+
+  test_user_job "$group" "$job_name" "$script" yes "OUTFILE=$OUTFILE"
+  rm -f $OUTFILE
+}
+
+test_user_job_single_line_script()
+{
+  group="user job running a single-line script"
+  job_name="single_line_script_test"
+  script="\
+script
+  sleep 999
+end script"
+  test_user_job "$group" "$job_name" "$script" no ""
+}
+
+test_user_job_single_line_script_task()
+{
+  group="user job running a single-line script task"
+  job_name="single_line_script_task_test"
+  OUTFILE=$(mktemp)
+
+  script="\
+task
+script
+  exec true > $OUTFILE
+end script"
+  test_user_job "$group" "$job_name" "$script" yes "OUTFILE=$OUTFILE"
+  rm -f $OUTFILE
+}
+
+test_user_job_multi_line_script()
+{
+  group="user job running a multi-line script"
+  job_name="multi_line_script_test"
+  script="\
+script
+
+  true
+  true;true
+  sleep 999
+
+end script"
+  test_user_job "$group" "$job_name" "$script" no ""
+}
+
+test_user_job_multi_line_script_task()
+{
+  group="user job running a multi-line script task"
+  job_name="multi_line_script_task_test"
+  OUTFILE=$(mktemp)
+
+  script="\
+task
+script
+
+  true
+  true
+  true
+
+end script"
+  test_user_job "$group" "$job_name" "$script" yes "OUTFILE=$OUTFILE"
+  rm -f $OUTFILE
+}
+
+test_user_emit_events()
+{
+  job_name="start_on_foo"
+
+  TEST_GROUP "user emitting an event"
+  initctl emit foo || TEST_FAILED "failed to emit event as user"
+
+  TEST_GROUP "user emitting an event to start a job"
+  script="\
+    start on foo BAR=2
+    stop on baz cow=moo or hello
+    exec sleep 999"
+
+  job_file="${test_dir}/${job_name}.conf"
+  job="${test_dir_suffix}/${job_name}"
+
+  echo "$script" > $job_file
+
+  ensure_job_known "$job" "$job_name"
+
+  initctl list|grep -q "^$job stop/waiting" || \
+      TEST_FAILED "job $job_name not stopped"
+
+  TEST_FEATURE "ensure job can be started with event"
+  initctl emit foo BAR=2 || \
+    TEST_FAILED "failed to emit event for user job"
+
+  initctl status "$job"|grep -q "^$job start/running" || \
+      TEST_FAILED "job $job_name failed to start"
+  
+  TEST_FEATURE "ensure job can be stopped with event"
+  initctl emit baz cow=moo || \
+    TEST_FAILED "failed to emit event for user job"
+
+  initctl list|grep -q "^$job stop/waiting" || \
+      TEST_FAILED "job $job_name not stopped"
+
+  rm -f "$job_file"
+}
+
+test_user_jobs()
+{
+  test_user_job_binary
+  test_user_job_single_line_script
+  test_user_job_multi_line_script
+
+  test_user_job_binary_task
+  test_user_job_single_line_script_task
+  test_user_job_multi_line_script_task
+
+  test_user_emit_events
+}
+
+tests()
+{
+  echo
+  echo -n "Running user session tests as user '`whoami`'"
+  echo " (uid $uid, gid $gid) in directory '$test_dir'"
+  echo
+
+  test_user_jobs
+
+  echo
+  echo "All tests completed successfully"
+  echo
+}
+
+usage()
+{
+cat <<EOT
+USAGE: $script_name [options]
+
+OPTIONS:
+
+ -a        : Actually run this script.      
+ -h        : Show this help.
+ -u <user> : Specify name of test user to create.
+
+DESCRIPTION: Run simple set of Upstart user session tests.
+
+WARNING: Note that this script is unavoidably invasive, so read what
+WARNING: follows before running!
+
+If run as a non-root user, this script will create a uniquely-named
+subdirectory below "\$HOME/.init/" to run its tests in. On successful
+completion of these tests, the unique subdirectory and its contents will
+be removed.
+
+If however, this script is invoked as the root user, the script will
+refuse to run until given the name of a test user to create via the "-u"
+option. If the user specified to this option already exists, this script
+will exit with an error. If the user does not already exist, it will be
+created, the script then run *as that user* and assuming successful
+completion of the tests, the test user and their home directory will
+then be deleted.
+ 
+EOT
+}
+
+#---------------------------------------------------------------------
+# main
+#---------------------------------------------------------------------
+
+while getopts "hu:" opt
+do
+  case "$opt" in
+    h)
+      usage
+      exit 0
+    ;;
+
+    u)
+      user_to_create="$OPTARG"
+    ;;
+  esac
+done
+
+setup
+tests
+cleanup
+exit 0