Merge lp:~jamesodhunt/upstart/remove-basic-user-sessions into lp:upstart

[James Hunt]

= Removal of Simple Sessions =

This branch removes the existing 'User Jobs' code since we are in the process of replacing that facility entirely by 'User Sessions' [1].

= D-Bus =

The branch reverts the D-Bus policy changes introduced to allow any user to manipulate any property and method (since with User Jobs, all commands were namespaced off by default.

Checks have been added to all control interfaces to disallow non-priv users from manipulating PID 1 properties and methods.

Note however that this branch does _not_ provide the same checks on job and job instance method calls (or log-priority method): we are reliant on D-Bus policy to police these for now. This is consistent with old pre-session behaviour but we should review this approach in a follow-on branch to make the internal D-Bus border checks fully consistent.

[1] - https://wiki.ubuntu.com/FoundationsTeam/Specs/RaringUpstartUserSessions

[Steve Langasek (vorlon)]

Several places in the code, you're using this construction:

  if (control_get_origin_uid (message, &origin_uid) && origin_uid != uid) {
      // EPERM

So if the control_get_origin_uid() function fails, access is granted. This seems like a bad idea, as it means anyone who can figure out a way to break the function can get access. I think it's probably better to do:

  if (!control_get_origin_uid (message, &origin_uid) || origin_uid != uid) {
      // EPERM

Otherwise, this looks good to me.

review: Needs Fixing

[lp:~jamesodhunt/upstart/remove-basic-user-sessions]

1430. By James Hunt on 2013-01-29

* init/control.c: More careful uid checking.

[James Hunt (jamesodhunt)]

Hi Steve,

Good catch! Fixed.

[lp:~jamesodhunt/upstart/remove-basic-user-sessions]

1431. By James Hunt on 2013-01-30

* init/control.c:
  - Typos.
  - Improved uid checks.
  - Replaced direct call to control_get_origin_uid() with call to new
    control_check_permission() (as early as possible) for clarity and
    to confine policy to one location.
  - control_set_log_prioity(): Added missing call to
    control_check_permission().
  - control_get_origin_uid(): Check message contents before allowing
    D-Bus calls.
* init/control.h: Added missing prototypes.

[James Hunt (jamesodhunt)]

Reworked branch D-Bus permission checking to simplify code and confine policy to a single location.

[Colin Watson (cjwatson)]

Looks better now, though I'd add a comment to control_check_permission explaining that we rely on dbus to limit session bus access to the same user (since this is a little non-obvious if you happen to be just looking at that function).

review: Approve

[lp:~jamesodhunt/upstart/remove-basic-user-sessions]

1432. By James Hunt on 2013-01-30

* init/control.c: Comments.

[James Hunt (jamesodhunt)]

Fixed. Thanks for reviewing.

=== modified file 'ChangeLog'
--- ChangeLog	2013-01-24 08:37:53 +0000
+++ ChangeLog	2013-01-30 16:15:24 +0000
@@ -1,3 +1,51 @@
[phone]  James Hunt  <[e-mail]>
+
+	* init/control.c:
+	  - Typos.
+	  - Improved uid checks.
+	  - Replaced direct call to control_get_origin_uid() with call to new
+	    control_check_permission() (as early as possible) for clarity and
+	    to confine policy to one location. 
+	  - control_set_log_prioity(): Added missing call to
+	    control_check_permission().
+	  - control_get_origin_uid(): Check message contents before allowing
+	    D-Bus calls.
+
[phone]  James Hunt  <[e-mail]>
+
+	* init/control.c: More careful uid checking.
+
[phone]  James Hunt  <[e-mail]>
+
+	* init/control.c:
+	  - control_reload_configuration(): Added missing permission checks.
+	  - control_emit_event_with_file(): Added missing permission checks.
+	  - Added calls to new function control_get_origin_uid() to allow
+	    D-Bus methods to be policed by filtering on uid, rather than
+	    relying on the same information that used to be stored in the
+	    old Session object.
+	* init/job.c: Typo.
+	* init/job_class.c:
+	  - job_class_new(): Removed user elements from session code.
+	  - job_class_serialise(): Comments.
+	  - job_class_deserialise(): Comments.
+	* init/job_process.c: job_process_spawn(): Removed user session
+	  handling.
+	* init/session.c: Removed user session handling since it is
+	  about to be replaced by the ability to run Upstart as a
+	  non-privileged user (aka a 'Session Init').
+	* init/session.h: Updated prototypes.
+	* init/state.h: Comments.
+	* init/tests/test_conf.c: test_source_reload_job_dir(): Added missing
+	  check.
+	* init/tests/test_state.c:
+	  - session_diff(): Removed user check.
+	  - Updated all calls to session_new().
+	* util/tests/test_initctl.c: test_notify_disk_writeable(): Ensure this
+	  test is not run as root.
+	* util/tests/test_user_sessions.sh: Removed.
+	* init/man/init.5: Updated to reflect removal of user jobs.
+
 2013-01-21  Dmitrijs Ledkovs  <[e-mail]>
 
 	* init/xdg.[ch]: add xdg_get_cache_home and get_user_log_dir

=== modified file 'dbus/Upstart.conf'
--- dbus/Upstart.conf	2010-12-10 03:02:57 +0000
+++ dbus/Upstart.conf	2013-01-30 16:15:24 +0000
@@ -9,14 +9,12 @@
     <allow own="com.ubuntu.Upstart" />
   </policy>
 
-  <!-- Allow any user to invoke all of the methods on Upstart, its jobs
-       or their instances, and to get and set properties - since Upstart
-       isolates commands by user. -->
-  <policy context="default">
-    <allow send_destination="com.ubuntu.Upstart"
-	   send_interface="org.freedesktop.DBus.Introspectable" />
+  <!-- Permit the root user to invoke all of the methods on Upstart, its jobs
+       or their instances, and to get and set properties. -->
+  <policy user="root">
     <allow send_destination="com.ubuntu.Upstart"
 	   send_interface="org.freedesktop.DBus.Properties" />
+
     <allow send_destination="com.ubuntu.Upstart"
 	   send_interface="com.ubuntu.Upstart0_6" />
     <allow send_destination="com.ubuntu.Upstart"
@@ -24,4 +22,36 @@
     <allow send_destination="com.ubuntu.Upstart"
 	   send_interface="com.ubuntu.Upstart0_6.Instance" />
   </policy>
+
+  <!-- Allow any user to introspect Upstart's interfaces, to obtain the
+       values of properties (but not set them) and to invoke selected
+       methods on Upstart and its jobs that are used to walk information. -->
+  <policy context="default">
+    <allow send_destination="com.ubuntu.Upstart"
+	   send_interface="org.freedesktop.DBus.Introspectable" />
+
+    <allow send_destination="com.ubuntu.Upstart"
+	   send_interface="org.freedesktop.DBus.Properties"
+	   send_type="method_call" send_member="Get" />
+    <allow send_destination="com.ubuntu.Upstart"
+	   send_interface="org.freedesktop.DBus.Properties"
+	   send_type="method_call" send_member="GetAll" />
+
+    <allow send_destination="com.ubuntu.Upstart"
+	   send_interface="com.ubuntu.Upstart0_6"
+	   send_type="method_call" send_member="GetJobByName" />
+    <allow send_destination="com.ubuntu.Upstart"
+	   send_interface="com.ubuntu.Upstart0_6"
+	   send_type="method_call" send_member="GetAllJobs" />
+
+    <allow send_destination="com.ubuntu.Upstart"
+	   send_interface="com.ubuntu.Upstart0_6.Job"
+	   send_type="method_call" send_member="GetInstance" />
+    <allow send_destination="com.ubuntu.Upstart"
+	   send_interface="com.ubuntu.Upstart0_6.Job"
+	   send_type="method_call" send_member="GetInstanceByName" />
+    <allow send_destination="com.ubuntu.Upstart"
+	   send_interface="com.ubuntu.Upstart0_6.Job"
+	   send_type="method_call" send_member="GetAllInstances" />
+  </policy>
 </busconfig>

=== modified file 'init/control.c'
--- init/control.c	2013-01-23 12:56:00 +0000
+++ init/control.c	2013-01-30 16:15:24 +0000
@@ -2,7 +2,7 @@
  *
  * control.c - D-Bus connections, objects and methods
  *
- * Copyright © 2009-2011 Canonical Ltd.
+ * Copyright  2009-2011 Canonical Ltd.
  * Author: Scott James Remnant <[e-mail]>.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -60,11 +60,15 @@
 #include "com.ubuntu.Upstart.h"
 
 /* Prototypes for static functions */
-static int   control_server_connect (DBusServer *server, DBusConnection *conn);
-static void  control_disconnected   (DBusConnection *conn);
-static void  control_register_all   (DBusConnection *conn);
+static int   control_server_connect   (DBusServer *server, DBusConnection *conn);
+static void  control_disconnected     (DBusConnection *conn);
+static void  control_register_all     (DBusConnection *conn);
 
-static void  control_bus_flush      (void);
+static void  control_bus_flush        (void);
+static int   control_get_origin_uid   (NihDBusMessage *message, uid_t *uid)
+	__attribute__ ((warn_unused_result));
+static int   control_check_permission (NihDBusMessage *message)
+	__attribute__ ((warn_unused_result));
 
 /**
  * use_session_bus:
@@ -378,6 +382,8 @@
  * Called to request that Upstart reloads its configuration from disk,
  * useful when inotify is not available or the user is generally paranoid.
  *
+ * Notes: chroot sessions are permitted to make this call.
+ *
  * Returns: zero on success, negative value on raised error.
  **/
 int
@@ -386,6 +392,13 @@
 {
 	nih_assert (message != NULL);
 
+	if (! control_check_permission (message)) {
+		nih_dbus_error_raise_printf (
+			DBUS_INTERFACE_UPSTART ".Error.PermissionDenied",
+			_("You do not have permission to reload configuration"));
+		return -1;
+	}
+
 	nih_info (_("Reloading configuration"));
 
 	/* This can only be called after deserialisation */
@@ -574,13 +587,20 @@
 			      int              wait,
 			      int              file)
 {
-	Event   *event;
-	Blocked *blocked;
+	Event    *event;
+	Blocked  *blocked;
 
 	nih_assert (message != NULL);
 	nih_assert (name != NULL);
 	nih_assert (env != NULL);
 
+	if (! control_check_permission (message)) {
+		nih_dbus_error_raise_printf (
+			DBUS_INTERFACE_UPSTART ".Error.PermissionDenied",
+			_("You do not have permission to emit an event"));
+		return -1;
+	}
+
 	/* Verify that the name is valid */
 	if (! strlen (name)) {
 		nih_dbus_error_raise_printf (DBUS_ERROR_INVALID_ARGS,
@@ -741,6 +761,13 @@
 	nih_assert (message != NULL);
 	nih_assert (log_priority != NULL);
 
+	if (! control_check_permission (message)) {
+		nih_dbus_error_raise_printf (
+			DBUS_INTERFACE_UPSTART ".Error.PermissionDenied",
+			_("You do not have permission to set log priority"));
+		return -1;
+	}
+
 	if (! strcmp (log_priority, "debug")) {
 		nih_log_set_priority (NIH_LOG_DEBUG);
 
@@ -793,6 +820,11 @@
  * Called to flush the job logs for all jobs that ended before the log
  * disk became writeable.
  *
+ * Notes: Session Inits are permitted to make this call. In the common
+ * case of starting a Session Init as a child of a Display Manager this
+ * is somewhat meaningless, but it does mean that if a Session Init were
+ * started from a system job, behaviour would be as expected.
+ *
  * Returns: zero on success, negative value on raised error.
  **/
 int
@@ -804,16 +836,16 @@
 
 	nih_assert (message != NULL);
 
-	/* Get the relevant session */
-	session = session_from_dbus (NULL, message);
-
-	if (session && session->user) {
+	if (! control_check_permission (message)) {
 		nih_dbus_error_raise_printf (
 			DBUS_INTERFACE_UPSTART ".Error.PermissionDenied",
 			_("You do not have permission to notify disk is writeable"));
 		return -1;
 	}
 
+	/* Get the relevant session */
+	session = session_from_dbus (NULL, message);
+
 	/* "nop" when run from a chroot */
 	if (session && session->chroot)
 		return 0;
@@ -978,13 +1010,17 @@
 		   char           **state)
 {
 	Session  *session;
-	uid_t     uid;
 	size_t    len;
 
 	nih_assert (message);
 	nih_assert (state);
 
-	uid = getuid ();
+	if (! control_check_permission (message)) {
+		nih_dbus_error_raise_printf (
+			DBUS_INTERFACE_UPSTART ".Error.PermissionDenied",
+			_("You do not have permission to request state"));
+		return -1;
+	}
 
 	/* Get the relevant session */
 	session = session_from_dbus (NULL, message);
@@ -999,17 +1035,6 @@
 		return 0;
 	}
 
-	/* Disallow users from obtaining state details, unless they
-	 * happen to own this process (which they may do in the test
-	 * scenario and when running Upstart as a non-privileged user).
-	 */
-	if (session && session->user != uid) {
-		nih_dbus_error_raise_printf (
-			DBUS_INTERFACE_UPSTART ".Error.PermissionDenied",
-			_("You do not have permission to request state"));
-		return -1;
-	}
-
 	if (state_to_string (state, &len) < 0)
 		goto error;
 
@@ -1041,11 +1066,15 @@
 		 NihDBusMessage *message)
 {
 	Session  *session;
-	uid_t     uid;
 
 	nih_assert (message != NULL);
 
-	uid = getuid ();
+	if (! control_check_permission (message)) {
+		nih_dbus_error_raise_printf (
+			DBUS_INTERFACE_UPSTART ".Error.PermissionDenied",
+			_("You do not have permission to request restart"));
+		return -1;
+	}
 
 	/* Get the relevant session */
 	session = session_from_dbus (NULL, message);
@@ -1061,17 +1090,6 @@
 		return 0;
 	}
 
-	/* Disallow users from restarting Upstart, unless they happen to
-	 * own this process (which they may do in the test scenario and
-	 * when running Upstart as a non-privileged user).
-	 */
-	if (session && session->user != uid) {
-		nih_dbus_error_raise_printf (
-			DBUS_INTERFACE_UPSTART ".Error.PermissionDenied",
-			_("You do not have permission to request restart"));
-		return -1;
-	}
-
 	nih_info (_("Restarting"));
 
 	stateful_reexec ();
@@ -1117,3 +1135,83 @@
 		NIH_ZERO (control_emit_restarted (conn, DBUS_PATH_UPSTART));
 	}
 }
+
+/**
+ * control_get_origin_uid:
+ * @message: D-Bus connection and message received,
+ * @uid: returned uid value.
+ *
+ * Returns TRUE: if @uid now contains uid corresponding to @message,
+ * else FALSE.
+ **/
+static int
+control_get_origin_uid (NihDBusMessage *message, uid_t *uid)
+{
+	DBusError       dbus_error;
+	unsigned long   unix_user = 0;
+	const char     *sender;
+
+	nih_assert (message);
+	nih_assert (uid);
+
+	dbus_error_init (&dbus_error);
+
+	if (! message->message || ! message->connection)
+		return FALSE;
+
+	sender = dbus_message_get_sender (message->message);
+	if (sender) {
+		unix_user = dbus_bus_get_unix_user (message->connection, sender,
+						    &dbus_error);
+		if (unix_user == (unsigned long)-1) {
+			dbus_error_free (&dbus_error);
+			return FALSE;
+		}
+	} else {
+		if (! dbus_connection_get_unix_user (message->connection,
+						     &unix_user)) {
+			return FALSE;
+		}
+	}
+
+	*uid = (uid_t)unix_user;
+
+	return TRUE;
+}
+
+/**
+ * control_check_permission:
+ *
+ * @message: D-Bus connection and message received.
+ *
+ * Determine if caller should be allowed to make a control request.
+ *
+ * Note that these permission checks rely on D-Bus to limit
+ * session bus access to the same user.
+ *
+ * Returns: TRUE if permission is granted, else FALSE.
+ **/
+static int
+control_check_permission (NihDBusMessage *message)
+{
+	int    ret;
+	uid_t  uid;
+	pid_t  pid;
+	uid_t  origin_uid = 0;
+
+	nih_assert (message);
+
+	uid = getuid ();
+	pid = getpid ();
+
+	ret = control_get_origin_uid (message, &origin_uid);
+
+	/* Its possible that D-Bus might be unable to determine the user
+	 * making the request. In this case, deny the request unless
+	 * we're running as a Session Init or via the test harness.
+	 */
+	if ((ret && origin_uid == uid) || user_mode || (uid && pid != 1))
+		return TRUE;
+
+	return FALSE;
+}

=== modified file 'init/job.c'
--- init/job.c	2012-11-07 11:56:33 +0000
+++ init/job.c	2013-01-30 16:15:24 +0000
@@ -1701,7 +1701,7 @@
 /**
  * job_serialise_all:
  *
- * Convert existing Session objects to JSON representation.
+ * Convert existing Job objects to JSON representation.
  *
  * Returns: JSON object containing array of Job objects, or NULL on error.
  **/

=== modified file 'init/job_class.c'
--- init/job_class.c	2012-12-14 20:55:41 +0000
+++ init/job_class.c	2013-01-30 16:15:24 +0000
@@ -142,40 +142,17 @@
 		goto error;
 
 	class->session = session;
-	if (class->session
-	    && class->session->chroot
-	    && class->session->user) {
-		nih_local char *uid = NULL;
-
-		uid = nih_sprintf (NULL, "%d", class->session->user);
-		if (! uid)
-			goto error;
-
-		class->path = nih_dbus_path (class, DBUS_PATH_UPSTART, "jobs",
-					     session->chroot, uid,
-					     class->name, NULL);
-
-	} else if (class->session
-		   && class->session->chroot) {
+
+	if (class->session && class->session->chroot) {
 		class->path = nih_dbus_path (class, DBUS_PATH_UPSTART, "jobs",
 					     session->chroot,
 					     class->name, NULL);
 
-	} else if (class->session
-		   && class->session->user) {
-		nih_local char *uid = NULL;
-
-		uid = nih_sprintf (NULL, "%d", class->session->user);
-		if (! uid)
-			goto error;
-
-		class->path = nih_dbus_path (class, DBUS_PATH_UPSTART, "jobs",
-					     uid, class->name, NULL);
-
 	} else {
 		class->path = nih_dbus_path (class, DBUS_PATH_UPSTART, "jobs",
 					     class->name, NULL);
 	}
+
 	if (! class->path)
 		goto error;
 
@@ -1595,12 +1572,12 @@
 	if (! json)
 		return NULL;
 	
-	/* XXX: user and chroot jobs are not currently supported
+	/* XXX: chroot jobs are not currently supported
 	 * due to ConfSources not currently being serialised.
 	 */
 	if (class->session) {
-		nih_info ("WARNING: serialisation of user jobs and "
-			"chroot sessions not currently supported");
+		nih_info ("WARNING: serialisation of chroot "
+				"sessions not currently supported");
 		goto error;
 	}
 
@@ -1828,12 +1805,12 @@
 
 	session = session_from_index (session_index);
 
-	/* XXX: user and chroot jobs are not currently supported
+	/* XXX: chroot jobs are not currently supported
 	 * due to ConfSources not currently being serialised.
 	 */
 	if (session) {
-		nih_info ("WARNING: deserialisation of user jobs and "
-			"chroot sessions not currently supported");
+		nih_info ("WARNING: deserialisation of chroot "
+				"sessions not currently supported");
 		goto error;
 	}
 

=== modified file 'init/job_process.c'
--- init/job_process.c	2013-01-23 12:40:36 +0000
+++ init/job_process.c	2013-01-30 16:15:24 +0000
@@ -420,8 +420,6 @@
 	char            pts_name[PATH_MAX];
 	char            filename[PATH_MAX];
 	FILE           *fd;
-	int             user_job = FALSE;
-	nih_local char *user_dir = NULL;
 	nih_local char *log_path = NULL;
 	JobClass       *class;
 	uid_t           job_setuid = -1;
@@ -439,20 +437,14 @@
 
 	nih_assert (class != NULL);
 
-	if (class && class->session && class->session->user)
-		user_job = TRUE;
-
 	/* Create a pipe to communicate with the child process until it
 	 * execs so we know whether that was successful or an error occurred.
 	 */
 	if (pipe (fds) < 0)
 		nih_return_system_error (-1);
 
-	/* Logging of user job output is not currently possible */
-	if (class->console == CONSOLE_LOG) {
-		if (disable_job_logging || user_job)
+	if (class->console == CONSOLE_LOG && disable_job_logging)
 			class->console = CONSOLE_NONE;
-	}
 
 	if (class->console == CONSOLE_LOG) {
 		NihError *err;
@@ -655,87 +647,6 @@
 	/* Set the process environment from the function parameters. */
 	environ = (char **)env;
 
-	/* Handle unprivileged user job by dropping privileges to
-	 * their level as soon as possible to avoid privilege
-	 * escalations when we set resource limits.
-	 */
-	if (user_job) {
-		uid_t uid = class->session->user;
-		struct passwd *pw = NULL;
-
-		/* D-Bus does not expose a public API call to allow
-		 * us to query a users primary group.
-		 * _dbus_user_info_fill_uid () seems to exist for this
-		 * purpose, but is a "secret" API. It is unclear why
-		 * D-Bus neglects the gid when it allows the uid
-		 * to be queried directly.
-		 *
-		 * Our only recourse is to disallow user sessions in a
-		 * chroot and assume that all other user sessions
-		 * originate from the local system. In this way, we can
-		 * bypass D-Bus and use getpwuid ().
-		 */
-
-		if (class->session->chroot) {
-			/* We cannot determine the group id of the user
-			 * session in the chroot via D-Bus, so disallow
-			 * all jobs in such an environment.
-			 */
-			nih_error_raise (EPERM, "user jobs not supported in chroots");
-			job_process_error_abort (fds[1], JOB_PROCESS_ERROR_CHROOT, 0);
-		}
-
-		pw = getpwuid (uid);
-
-		if (!pw) {
-			nih_error_raise_system ();
-			job_process_error_abort (fds[1], JOB_PROCESS_ERROR_GETPWUID, 0);
-		}
-
-		nih_assert (pw->pw_uid == uid);
-
-		if (! pw->pw_dir) {
-			nih_error_raise_printf (ENOENT,
-					"no home directory for user with uid %d", uid);
-			job_process_error_abort (fds[1], JOB_PROCESS_ERROR_GETPWUID, 0);
-
-		}
-
-		/* Note we don't use NIH_MUST since this could result in a
-		 * DoS for a (low priority) user job in low-memory scenarios.
-		 */
-		user_dir = nih_strdup (NULL, pw->pw_dir);
-
-		if (! user_dir) {
-			nih_error_raise_no_memory ();
-			job_process_error_abort (fds[1], JOB_PROCESS_ERROR_ALLOC, 0);
-		}
-
-		/* Ensure the file associated with fd 9
-		 * (/proc/self/fd/9) is owned by the user we're about to
-		 * become to avoid EPERM.
-		 */
-		if (script_fd != -1 && fchown (script_fd, pw->pw_uid, pw->pw_gid) < 0) {
-			nih_error_raise_system ();
-			job_process_error_abort (fds[1], JOB_PROCESS_ERROR_CHOWN, 0);
-		}
-
-		if (geteuid () == 0 && initgroups (pw->pw_name, pw->pw_gid) < 0) {
-			nih_error_raise_system ();
-			job_process_error_abort (fds[1], JOB_PROCESS_ERROR_INITGROUPS, 0);
-		}
-
-		if (pw->pw_gid && setgid (pw->pw_gid) < 0) {
-			nih_error_raise_system ();
-			job_process_error_abort (fds[1], JOB_PROCESS_ERROR_SETGID, 0);
-		}
-
-		if (pw->pw_uid && setuid (pw->pw_uid) < 0) {
-			nih_error_raise_system ();
-			job_process_error_abort (fds[1], JOB_PROCESS_ERROR_SETUID, 0);
-		}
-	}
-
 	/* Set the standard file descriptors to an output of our chosing;
 	 * any other open descriptor must be intended for the child, or have
 	 * the FD_CLOEXEC flag so it's automatically closed when we exec()
@@ -854,7 +765,7 @@
 	 * configured in the job, or to the root directory of the filesystem
 	 * (or at least relative to the chroot).
 	 */
-	if (chdir (class->chdir ? class->chdir : user_job ? user_dir : "/") < 0) {
+	if (chdir (class->chdir ? class->chdir : "/") < 0) {
 		nih_error_raise_system ();
 		job_process_error_abort (fds[1], JOB_PROCESS_ERROR_CHDIR, 0);
 	}

=== modified file 'init/man/init.5'
--- init/man/init.5	2013-01-23 12:40:36 +0000
+++ init/man/init.5	2013-01-30 16:15:24 +0000
@@ -1,4 +1,4 @@
-.TH init 5 2012-12-18 "Upstart"
+.TH init 5 2013-01-25 "Upstart"
 .\"
 .SH NAME
 init \- Upstart init daemon job configuration
@@ -9,13 +9,14 @@
 Default location of system job configuration files.
 .\"
 .TP
-.B $HOME/.init/
-Default location of user job configuration files.
-.\"
-.TP
 .B $XDG_CONFIG_HOME/upstart/, $XDG_CONFIG_DIRS/upstart/
 Default locations of user session job configuration files.
 .\"
+.TP
+.B $HOME/.init/
+Deprecated location of user job configuration files (still
+honoured by User Session Mode).
+.\"
 .SH DESCRIPTION
 On startup, the Upstart
 .BR init (8)
@@ -24,11 +25,6 @@
 directory, and watches for future changes to these files using
 .BR inotify (7).
 
-If D\-Bus has been configured to allow non\-privileged users to invoke all
-Upstart D\-Bus methods, Upstart is also able to manage User Jobs. See
-.B User Jobs
-for further details.
-
 If Upstart was invoked as a user process with \-\-user option, it will
 run in User Session mode. See
 .B User Session Mode
@@ -85,33 +81,6 @@
 
 Configuration files are plain text and should not be executable.
 .\"
-.SS User Jobs
-
-A User Job is a job configuration file created by a non\-privileged user
-in their
-.B $HOME/.init/
-directory. Job configuration files in this directory have the same
-syntax as system job configuration files.
-Files in this directory will be read and an
-.BR inotify (7)
-watch created the first time a user runs 
-.BR initctl (8) "."
-
-Any user can create user jobs, but that user can control
-.I only
-jobs they create.
-
-Users are able to manage their jobs using the standard
-.BR initctl (8)
-facility.
-
-Note that stanzas which manipulate resources limits may cause a job to
-fail to start should the value provided to such a stanza attempt to
-exceed the maximum value the users privilege level allows.
-
-Note that a user job configuration file cannot have the same name as a
-system job configuration file.
-.\"
 .SS Chroot Support
 
 Upstart is able to manage jobs within a \fBchroot\fP(2). To control jobs
@@ -124,10 +93,6 @@
 .B Process environment
 below).
 
-Note that User Jobs
-.B cannot
-be used within a chroot environment.
-
 .\"
 .SS User Session Mode
 
@@ -447,9 +412,10 @@
 .BR initctl (8)
 utility to default to acting on the job the commands are called from.
 
-When running in a user session, the additional UPSTART_SESSION environment
-variable is also set and contains the DBus path to the private bus used by
-the upstart instance daemon.
+When running in a user session, the additional
+.B UPSTART_SESSION
+environment variable is also set and contains the DBus path to the
+private bus used by the upstart instance daemon.
 
 .TP
 .B env \fIKEY\fR[=\fIVALUE\fR]
@@ -667,12 +633,7 @@
 .B log
 .RS
 .B
-Only applies to system and user session jobs:
-if specified by user jobs, the job will be considered to have specified
-the value
-.BR none "."
-
-For system and user session jobs jobs, if \fBlog\fR is specified, standard input is connected
+If \fBlog\fR is specified, standard input is connected
 to
 .IR /dev/null ","
 and standard output and standard error are connected to a pseudo-tty
@@ -881,7 +842,7 @@
 block is used for all job processes. If both stanzas are unspecified,
 all job processes will run with its group ID set to 0 in the case of
 system jobs, and as the primary group of the user in the case of User
-Jobs.
+Session jobs.
 .\"
 .SS Override File Handling
 Override files allow a jobs environment to be changed without modifying
@@ -1025,11 +986,13 @@
 .
 .TP
 .I $HOME/.init/*.conf
-User job configuration files.
+User job configuration files
+.BR (deprecated) .
 .
 .TP
 .I $HOME/.init/*.override
 User job override files.
+.BR (deprecated) .
 .
 .TP
 .I $XDG_CONFIG_HOME/upstart/*.conf
@@ -1063,7 +1026,7 @@
 .RB < https://launchpad.net/upstart/+bugs >
 .\"
 .SH COPYRIGHT
-Copyright \(co 2009-2011 Canonical Ltd.
+Copyright \(co 2009-2013 Canonical Ltd.
 .br
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

=== modified file 'init/session.c'
--- init/session.c	2012-11-14 14:47:19 +0000
+++ init/session.c	2013-01-30 16:15:24 +0000
@@ -68,7 +68,7 @@
 /**
  * disable_sessions:
  *
- * If TRUE, disable user and chroot sessions, resulting in a
+ * If TRUE, disable chroot sessions, resulting in a
  * "traditional" (pre-session support) system.
  **/
 int disable_sessions = FALSE;
@@ -93,21 +93,19 @@
 /**
  * session_new:
  * @parent: parent,
- * @chroot: full chroot path,
- * @user: user id.
+ * @chroot: full chroot path.
  *
- * Create a new session.
+ * Create a new chroot session.
  *
  * Returns: new Session, or NULL on error.
  **/
 Session *
 session_new (const void *parent,
-	     const char *chroot,
-	     uid_t       user)
+	     const char *chroot)
 {
 	Session *session;
 
-	nih_assert ((chroot != NULL) || (user != 0));
+	nih_assert (chroot);
 
 	session_init ();
 
@@ -117,18 +115,12 @@
 
 	nih_list_init (&session->entry);
 
-	if (chroot) {
-		session->chroot = nih_strdup (session, chroot);
-		if (! session->chroot) {
-			nih_free (session);
-			return NULL;
-		}
-	} else {
-		session->chroot = NULL;
+	session->chroot = nih_strdup (session, chroot);
+	if (! session->chroot) {
+		nih_free (session);
+		return NULL;
 	}
 
-	session->user = user;
-
 	session->conf_path = NULL;
 
 	nih_alloc_set_destructor (session, nih_list_destroy);
@@ -151,14 +143,13 @@
 session_from_dbus (const void     *parent,
 		   NihDBusMessage *message)
 {
-	const char     *sender;
-	DBusError       dbus_error;
-	unsigned long   unix_user;
-	unsigned long   unix_process_id;
-	char            root[PATH_MAX];
-	Session        *session;
-	struct passwd  *pwd;
-	nih_local char *conf_path = NULL;
+	DBusError        dbus_error;
+	unsigned long    unix_process_id;
+	char             root[PATH_MAX];
+	Session         *session;
+	nih_local char  *conf_path = NULL;
+	nih_local char  *symlink = NULL;
+	ssize_t          len;
 
 	nih_assert (message != NULL);
 
@@ -170,126 +161,43 @@
 
 	session_init ();
 
-	/* Ask D-Bus nicely for the origin uid and/or pid of the caller;
-	 * sadly we can't ask the bus daemon for the origin pid, so that
-	 * one will just have to stay user-session only.
-	 */
 	dbus_error_init (&dbus_error);
 
-	sender = dbus_message_get_sender (message->message);
-	if (sender) {
-		unix_user = dbus_bus_get_unix_user (message->connection, sender,
-						    &dbus_error);
-		if (unix_user == (unsigned long)-1) {
-			dbus_error_free (&dbus_error);
-			unix_user = 0;
-		}
-
-		unix_process_id = 0;
-
-	} else {
-		if (! dbus_connection_get_unix_user (message->connection,
-						     &unix_user))
-			unix_process_id = 0;
-
-		if (! dbus_connection_get_unix_process_id (message->connection,
-							   &unix_process_id))
-			unix_process_id = 0;
-	}
-
-	/* If we retrieved a process id, look up the root path for it;
-	 * if it's just '/' don't worry so much about it.
-	 */
-	if (unix_process_id) {
-		nih_local char *symlink = NULL;
-		ssize_t len;
-
-		symlink = NIH_MUST (nih_sprintf (NULL, "/proc/%lu/root",
-						 unix_process_id));
-		len = readlink (symlink, root, sizeof root);
-		if (len < 0)
-			return NULL;
-
-		root[len] = '\0';
-
-		if (! strcmp (root, "/")) {
-			unix_process_id = 0;
-			if (! unix_user)
-				return NULL;
-		}
-
-	} else if (! unix_user) {
-		/* No process id or user id found, return the NULL session */
-		return NULL;
-	}
-
-	if (unix_user) {
-		pwd = getpwuid (unix_user);
-
-		if (! pwd || ! pwd->pw_dir) {
-			nih_error ("%lu: %s: %s", unix_user,
-				   _("Unable to lookup home directory"),
-				   strerror (errno));
-			return NULL;
-		}
-
-		NIH_MUST (nih_strcat_sprintf (&conf_path, NULL, "%s/%s",
-					pwd->pw_dir, USERCONFDIR));
-	}
-
+	/* Query origin pid of the caller */
+	if (! dbus_connection_get_unix_process_id (message->connection,
+				&unix_process_id)) {
+		return NULL;
+	}
+
+	/* Look up the root path for retrieved pid */
+	symlink = NIH_MUST (nih_sprintf (NULL, "/proc/%lu/root",
+				unix_process_id));
+	len = readlink (symlink, root, sizeof root);
+	if (len < 0)
+		return NULL;
+
+	root[len] = '\0';
+
+	/* Path is not inside a chroot */
+	if (! strcmp (root, "/"))
+		return NULL;
 
 	/* Now find in the existing Sessions list */
 	NIH_LIST_FOREACH_SAFE (sessions, iter) {
 		Session *session = (Session *)iter;
 
-		if (unix_process_id) {
-			if (! session->chroot)
-				continue;
-
+		if (strcmp (session->chroot, root))
 			/* ignore sessions relating to other chroots */
-			if (strcmp (session->chroot, root))
-				continue;
-		}
-
-		/* ignore sessions relating to other users */
-		if (unix_user != session->user)
 			continue;
 
-		/* Found a user with the same uid but different
-		 * conf_path to the existing session user. Either the
-		 * original user has been deleted and a new user created
-		 * with the same uid, or the original users home
-		 * directory has changed since they first started
-		 * running jobs. Whatever the reason, we (can only) honour
-		 * the new value.
-		 *
-		 * Since multiple users with the same uid are considered
-		 * to be "the same user", invalidate the old path,
-		 * allowing the correct new path to be set below.
-		 *
-		 * Note that there may be a possibility of trouble if
-		 * the scenario relates to a deleted user and that original
-		 * user still has jobs running. However, if that were the
-		 * case, those jobs would likely fail anyway since they
-		 * would have no working directory due to the original
-		 * users home directory being deleted/changed/made inaccessible.
-		 */
-		if (unix_user && conf_path && session->conf_path &&
-				strcmp (conf_path, session->conf_path)) {
-			nih_free (session->conf_path);
-			session->conf_path = NULL;
-		}
-
 		if (! session->conf_path)
 			session_create_conf_source (session, FALSE);
 
 		return session;
 	}
 
-
 	/* Didn't find one, make a new one */
-	session = NIH_MUST (session_new (parent, unix_process_id ? root : NULL,
-					 unix_user));
+	session = NIH_MUST (session_new (parent, root));
 	session_create_conf_source (session, FALSE);
 
 	return session;
@@ -317,27 +225,8 @@
 	session_init ();
 
 	if (! deserialised) {
-		if (session->chroot)
-			session->conf_path = NIH_MUST (nih_strdup (NULL, session->chroot));
-		if (session->user) {
-			struct passwd *pwd;
-
-			pwd = getpwuid (session->user);
-			if (! pwd) {
-				nih_error ("%d: %s: %s", session->user,
-						_("Unable to lookup home directory"),
-						strerror (errno));
-
-				nih_free (session->conf_path);
-				session->conf_path = NULL;
-				return;
-			}
-
-			NIH_MUST (nih_strcat_sprintf (&session->conf_path, NULL, "%s/%s",
-						pwd->pw_dir, USERCONFDIR));
-		} else {
-			NIH_MUST (nih_strcat (&session->conf_path, NULL, CONFDIR));
-		}
+		session->conf_path = NIH_MUST (nih_strdup (NULL, session->chroot));
+		NIH_MUST (nih_strcat (&session->conf_path, NULL, CONFDIR));
 	}
 
 	source = NIH_MUST (conf_source_new (session, session->conf_path,
@@ -375,9 +264,10 @@
 	json_object  *json;
 	json_object  *conf_path = NULL;
 	json_object  *chroot = NULL;
-	json_object  *user;
 
 	nih_assert (session);
+	nih_assert (session->chroot);
+	nih_assert (session->conf_path);
 
 	session_init ();
 
@@ -385,26 +275,16 @@
 	if (! json)
 		return NULL;
 
-	if (session->chroot) {
-		chroot = json_object_new_string (session->chroot);
-		if (! chroot)
-			goto error;
-	}
+	chroot = json_object_new_string (session->chroot);
+	if (! chroot)
+		goto error;
 
 	json_object_object_add (json, "chroot", chroot);
 
-	user = state_new_json_int (session->user);
-	if (! user)
+	conf_path = json_object_new_string (session->conf_path);
+	if (! conf_path)
 		goto error;
 
-	json_object_object_add (json, "user", user);
-
-	if (session->conf_path) {
-		conf_path = json_object_new_string (session->conf_path);
-		if (! conf_path)
-			goto error;
-	}
-
 	json_object_object_add (json, "conf_path", conf_path);
 
 	return json;
@@ -459,6 +339,9 @@
  *
  * Convert @json into a Session object.
  *
+ * NOTE: Any user sessions seen when re-execing from an older version
+ * of Upstart are implicitly ignored.
+ *
  * Returns: Session object, or NULL on error.
  **/
 static Session *
@@ -466,7 +349,6 @@
 {
 	Session              *session = NULL;
 	nih_local const char *chroot = NULL;
-	uid_t                 user;
 
 	nih_assert (json);
 
@@ -477,11 +359,11 @@
 	if (! state_get_json_string_var (json, "chroot", NULL, chroot))
 		return NULL;
 
-	if (! state_get_json_int_var (json, "user", user))
+	if (! chroot)
 		return NULL;
 
 	/* Create a new session */
-	session = NIH_MUST (session_new (NULL, chroot, user));
+	session = NIH_MUST (session_new (NULL, chroot));
 
 	if (! state_get_json_string_var_to_obj (json, session, conf_path))
 		goto error;

=== modified file 'init/session.h'
--- init/session.h	2012-11-22 16:32:36 +0000
+++ init/session.h	2013-01-30 16:15:24 +0000
@@ -33,14 +33,11 @@
  * Session:
  * @entry: list header,
  * @chroot: path all jobs are chrooted to,
- * @user: uid all jobs are switched to,
- * @conf_path: configuration path (either full path to chroot root, or
- * full path to users job directory (which may itself be prepended
- * with a chroot path)).
+ * @conf_path: configuration path (full path to chroot root).
  *
  * This structure is used to identify collections of jobs
- * that share either a common @chroot and/or common @user. Note that
- * @conf_path is unique across all sessions.
+ * that share a common @chroot (*). Note that @conf_path is
+ * unique across all sessions.
  *
  * Summary of Session values for different environments:
  *
@@ -50,27 +47,28 @@
  * | user | PID  | chroot | uid | Object contents                   |
  * +------+------+--------+-----+-----------------------------------+
  * | 0    | >0   | no     | 0   | NULL (*1)                         |
- * | >0   | "0"  | no     | >0  | uid + conf_path set to "~/.init". |
  * | 0    | >0   | yes    | 0   | chroot + conf_path set            |
- * | >0   | ??   | yes    | >0  | XXX: fails (*2)                   |
+ * | >0   | ??   | yes    | >0  | Not permitted (*2)                |
  * +------+------+--------+-----+-----------------------------------+
  *
  * Notes:
  *
+ * (*) - this structure used to also store user session details (hence
+ * the name), but the functionality was removed with the advent of
+ * a true user mode.
+ *
  * (*1) - The "NULL session" represents the "traditional" environment
  * before sessions were introduced (namely a non-chroot environment
  * where all job and event operations were handled by uid 0 (root)).
  *
- * (*2) - error is:
+ * (*2) - User lookup is not reliable since the user to query exists
+ * within the chroot, but the only possible lookup is outside the
+ * chroot.
  *
- *   initctl: Unable to connect to system bus: Failed to connect to socket
- *   /var/run/dbus/system_bus_socket: No such file or directory
- * 
  **/
 typedef struct session {
 	NihList entry;
 	char *  chroot;
-	uid_t   user;
 	char *  conf_path;
 } Session;
 
@@ -81,7 +79,7 @@
 
 void           session_init        (void);
 
-Session      * session_new         (const void *parent, const char *chroot, uid_t user)
+Session      * session_new         (const void *parent, const char *chroot)
 	__attribute__ ((malloc, warn_unused_result));
 
 Session      * session_from_dbus   (const void *parent, NihDBusMessage *message);

=== modified file 'init/state.h'
--- init/state.h	2012-12-04 16:09:18 +0000
+++ init/state.h	2013-01-30 16:15:24 +0000
@@ -28,10 +28,10 @@
  *     detect that is *has* changed filesystem context.
  *
  *   - Since ConfSources are NOT serialised, it is currently not possible
- *     to support user jobs and chroot jobs (because the only ConfSource
+ *     to support chroot jobs (because the only ConfSource
  *     objects created are those at startup (for '/etc/init/'): any
- *     pre-existing ConfSources with non-NULL sessions representing
- *     user jobs will be ignored).
+ *     pre-existing ConfSources with non-NULL Session objects will
+ *     be ignored).
  *
  *   - parent/child timeout handling: we won't support down-grading initially.
  *

=== modified file 'init/tests/test_conf.c'
--- init/tests/test_conf.c	2013-01-04 13:03:47 +0000
+++ init/tests/test_conf.c	2013-01-30 16:15:24 +0000
@@ -1404,6 +1404,8 @@
 	fclose (f);
 
 	source = conf_source_new (NULL, dirname, CONF_JOB_DIR);
+	TEST_NE_P (source, NULL);
+
 	ret = conf_source_reload (source);
 
 	TEST_EQ (ret, 0);

=== modified file 'init/tests/test_state.c'
--- init/tests/test_state.c	2012-12-07 21:38:17 +0000
+++ init/tests/test_state.c	2013-01-30 16:15:24 +0000
@@ -217,9 +217,6 @@
 	if (obj_string_check (a, b, chroot))
 		goto fail;
 
-	if (obj_num_check (a, b, user))
-		goto fail;
-
 	if (obj_string_check (a, b, conf_path))
 		goto fail;
 
@@ -871,12 +868,12 @@
 	TEST_NE_P (json, NULL);
 
 	/* Create a couple of sessions */
-	session1 = session_new (NULL, "/abc", getuid ());
+	session1 = session_new (NULL, "/abc");
 	TEST_NE_P (session1, NULL);
 	session1->conf_path = NIH_MUST (nih_strdup (session1, "/def/ghi"));
 	TEST_LIST_NOT_EMPTY (sessions);
 
-	session2 = session_new (NULL, "/foo", 0);
+	session2 = session_new (NULL, "/foo");
 	TEST_NE_P (session2, NULL);
 	session2->conf_path = NIH_MUST (nih_strdup (session2, "/bar/baz"));
 
@@ -1264,7 +1261,7 @@
 	TEST_LIST_EMPTY (conf_sources);
 	TEST_HASH_EMPTY (job_classes);
 
-	session = session_new (NULL, "/my/session", getuid ());
+	session = session_new (NULL, "/my/session");
 	TEST_NE_P (session, NULL);
 	session->conf_path = NIH_MUST (nih_strdup (session, "/lives/here"));
 	TEST_LIST_NOT_EMPTY (sessions);
@@ -1659,7 +1656,7 @@
 	TEST_NE_P (env, NULL);
 	TEST_NE_P (environ_add (&env, NULL, &len, TRUE, "FOO=BAR"), NULL);
 
-	session = session_new (NULL, "/abc", getuid ());
+	session = session_new (NULL, "/abc");
 	TEST_NE_P (session, NULL);
 	session->conf_path = NIH_MUST (nih_strdup (session, "/def/ghi"));
 	TEST_LIST_NOT_EMPTY (sessions);

=== modified file 'util/tests/test_initctl.c'
--- util/tests/test_initctl.c	2013-01-22 18:17:04 +0000
+++ util/tests/test_initctl.c	2013-01-30 16:15:24 +0000
@@ -12490,6 +12490,9 @@
 	/* Ensure again that no log file written */
 	TEST_LT (stat (logfile_name, &statbuf), 0);
 
+	/* Must not be run as root */
+	TEST_TRUE (getuid ());
+
 	cmd = nih_sprintf (NULL, "%s notify-disk-writeable 2>&1", INITCTL_BINARY);
 	TEST_NE_P (cmd, NULL);
 	RUN_COMMAND (NULL, cmd, &output, &lines);

=== removed file 'util/tests/test_user_sessions.sh'
--- util/tests/test_user_sessions.sh	2012-01-26 08:59:08 +0000
+++ util/tests/test_user_sessions.sh	1970-01-01 00:00:00 +0000
@@ -1,1091 +0,0 @@
-#!/bin/sh
-#---------------------------------------------------------------------
-# Script to run minimal Upstart user session tests.
-#
-# Note that this script _cannot_ be run as part of the "make check"
-# tests since those tests stimulate functions and features of the
-# as-yet-uninstalled version of Upstart. However, this script needs to
-# run on a system where the version of Upstart under test has _already_
-# been fully installed.
-#---------------------------------------------------------------------
-#
-# Copyright (C) 2011 Canonical Ltd.
-#
-# Author: James Hunt <[e-mail]>
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, version 3 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-#---------------------------------------------------------------------
-
-script_name=${0##*/}
-sys_job_dir="/etc/init"
-user_job_dir="$HOME/.init"
-user_log_dir="$HOME/.cache/upstart/log"
-sys_log_dir="/var/log/upstart"
-bug_url="https://bugs.launchpad.net/upstart/+filebug"
-test_dir=
-test_dir_suffix=
-user_to_create=
-uid=
-gid=
-opt=
-OPTARG=
-debug_enabled=0
-feature=
-
-# allow non-priv users to find 'initctl'
-export PATH=$PATH:/sbin
-
-# for assertions
-die()
-{
-  msg="$*"
-  echo "ERROR: $msg" >&2
-  exit 1
-}
-
-debug()
-{
-  str="$1"
-  [ "$debug_enabled" = 1 ] && echo "DEBUG: $str"
-}
-
-get_job_pid()
-{
-  job="$1"
-  [ -z "$job" ] && die "need job"
-
-  pid=$(initctl status "$job"|grep process|awk '{print $NF}')
-  [ -z "$pid" ] && die "job $job has no pid"
-
-  echo "$pid"
-}
-
-# take a string and convert it into a valid job name
-make_job_name()
-{
-  str="$1"
-
-  echo "$str" |\
-    sed -e 's/>/ gt /g' -e 's/</ lt /g' -e 's/+/ and /g' |\
-    sed -e 's/[[:punct:]]//g' -e 's/  */ /g' |\
-    tr ' ' '-'
-}
-
-upstart_encode()
-{
-  str="$1"
-
-  echo "$str" | sed 's!/!_!g'
-}
-
-# take a string and convert it into a valid job log file name
-make_log_name()
-{
-  str="$1"
-  upstart_encode "$str"
-}
-
-TEST_FAILED()
-{
-  args="$*"
-
-  [ -z "$args" ] && die "need args"
-
-  echo
-  echo "ERROR: TEST FAILED ('$feature')"
-  echo
-  printf "BAD: ${args}\n"
-  printf "\nPlease report a bug at $bug_url including the following details:\n"
-  printf "\nUpstart:\n"
-  /sbin/init --version|head -n1
-  /sbin/initctl --version|head -n1
-  echo
-  printf "cmdline:\n"
-  cat /proc/cmdline
-  echo
-  printf "Upstart Env:\n"
-  set|grep UPSTART_
-  echo
-  printf "lsb:\n"
-  lsb_release -a
-  printf "\nuname:\n"
-  uname -a
-  echo
-  sync
-  echo "ERROR: TEST FAILED ('$feature')"
-  echo
-  exit 1
-}
-
-TEST_GROUP()
-{
-  name="$1"
-
-  [ -z "$name" ] && die "need name"
-
-  printf "Testing %s\n" "$name"
-}
-
-TEST_FEATURE()
-{
-  feature="$1"
-
-  [ -z "$feature" ] && die "need feature"
-
-  printf "...%s\n" "$feature"
-}
-
-TEST_NE()
-{
-  cmd="$1"
-  value="$2"
-  expected="$3"
-
-  # XXX: no checks on value or expected since they might be blank
-  [ -z "$cmd" ] && die "need cmd"
-
-  [ "$value" = "$expected" ] && TEST_FAILED \
-  "wrong value for '$cmd', expected $expected got $value"
-}
-
-TEST_EQ()
-{
-  cmd="$1"
-  value="$2"
-  expected="$3"
-
-  # XXX: no checks on value or expected since they might be blank
-  [ -z "$cmd" ] && die "need cmd"
-
-  [ "$value" != "$expected" ] && TEST_FAILED \
-  "wrong value for '$cmd', expected '$expected' got '$value'"
-}
-
-checks()
-{
-  cmd=initctl
-  [ -z "$(command -v $cmd)" ] && die "cannot find command $cmd"
-
-  [ "$(id -u)" = 0 ] && die "ERROR: should not run this function as root"
-
-  # This will fail for a non-root user unless D-Bus is correctly
-  # configured
-  $cmd emit foo || die \
-    "You do not appear to have configured D-Bus for Upstart user sessions. See usage."
-}
-
-setup()
-{
-  uid=$(id -u)
-  gid=$(id -g)
-
-  if [ "$uid" = 0 ]
-  then
-    [ -z "$user_to_create" ] && die "need '-u' option when running as root"
-
-    getent passwd "$user_to_create" && \
-      die "user '$user_to_create' already exists"
-
-    echo "Creating user '$user_to_create'"
-    cmd="useradd -mU -c 'Upstart Test User' $user_to_create"
-    eval "$cmd"
-    TEST_EQ "$cmd" $? 0
-
-    echo "Locking account for user '$user_to_create'"
-    cmd="usermod -L $user_to_create"
-    eval "$cmd"
-    TEST_EQ "$cmd" $? 0
-
-    # Run ourselves again as the new user
-    su -c "$0 -a" "$user_to_create"
-    test_run_rc=$?
-
-    if [ $test_run_rc -eq 0 ]
-    then
-      echo "Deleting user '$user_to_create'"
-      cmd="userdel -r \"$user_to_create\""
-      eval "$cmd"
-      TEST_EQ "$cmd" $? 0
-    fi
-
-    exit $test_run_rc
-  fi
-
-  checks
-
-  # setup
-  if [ ! -d "$user_job_dir" ]
-  then
-    cmd="mkdir -p \"$user_job_dir\""
-    eval $cmd
-    TEST_EQ "$cmd" $? 0
-
-    cmd="chmod 755 \"$user_job_dir\""
-    eval "$cmd"
-    TEST_EQ "$cmd" $? 0
-  fi
-
-  # create somewhere to store user jobs
-  cmd="mktemp -d --tmpdir=\"$user_job_dir\""
-  test_dir=$(eval "$cmd")
-  TEST_EQ "$cmd" $? 0
-  TEST_NE "$test_dir" "$test_dir" ""
-  test_dir_suffix=${test_dir#${user_job_dir}/}
-
-  # ensure files in this directory are accessible since
-  # mktemp sets directory perms to 0700 regardless of umask.
-  cmd="chmod 755 \"$test_dir\""
-  eval "$cmd"
-  TEST_EQ "$cmd" $? 0
-
-  TEST_NE "HOME" "$HOME" ""
-}
-
-cleanup()
-{
-  if [ -d "$test_dir" ]
-  then
-    echo "Removing test directory '$test_dir'"
-    cmd="rmdir \"$test_dir\""
-    eval "$cmd"
-    TEST_EQ "$cmd" $? 0
-  fi
-}
-
-ensure_job_known()
-{
-  job="$1"
-  job_name="$2"
-
-  [ -z "$job" ] && die "no job"
-  [ -z "$job_name" ] && die "no job name"
-
-  TEST_FEATURE "ensure 'initctl' recognises job"
-  initctl list|grep -q "^$job " || \
-    TEST_FAILED "job $job_name not known to initctl"
-
-  TEST_FEATURE "ensure 'status' recognises job"
-  cmd="status ${job}"
-  eval "$cmd" >/dev/null 2>&1
-  rc=$?
-  TEST_EQ "$cmd" $rc 0
-}
-
-# Note that if the specified job is *not* as task, it is expected to run
-# indefinately. This allows us to perform PID checks, etc.
-run_user_job_tests()
-{
-  job_name="$1"
-  job_file="$2"
-  task="$3"
-  env="$4"
-
-  # XXX: env can be empty
-  [ -z "$job_name" ] && die "no job name"
-  [ -z "$job_file" ] && die "no job file"
-  [ -z "$task" ] && die "no task value"
-
-  job="${test_dir_suffix}/${job_name}"
-
-  [ -f "$job_file" ] || TEST_FAILED "job file '$job_file' does not exist"
-
-  ensure_job_known "$job" "$job_name"
-
-  TEST_FEATURE "ensure job can be started"
-  cmd="start ${job} ${env}"
-  output=$(eval "$cmd")
-  rc=$?
-  TEST_EQ "$cmd" $rc 0
-
-  if [ "$task" = no ]
-  then
-    TEST_FEATURE "ensure 'start' shows job pid"
-    pid=$(echo "$output"|awk '{print $4}')
-    TEST_NE "pid" "$pid" ""
-
-    TEST_FEATURE "ensure 'initctl' shows job is running with pid"
-    initctl list|grep -q "^$job start/running, process $pid" || \
-      TEST_FAILED "job $job_name did not start"
-
-    TEST_FEATURE "ensure 'status' shows job is running with pid"
-    cmd="status ${job}"
-    output=$(eval "$cmd")
-    echo "$output"|while read job_tmp state ignored status_pid
-    do
-      state=$(echo $state|tr -d ',')
-      TEST_EQ "job name"  "$job_tmp" "$job"
-      TEST_EQ "job state" "$state" "start/running"
-      TEST_EQ "job pid"   "$status_pid" "$pid"
-    done
-
-    TEST_FEATURE "ensure job pid is running with correct uids"
-    pid_uids=$(ps --no-headers -p $pid -o euid,ruid)
-    for pid_uid in $pid_uids
-    do
-      TEST_EQ "pid uid" "$pid_uid" "$uid"
-    done
-
-    TEST_FEATURE "ensure job pid is running with correct gids"
-    pid_gids=$(ps --no-headers -p $pid -o egid,rgid)
-    for pid_gid in $pid_gids
-    do
-      TEST_EQ "pid gid" "$pid_gid" "$gid"
-    done
-
-    TEST_FEATURE "ensure process is running in correct directory"
-    cwd=$(readlink /proc/$pid/cwd)
-    TEST_EQ "cwd" "$cwd" "$HOME"
-
-    TEST_FEATURE "ensure job can be stopped"
-    cmd="stop ${job}"
-    output=$(eval "$cmd")
-    rc=$?
-    TEST_EQ "$cmd" $rc 0
-
-    TEST_FEATURE "ensure job pid no longer exists"
-    pid_ids=$(ps --no-headers -p $pid -o euid,ruid,egid,rgid)
-    TEST_EQ "pid uids+gids" "$pid_ids" ""
-  fi
-
-  remove_job_file "$job_file"
-  ensure_job_gone "$job" "$job_name" "$env"
-}
-
-remove_job_file()
-{
-  job_file="$1"
-
-  [ -z "$job_file" ] && die "no job file"
-  [ ! -f "$job_file" ] && TEST_FAILED "job file '$job_file' does not exist"
-
-  cmd="rm $job_file"
-  eval "$cmd"
-  TEST_EQ "$cmd" $? 0
-}
-
-ensure_job_gone()
-{
-  job="$1"
-  job_name="$2"
-  env="$3"
-
-  # XXX: no check on env since it can be empty
-  [ -z "$job" ] && die "no job"
-  [ -z "$job_name" ] && die "no job name"
-
-  TEST_FEATURE "ensure 'initctl' no longer recognises job"
-  initctl list|grep -q "^$job " && \
-    TEST_FAILED "deleted job $job_name still known to initctl"
-
-  TEST_FEATURE "ensure 'status' no longer recognises job"
-  cmd="status ${job}"
-  eval "$cmd" >/dev/null 2>&1
-  rc=$?
-  TEST_NE "$cmd" $rc 0
-}
-
-test_user_job()
-{
-  test_group="$1"
-  job_name="$2"
-  script="$3"
-  task="$4"
-  env="$5"
-
-  # XXX: no test on script or env since they might be empty
-  [ -z "$test_group" ] && die "no test group"
-  [ -z "$job_name" ] && die "no job name"
-  [ -z "$task" ] && die "no task"
-
-  TEST_GROUP "$test_group"
-
-  job_file="${test_dir}/${job_name}.conf"
-
-  echo "$script" > $job_file
-
-  run_user_job_tests "$job_name" "$job_file" "$task" "$env"
-}
-
-test_user_job_binary()
-{
-  group="user job running a binary"
-  job_name="binary_test"
-  script="exec sleep 999"
-  test_user_job "$group" "$job_name" "$script" no ""
-}
-
-test_user_job_binary_task()
-{
-  group="user job running a binary task"
-  job_name="binary_task_test"
-  OUTFILE=$(mktemp)
-
-  script="\
-task
-exec /bin/true > $OUTFILE"
-
-  test_user_job "$group" "$job_name" "$script" yes "OUTFILE=$OUTFILE"
-  rm -f $OUTFILE
-}
-
-test_user_job_single_line_script()
-{
-  group="user job running a single-line script"
-  job_name="single_line_script_test"
-  script="\
-script
-  sleep 999
-end script"
-  test_user_job "$group" "$job_name" "$script" no ""
-}
-
-test_user_job_single_line_script_task()
-{
-  group="user job running a single-line script task"
-  job_name="single_line_script_task_test"
-  OUTFILE=$(mktemp)
-
-  script="\
-task
-script
-  exec /bin/true > $OUTFILE
-end script"
-  test_user_job "$group" "$job_name" "$script" yes "OUTFILE=$OUTFILE"
-  rm -f $OUTFILE
-}
-
-test_user_job_multi_line_script()
-{
-  group="user job running a multi-line script"
-  job_name="multi_line_script_test"
-  script="\
-script
-
-  /bin/true
-  /bin/true;/bin/true
-  sleep 999
-
-end script"
-  test_user_job "$group" "$job_name" "$script" no ""
-}
-
-test_user_job_multi_line_script_task()
-{
-  group="user job running a multi-line script task"
-  job_name="multi_line_script_task_test"
-  OUTFILE=$(mktemp)
-
-  script="\
-task
-script
-
-  /bin/true
-  /bin/true
-  /bin/true
-
-end script"
-  test_user_job "$group" "$job_name" "$script" yes "OUTFILE=$OUTFILE"
-  rm -f $OUTFILE
-}
-
-test_user_emit_events()
-{
-  job_name="start_on_foo"
-
-  TEST_GROUP "user emitting an event"
-  initctl emit foo || TEST_FAILED "failed to emit event as user"
-
-  TEST_GROUP "user emitting an event to start a job"
-  script="\
-    start on foo BAR=2
-    stop on baz cow=moo or hello
-    exec sleep 999"
-
-  job_file="${test_dir}/${job_name}.conf"
-  job="${test_dir_suffix}/${job_name}"
-
-  echo "$script" > $job_file
-
-  ensure_job_known "$job" "$job_name"
-
-  initctl list|grep -q "^$job stop/waiting" || \
-      TEST_FAILED "job $job_name not stopped"
-
-  TEST_FEATURE "ensure job can be started with event"
-  initctl emit foo BAR=2 || \
-    TEST_FAILED "failed to emit event for user job"
-
-  initctl status "$job"|grep -q "^$job start/running" || \
-      TEST_FAILED "job $job_name failed to start"
-
-  TEST_FEATURE "ensure job can be stopped with event"
-  initctl emit baz cow=moo || \
-    TEST_FAILED "failed to emit event for user job"
-
-  initctl list|grep -q "^$job stop/waiting" || \
-      TEST_FAILED "job $job_name not stopped"
-
-  rm -f "$job_file"
-}
-
-test_user_job_setuid_setgid()
-{
-    group="user job with setuid and setgid me"
-    job_name="setuid_setgid_me_test"
-    script="\
-setuid $(id -un)
-setgid $(id -gn)
-exec sleep 999"
-    test_user_job "$group" "$job_name" "$script" no ""
-
-    TEST_GROUP "user job with setuid and setgid root"
-    script="\
-setuid root
-setgid root
-exec sleep 999"
-
-    job_name="setuid_setgid_root_test"
-    job_file="${test_dir}/${job_name}.conf"
-    job="${test_dir_suffix}/${job_name}"
-
-    echo "$script" > $job_file
-
-    ensure_job_known "$job" "$job_name"
-
-    TEST_FEATURE "ensure job fails to start as root"
-    cmd="start ${job}"
-    output=$(eval "$cmd" 2>&1)
-    rc=$?
-    TEST_EQ "$cmd" $rc 1
-
-    TEST_FEATURE "ensure 'start' indicates job failure"
-    error=$(echo "$output"|grep failed)
-    TEST_NE "error" "$error" ""
-
-    TEST_FEATURE "ensure 'initctl' does not list job"
-    initctl list|grep -q "^$job stop/waiting" || \
-        TEST_FAILED "job $job_name not listed as stopped"
-
-    delete_job "$job_name"
-}
-
-get_job_file()
-{
-  job_name="$1"
-
-  [ -z "$job_name" ] && die "no job name"
-  echo "${test_dir}/${job_name}.conf"
-}
-
-ensure_no_output()
-{
-  job_name="$1"
-  script="$2"
-  instance="$3"
-
-  job="${test_dir_suffix}/${job_name}"
-
-  create_job "$job_name" "$script"
-  start_job "$job" "$job_name" "$instance"
-
-  check_job_output "$job_name"
-  delete_job "$job_name"
-}
-
-create_job()
-{
-  job_name="$1"
-  script="$2"
-
-  # XXX: script could be empty
-  [ -z "$job_name" ] && die "no job name"
-
-  debug "create_job: job_name='$job_name'"
-  debug "create_job: script='$script'"
-
-  # Not currently possible to have a user job with the
-  # same name as a system job.
-  #
-  # XXX: Note that this test assumes that user has *not* specified
-  # XXX: an alternate configuration directory using the
-  # XXX: '--confdir' option.
-  [ -e "${sys_job_dir}/${job_name}.conf" ] && \
-    die "job '$job_name' already exists as a system job"
-
-  job_file="${test_dir}/${job_name}.conf"
-  job="${test_dir_suffix}/${job_name}"
-
-  echo "$script" > "$job_file"
-  sync
-}
-
-delete_job()
-{
-  job_name="$1"
-
-  [ -z "$job_name" ] && die "no job name"
-
-  job_file="$(get_job_file $job_name)"
-
-  rm "$job_file" || TEST_FAILED "unable to remove job file '$job_file'"
-}
-
-check_job_output()
-{
-  job_name="$1"
-
-  [ ! -z "$(ls $user_log_dir 2>/dev/null)" ] && \
-    TEST_FAILED "job $job_name created logfile unexpectedly in '$user_log_dir'"
-
-  # XXX: note that it might appear that checking in $sys_log_dir
-  # could result in false positives, but this isn't so since
-  # (currently) it is not possible for a user job to have the
-  # same name as a system job. start_job() will detect this
-  # scenario.
-  for dir in "$user_log_dir" "$sys_log_dir"
-  do
-    log_file="${dir}/${job_name}.log"
-    [ -f "$log_file" ] && \
-      TEST_FAILED "job $job_name created logfile unexpectedly as '$log_file'"
-  done
-}
-
-start_job()
-{
-  job="$1"
-  job_file="$2"
-  instance="$3"
-  allow_failure="$4"
-
-  # XXX: instance may be blank
-  [ -z "$job" ] && die "no job"
-  [ -z "$job_file" ] && die "no job file"
-
-  debug "start_job: job='$job'"
-  debug "start_job: job_file='$job_file'"
-  debug "start_job: instance='$instance'"
-  debug "start_job: allow_failure='$allow_failure'"
-
-  eval output=$(mktemp)
-
-  # XXX: Don't quote instance as we don't want to pass a null instance to
-  # start(8).
-  cmd="start \"$job\" $instance >${output} 2>&1"
-  debug "start_job: running '$cmd'"
-  eval "$cmd"
-  rc=$?
-
-  if [ $rc -ne 0 -a -z "$allow_failure" ]
-  then
-    TEST_FAILED "job $job_file not started: $(cat $output)"
-  fi
-
-  rm -f "$output"
-}
-
-get_job_logfile_name()
-{
-  job_name="$1"
-  instance_value="$2"
-
-  # XXX: instance may be null
-  [ -z "$job_name" ] && die "no job name"
-
-  encoded_test_dir_suffix=$(upstart_encode "${test_dir_suffix}/")
-  file_name="${encoded_test_dir_suffix}$(make_log_name $job_name)"
-
-  if [ ! -z "$instance_value" ]
-  then
-    log_file="${user_log_dir}/${file_name}-${instance_value}.log"
-  else
-    log_file="${user_log_dir}/${file_name}.log"
-  fi
-
-  echo "$log_file"
-}
-
-run_job()
-{
-  job="$1"
-  job_name="$2"
-  script="$3"
-  instance="$4"
-
-  # XXX: script, instance might be blank
-  [ -z "$job" ] && die "no job"
-  [ -z "$job_name" ] && die "no job name"
-
-  debug "run_job: job='$job'"
-  debug "run_job: job_name='$job_name'"
-  debug "run_job: script='$script'"
-  debug "run_job: instance='$instance'"
-
-  create_job "$job_name" "$script"
-  start_job "$job" "$job_name" "$instance"
-}
-
-ensure_file_meta()
-{
-  file="$1"
-  expected_owner="$2"
-  expected_group="$3"
-  expected_perms="$4"
-
-  [ -z "$file" ] && die "no file"
-  [ -z "$expected_owner" ] && die "no expected owner"
-  [ -z "$expected_group" ] && die "no expected group"
-  [ -z "$expected_perms" ] && die "no expected perms"
-
-  [ ! -f "$file" ] && die "file $file does not exist"
-
-  expected_perms="640"
-  umask_value=$(umask)
-  umask_expected=0022
-
-  if [ "$umask_value" != "$umask_expected" ]
-  then
-    msg="umask value is $umask_value -"
-    msg="${msg} changing it to $umask_expected."
-    echo "WARNING: $msg"
-    umask "$umask_expected" || TEST_FAILED "unable to change umask"
-  fi
-
-  owner=$(ls -l "$file"|awk '{print $3}')
-  group=$(ls -l "$file"|awk '{print $4}')
-  perms=$(stat --printf "%a\n" "$file")
-
-  [ "$owner" = "$expected_owner" ] || TEST_FAILED \
-    "file $file has wrong owner (expected $expected_owner, got $owner)"
-
-  [ "$group" = "$expected_group" ] || TEST_FAILED \
-    "file $file has wrong group (expected $expected_group, got $group)"
-
-  [ "$perms" = "$expected_perms" ] || TEST_FAILED \
-    "file $file has wrong group (expected $expected_perms, got $perms)"
-}
-
-
-ensure_output()
-{
-  job_name="$1"
-  script="$2"
-  expected_output="$3"
-  instance="$4"
-  instance_value="$5"
-  options="$6"
-
-  # XXX: remaining args could be null
-  [ -z "$job_name" ] && die "no job name"
-
-  debug "ensure_output: job_name='$job_name'"
-  debug "ensure_output: script='$script'"
-  debug "ensure_output: expected_ouput='$expected_ouput'"
-  debug "ensure_output: instance='$instance'"
-  debug "ensure_output: instance_value='$instance_value'"
-  debug "ensure_output: options='$options'"
-
-  regex=n
-  retain=n
-  unique=""
-  use_od=n
-
-  for opt in $options
-  do
-    case "$opt" in
-      regex)
-        regex=y
-        ;;
-      retain)
-        retain=y
-        ;;
-      unique)
-        unique='|sort -u'
-        ;;
-      use_od)
-        use_od=y
-        ;;
-    esac
-  done
-
-  debug "ensure_output: regex='$regex'"
-  debug "ensure_output: retain='$retain'"
-  debug "ensure_output: unique='$unique'"
-  debug "ensure_output: use_od='$use_od'"
-
-  expected_owner=$(id -un)
-  expected_group=$(id -gn)
-  expected_perms="640"
-
-  job="${test_dir_suffix}/${job_name}"
-
-  run_job "$job" "$job_name" "$script" "$instance"
-
-  debug "ensure_output: user_log_dir='$user_log_dir'"
-  debug "ensure_output: test_dir='$test_dir'"
-  debug "ensure_output: test_dir_suffix='$test_dir_suffix'"
-
-  log_file=$(get_job_logfile_name "$job_name" "$instance_value")
-
-  debug "ensure_output: log_file='$log_file'"
-
-  # Give Upstart a chance to parse the file
-  count=1
-  while ! status "$job" >/dev/null 2>&1
-  do
-    sleep 1
-    count=$((count+1))
-    [ "$count" -eq 5 ] && break
-  done
-
-  # give job a chance to start
-  count=1
-  while [ ! -f "$log_file" ]
-  do
-    sleep 1
-    count=$((count+1))
-    [ "$count" -eq 5 ] && break
-  done
-
-  [ ! -f "$log_file" ] && \
-      TEST_FAILED "job '$job_name' failed to create logfile"
-
-  ensure_file_meta \
-    "$log_file" \
-    "$expected_owner" \
-    "$expected_group" \
-    "$expected_perms"
-
-  # XXX: note we have to remove carriage returns added by the line
-  # discipline
-  if [ "$regex" = y ]
-  then
-    log=$(eval "cat $log_file|tr -d '\r' $unique")
-    msg="job '$job_name' failed to log correct data\n"
-    msg="${msg}\texpected regex: '$expected_output'\n"
-    msg="${msg}\tgot           : '$log'"
-    cat "$log_file" | egrep "$expected_output" || TEST_FAILED "$msg"
-  elif [ "$use_od" = y ]
-  then
-    log=$(eval "cat $log_file|tr -d '\r' $unique|od -x")
-    msg="job '$job_name' failed to log correct data\n"
-    msg="${msg}\texpected hex: '$expected_output'\n"
-    msg="${msg}\tgot         : '$log'"
-    [ "$expected_output" != "$log" ] && TEST_FAILED "$msg"
-  else
-    log=$(eval "cat $log_file|tr -d '\r' $unique")
-    msg="job '$job_name' failed to log correct data\n"
-    msg="${msg}\texpected text: '$expected_output'\n"
-    msg="${msg}\tgot          : '$log'"
-    [ "$expected_output" != "$log" ] && TEST_FAILED "$msg"
-  fi
-
-  if [ "$retain" = n ]
-  then
-    delete_job "$job_name"
-    rm "$log_file" || TEST_FAILED "unable to remove log file '$log_file'"
-  fi
-}
-
-test_ensure_no_unexpected_output()
-{
-  #---------------------------------------------------------------------
-  feature="ensure command job does not create log file with no console"
-  TEST_FEATURE "$feature"
-
-  job_name=$(make_job_name "$feature")
-
-  script="\
-    console none
-    exec echo hello world"
-
-  ensure_no_output "$job_name" "$script" ""
-
-  #---------------------------------------------------------------------
-  feature="ensure 1-line script job does not create log file with no console"
-  TEST_FEATURE "$feature"
-
-  job_name=$(make_job_name "$feature")
-
-  script="\
-    console none
-    script
-      echo hello world
-    end script
-  "
-
-  ensure_no_output "$job_name" "$script" ""
-
-  #---------------------------------------------------------------------
-  feature="ensure multi-line script job does not create log file with no console"
-  TEST_FEATURE "$feature"
-
-  job_name=$(make_job_name "$feature")
-
-  script="\
-    console none
-    script
-      /bin/true
-      echo hello world
-    end script
-  "
-
-  ensure_no_output "$job_name" "$script" ""
-
-  #---------------------------------------------------------------------
-  feature="ensure no output if log directory does not exist"
-  TEST_FEATURE "$feature"
-
-  rmdir "${user_log_dir}" || \
-    TEST_FAILED "unable to delete log directory '$user_log_dir'"
-
-  job_name=$(make_job_name "$feature")
-  string="hello world"
-  script="\
-    console log
-    script
-      /bin/true
-      /bin/echo hello world
-    end script
-  "
-
-  ensure_no_output "$job_name" "$script" ""
-
-  mkdir "${user_log_dir}" || \
-    TEST_FAILED "unable to recreate log directory '$user_log_dir'"
-
-  #---------------------------------------------------------------------
-  feature="ensure command job does not create log file with invalid command"
-  TEST_FEATURE "$feature"
-
-  job_name=$(make_job_name "$feature")
-
-  script="\
-    console log
-    exec /this/command/does/not/exist"
-
-  job="${test_dir_suffix}/${job_name}"
-  create_job "$job_name" "$script"
-  start_job "$job" "$job_name" "" 1
-  check_job_output "$job_name"
-  delete_job "$job_name"
-}
-
-test_output_logged()
-{
-  # XXX: upstart won't create this
-  mkdir -p "$user_log_dir"
-
-  test_ensure_no_unexpected_output
-}
-
-test_user_jobs()
-{
-  test_user_job_binary
-  test_user_job_single_line_script
-  test_user_job_multi_line_script
-
-  test_user_job_binary_task
-  test_user_job_single_line_script_task
-  test_user_job_multi_line_script_task
-
-  test_user_job_setuid_setgid
-
-  test_user_emit_events
-
-  test_output_logged
-}
-
-tests()
-{
-  echo
-  echo -n "Running Upstart user session tests as user '`whoami`'"
-  echo " (uid $uid, gid $gid) in directory '$test_dir'"
-  echo
-
-  test_user_jobs
-
-  echo
-  echo "All tests completed successfully"
-  echo
-}
-
-usage()
-{
-cat <<EOT
-USAGE: $script_name [options]
-
-OPTIONS:
-
- -a        : Actually run this script.
- -h        : Show this help.
- -u <user> : Specify name of test user to create.
-
-DESCRIPTION:
-
-Run simple set of Upstart user session tests.
-
-PREREQUISITE:
-
-For this test to run, non-root users must be allowed to invoke all D-Bus
-methods on Upstart via configuration file:
-
-  /etc/dbus-1/system.d/Upstart.conf 
-
-See dbus-daemon(1) for further details.
-
-WARNING: Note that this script is unavoidably invasive, so read what
-WARNING: follows before running!
-
-If run as a non-root user, this script will create a uniquely-named
-subdirectory below "\$HOME/.init/" to run its tests in. On successful
-completion of these tests, the unique subdirectory and its contents will
-be removed.
-
-If however, this script is invoked as the root user, the script will
-refuse to run until given the name of a test user to create via the "-u"
-option. If the user specified to this option already exists, this script
-will exit with an error. If the user does not already exist, it will be
-created, the script then run *as that user* and assuming successful
-completion of the tests, the test user and their home directory will
-then be deleted.
-
-EOT
-}
-
-#---------------------------------------------------------------------
-# main
-#---------------------------------------------------------------------
-
-while getopts "dhu:" opt
-do
-  case "$opt" in
-    d)
-      debug_enabled=1
-    ;;
-
-    h)
-      usage
-      exit 0
-    ;;
-
-    u)
-      user_to_create="$OPTARG"
-    ;;
-  esac
-done
-
-setup
-tests
-cleanup
-exit 0