verify: ignore nonexistent executables if required

We provide a way via the '-' symbol to ignore errors when nonexistent
executable files are passed to Exec* parameters & so on. In such a case,
the flag `EXEC_COMMAND_IGNORE_FAILURE` is set and we go on happily with
our life if that happens. However, `systemd-analyze verify` complained
about missing executables even in such a case. In such a case it is not
an error for this to happen so check if the flag is set before checking
if the file is accessible and executable.

Add some small tests to check this condition.

Closes #15218.

meson_options.txt

@@ -354,3 +354,5 @@ option('oss-fuzz', type : 'boolean', value : 'false',
        description : 'build against oss-fuzz')
 option('llvm-fuzz', type : 'boolean', value : 'false',
        description : 'build against LLVM libFuzzer')
+option('kernel-install', type: 'boolean', value: 'true',
+       description : 'include kernel-install feature')

src/analyze/analyze-verify.c

@@ -124,10 +124,13 @@ static int verify_socket(Unit *u) {
         return 0;
 }
 
-static int verify_executable(Unit *u, ExecCommand *exec) {
+int verify_executable(Unit *u, const ExecCommand *exec) {
         if (!exec)
                 return 0;
 
+        if (exec->flags & EXEC_COMMAND_IGNORE_FAILURE)
+                return 0;
+
         if (access(exec->path, X_OK) < 0)
                 return log_unit_error_errno(u, errno, "Command %s is not executable: %m", exec->path);
 

src/analyze/analyze-verify.h

@@ -3,6 +3,8 @@
 
 #include <stdbool.h>
 
+#include "execute.h"
 #include "path-lookup.h"
 
+int verify_executable(Unit *u, const ExecCommand *exec);
 int verify_units(char **filenames, UnitFileScope scope, bool check_man, bool run_generators);

src/analyze/test-verify.c

@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: LGPL-2.1+ */
+#include "analyze-verify.h"
+#include "tests.h"
+
+static void test_verify_nonexistent(void) {
+        /* Negative cases */
+        assert_se(verify_executable(NULL, &(ExecCommand) {.flags = EXEC_COMMAND_IGNORE_FAILURE, .path = (char*) "/non/existent"}) == 0);
+        assert_se(verify_executable(NULL, &(ExecCommand) {.path = (char*) "/non/existent"}) < 0);
+
+        /* Ordinary cases */
+        assert_se(verify_executable(NULL, &(ExecCommand) {.path = (char*) "/bin/echo"}) == 0);
+        assert_se(verify_executable(NULL, &(ExecCommand) {.flags = EXEC_COMMAND_IGNORE_FAILURE, .path = (char*) "/bin/echo"}) == 0);
+}
+
+int main(int argc, char *argv[]) {
+        test_setup_logging(LOG_DEBUG);
+
+        test_verify_nonexistent();
+}

src/kernel-install/meson.build

@@ -1,14 +1,18 @@
 # SPDX-License-Identifier: LGPL-2.1+
 
-install_data('kernel-install',
-             install_mode : 'rwxr-xr-x',
-             install_dir : bindir)
+want_kernel_install = get_option('kernel-install')
 
-install_data('00-entry-directory.install',
-             '50-depmod.install',
-             '90-loaderentry.install',
-             install_mode : 'rwxr-xr-x',
-             install_dir : kernelinstalldir)
+if want_kernel_install
+	install_data('kernel-install',
+		install_mode : 'rwxr-xr-x',
+		install_dir : bindir)
 
-meson.add_install_script('sh', '-c',
-                         mkdir_p.format(join_paths(sysconfdir, 'kernel/install.d')))
+	install_data('00-entry-directory.install',
+		'50-depmod.install',
+		'90-loaderentry.install',
+		install_mode : 'rwxr-xr-x',
+		install_dir : kernelinstalldir)
+
+	meson.add_install_script('sh', '-c',
+				mkdir_p.format(join_paths(sysconfdir, 'kernel/install.d')))
+endif

src/test/meson.build

@@ -1127,6 +1127,10 @@ tests += [
          [],
          []],
 
+        [['src/analyze/test-verify.c', 'src/analyze/analyze-verify.c', 'src/analyze/analyze-verify.h'],
+         [libcore, libshared],
+         []],
+
         [['src/login/test-inhibit.c'],
          [],
          [],