3 # Run select tests by setting ONLY, or as arguments to the script.
4 # Skip specific tests by setting EXCEPT.
10 # bug number for skipped test: 19430 19967 19967
11 ALWAYS_EXCEPT=" 2 5 6 $SANITY_SEC_EXCEPT"
12 # UPDATE THE COMMENT ABOVE WITH BUG NUMBERS WHEN CHANGING ALWAYS_EXCEPT!
14 [ "$ALWAYS_EXCEPT$EXCEPT" ] && \
15 echo "Skipping tests: $ALWAYS_EXCEPT $EXCEPT"
18 export PATH=$PWD/$SRCDIR:$SRCDIR:$PWD/$SRCDIR/../utils:$PATH:/sbin
19 export NAME=${NAME:-local}
21 LUSTRE=${LUSTRE:-$(dirname $0)/..}
22 . $LUSTRE/tests/test-framework.sh
24 . ${CONFIG:=$LUSTRE/tests/cfg/$NAME.sh}
27 RUNAS_CMD=${RUNAS_CMD:-runas}
29 WTL=${WTL:-"$LUSTRE/tests/write_time_limit"}
32 PERM_CONF=$CONFDIR/perm.conf
35 HOSTNAME_CHECKSUM=$(hostname | sum | awk '{ print $1 }')
36 SUBNET_CHECKSUM=$(expr $HOSTNAME_CHECKSUM % 250 + 1)
39 NODEMAP_IPADDR_LIST="1 10 64 128 200 250"
42 require_dsh_mds || exit 0
43 require_dsh_ost || exit 0
45 clients=${CLIENTS//,/ }
46 num_clients=$(get_node_count ${clients})
47 clients_arr=($clients)
51 USER0=$(grep :$ID0:$ID0: /etc/passwd | cut -d: -f1)
52 USER1=$(grep :$ID1:$ID1: /etc/passwd | cut -d: -f1)
55 skip "need to add user0 ($ID0:$ID0) to /etc/passwd" && exit 0
58 skip "need to add user1 ($ID1:$ID1) to /etc/passwd" && exit 0
60 IDBASE=${IDBASE:-60000}
62 # changes to mappings must be reflected in test 23
64 [0]="$((IDBASE+3)):$((IDBASE+0)) $((IDBASE+4)):$((IDBASE+2))"
65 [1]="$((IDBASE+5)):$((IDBASE+1)) $((IDBASE+6)):$((IDBASE+2))"
68 check_and_setup_lustre
71 if [ "$I_MOUNTED" = "yes" ]; then
72 cleanupall -f || error "sec_cleanup"
77 [ -z "`echo $DIR | grep $MOUNT`" ] && \
78 error "$DIR not in $MOUNT" && sec_cleanup && exit 1
80 [ `echo $MOUNT | wc -w` -gt 1 ] && \
81 echo "NAME=$MOUNT mounted more than once" && sec_cleanup && exit 0
84 GSS_REF=$(lsmod | grep ^ptlrpc_gss | awk '{print $3}')
85 if [ ! -z "$GSS_REF" -a "$GSS_REF" != "0" ]; then
87 echo "with GSS support"
90 echo "without GSS support"
93 MDT=$(do_facet $SINGLEMDS lctl get_param -N "mdt.\*MDT0000" |
95 [ -z "$MDT" ] && error "fail to get MDT device" && exit 1
96 do_facet $SINGLEMDS "mkdir -p $CONFDIR"
97 IDENTITY_FLUSH=mdt.$MDT.identity_flush
98 IDENTITY_UPCALL=mdt.$MDT.identity_upcall
100 CAPA_TIMEOUT=mdt.$MDT.capa_timeout
101 MDSSECLEVEL=mdt.$MDT.sec_level
104 if [ -z "$(lctl get_param -n llite.*.client_type | grep remote 2>/dev/null)" ]
121 if ! $RUNAS_CMD -u $user krb5_login.sh; then
122 error "$user login kerberos failed."
126 if ! $RUNAS_CMD -u $user -g $group ls $DIR > /dev/null 2>&1; then
127 $RUNAS_CMD -u $user lfs flushctx -k
128 $RUNAS_CMD -u $user krb5_login.sh
129 if ! $RUNAS_CMD -u$user -g$group ls $DIR > /dev/null 2>&1; then
130 error "init $user $group failed."
136 declare -a identity_old
139 for num in `seq $MDSCOUNT`; do
140 switch_identity $num true || identity_old[$num]=$?
143 if ! $RUNAS_CMD -u $ID0 ls $DIR > /dev/null 2>&1; then
144 sec_login $USER0 $USER0
147 if ! $RUNAS_CMD -u $ID1 ls $DIR > /dev/null 2>&1; then
148 sec_login $USER1 $USER1
153 # run as different user
157 chmod 0755 $DIR || error "chmod (1)"
158 rm -rf $DIR/$tdir || error "rm (1)"
159 mkdir -p $DIR/$tdir || error "mkdir (1)"
161 if [ "$CLIENT_TYPE" = "remote" ]; then
162 do_facet $SINGLEMDS "echo '* 0 normtown' > $PERM_CONF"
163 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
164 chown $USER0 $DIR/$tdir && error "chown (1)"
165 do_facet $SINGLEMDS "echo '* 0 rmtown' > $PERM_CONF"
166 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
168 chown $USER0 $DIR/$tdir || error "chown (2)"
171 $RUNAS_CMD -u $ID0 ls $DIR || error "ls (1)"
172 rm -f $DIR/f0 || error "rm (2)"
173 $RUNAS_CMD -u $ID0 touch $DIR/f0 && error "touch (1)"
174 $RUNAS_CMD -u $ID0 touch $DIR/$tdir/f1 || error "touch (2)"
175 $RUNAS_CMD -u $ID1 touch $DIR/$tdir/f2 && error "touch (3)"
176 touch $DIR/$tdir/f3 || error "touch (4)"
177 chown root $DIR/$tdir || error "chown (3)"
178 chgrp $USER0 $DIR/$tdir || error "chgrp (1)"
179 chmod 0775 $DIR/$tdir || error "chmod (2)"
180 $RUNAS_CMD -u $ID0 touch $DIR/$tdir/f4 || error "touch (5)"
181 $RUNAS_CMD -u $ID1 touch $DIR/$tdir/f5 && error "touch (6)"
182 touch $DIR/$tdir/f6 || error "touch (7)"
183 rm -rf $DIR/$tdir || error "rm (3)"
185 if [ "$CLIENT_TYPE" = "remote" ]; then
186 do_facet $SINGLEMDS "rm -f $PERM_CONF"
187 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
190 run_test 0 "uid permission ============================="
194 [ $GSS_SUP = 0 ] && skip "without GSS support." && return
196 if [ "$CLIENT_TYPE" = "remote" ]; then
197 do_facet $SINGLEMDS "echo '* 0 rmtown' > $PERM_CONF"
198 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
204 chown $USER0 $DIR/$tdir || error "chown (1)"
205 $RUNAS_CMD -u $ID1 -v $ID0 touch $DIR/$tdir/f0 && error "touch (2)"
206 echo "enable uid $ID1 setuid"
207 do_facet $SINGLEMDS "echo '* $ID1 setuid' >> $PERM_CONF"
208 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
209 $RUNAS_CMD -u $ID1 -v $ID0 touch $DIR/$tdir/f1 || error "touch (3)"
211 chown root $DIR/$tdir || error "chown (4)"
212 chgrp $USER0 $DIR/$tdir || error "chgrp (5)"
213 chmod 0770 $DIR/$tdir || error "chmod (6)"
214 $RUNAS_CMD -u $ID1 -g $ID1 touch $DIR/$tdir/f2 && error "touch (7)"
215 $RUNAS_CMD -u$ID1 -g$ID1 -j$ID0 touch $DIR/$tdir/f3 && error "touch (8)"
216 echo "enable uid $ID1 setuid,setgid"
217 do_facet $SINGLEMDS "echo '* $ID1 setuid,setgid' > $PERM_CONF"
218 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
219 $RUNAS_CMD -u $ID1 -g $ID1 -j $ID0 touch $DIR/$tdir/f4 ||
221 $RUNAS_CMD -u $ID1 -v $ID0 -g $ID1 -j $ID0 touch $DIR/$tdir/f5 ||
226 do_facet $SINGLEMDS "rm -f $PERM_CONF"
227 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
229 run_test 1 "setuid/gid ============================="
231 run_rmtacl_subtest() {
232 $SAVE_PWD/rmtacl/run $SAVE_PWD/rmtacl/$1.test
237 # for remote client only
239 [ "$CLIENT_TYPE" = "local" ] && \
240 skip "remote_acl for remote client only" && return
241 [ -z "$(lctl get_param -n mdc.*-mdc-*.connect_flags | grep ^acl)" ] && \
242 skip "must have acl enabled" && return
243 [ -z "$(which setfacl 2>/dev/null)" ] && \
244 skip "could not find setfacl" && return
245 [ "$UID" != 0 ] && skip "must run as root" && return
247 do_facet $SINGLEMDS "echo '* 0 rmtacl,rmtown' > $PERM_CONF"
248 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
252 sec_login daemon daemon
253 sec_login games users
259 echo "performing cp ..."
260 run_rmtacl_subtest cp || error "cp"
261 echo "performing getfacl-noacl..."
262 run_rmtacl_subtest getfacl-noacl || error "getfacl-noacl"
263 echo "performing misc..."
264 run_rmtacl_subtest misc || error "misc"
265 echo "performing permissions..."
266 run_rmtacl_subtest permissions || error "permissions"
267 echo "performing setfacl..."
268 run_rmtacl_subtest setfacl || error "setfacl"
270 # inheritance test got from HP
271 echo "performing inheritance..."
272 cp $SAVE_PWD/rmtacl/make-tree .
274 run_rmtacl_subtest inheritance || error "inheritance"
280 do_facet $SINGLEMDS "rm -f $PERM_CONF"
281 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
283 run_test 2 "rmtacl ============================="
286 # root_squash will be redesigned in Lustre 1.7
288 skip "root_squash will be redesigned in Lustre 1.7" && return
290 run_test 3 "rootsquash ============================="
292 # bug 3285 - supplementary group should always succeed.
293 # NB: the supplementary groups are set for local client only,
294 # as for remote client, the groups of the specified uid on MDT
295 # will be obtained by upcall /sbin/l_getidentity and used.
297 if [ "$CLIENT_TYPE" = "remote" ]; then
298 do_facet $SINGLEMDS "echo '* 0 rmtown' > $PERM_CONF"
299 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
304 chmod 0771 $DIR/$tdir
305 chgrp $ID0 $DIR/$tdir
306 $RUNAS_CMD -u $ID0 ls $DIR/$tdir || error "setgroups (1)"
307 if [ "$CLIENT_TYPE" = "local" ]; then
308 do_facet $SINGLEMDS "echo '* $ID1 setgrp' > $PERM_CONF"
309 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
310 $RUNAS_CMD -u $ID1 -G1,2,$ID0 ls $DIR/$tdir ||
311 error "setgroups (2)"
313 $RUNAS_CMD -u $ID1 -G1,2 ls $DIR/$tdir && error "setgroups (3)"
316 do_facet $SINGLEMDS "rm -f $PERM_CONF"
317 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
319 run_test 4 "set supplementary group ==============="
321 mds_capability_timeout() {
322 [ $# -lt 1 ] && echo "Miss mds capability timeout value" && return 1
324 echo "Set mds capability timeout as $1 seconds"
325 do_facet $SINGLEMDS "lctl set_param -n $CAPA_TIMEOUT=$1"
329 mds_sec_level_switch() {
330 [ $# -lt 1 ] && echo "Miss mds sec level switch value" && return 1
333 0) echo "Disable capa for all clients";;
334 1) echo "Enable capa for remote client";;
335 3) echo "Enable capa for all clients";;
336 *) echo "Invalid mds sec level switch value" && return 2;;
339 do_facet $SINGLEMDS "lctl set_param -n $MDSSECLEVEL=$1"
343 oss_sec_level_switch() {
344 [ $# -lt 1 ] && echo "Miss oss sec level switch value" && return 1
347 0) echo "Disable capa for all clients";;
348 1) echo "Enable capa for remote client";;
349 3) echo "Enable capa for all clients";;
350 *) echo "Invalid oss sec level switch value" && return 2;;
353 for i in `seq $OSTCOUNT`; do
354 local j=`expr $i - 1`
355 local OST="`do_facet ost$i "lctl get_param -N obdfilter.\*OST\*$j/stats 2>/dev/null | cut -d"." -f2" || true`"
356 [ -z "$OST" ] && return 3
357 do_facet ost$i "lctl set_param -n obdfilter.$OST.sec_level=$1"
362 mds_capability_switch() {
363 [ $# -lt 1 ] && echo "Miss mds capability switch value" && return 1
366 0) echo "Turn off mds capability";;
367 3) echo "Turn on mds capability";;
368 *) echo "Invalid mds capability switch value" && return 2;;
371 do_facet $SINGLEMDS "lctl set_param -n $MDSCAPA=$1"
375 oss_capability_switch() {
376 [ $# -lt 1 ] && echo "Miss oss capability switch value" && return 1
379 0) echo "Turn off oss capability";;
380 1) echo "Turn on oss capability";;
381 *) echo "Invalid oss capability switch value" && return 2;;
384 for i in `seq $OSTCOUNT`; do
385 local j=`expr $i - 1`
386 local OST="`do_facet ost$i "lctl get_param -N obdfilter.\*OST\*$j/stats 2>/dev/null | cut -d"." -f2" || true`"
387 [ -z "$OST" ] && return 3
388 do_facet ost$i "lctl set_param -n obdfilter.$OST.capa=$1"
394 mds_capability_switch 3 || return 1
395 mds_sec_level_switch 3 || return 2
400 oss_capability_switch 1 || return 1
401 oss_sec_level_switch 3 || return 2
405 turn_capability_on() {
406 local capa_timeout=${1:-"1800"}
408 # To turn on fid capability for the system,
409 # there is a requirement that fid capability
410 # is turned on on all MDS/OSS servers before
413 turn_mds_capa_on || return 1
414 turn_oss_capa_on || return 2
415 mds_capability_timeout $capa_timeout || return 3
416 remount_client $MOUNT || return 4
420 turn_mds_capa_off() {
421 mds_sec_level_switch 0 || return 1
422 mds_capability_switch 0 || return 2
426 turn_oss_capa_off() {
427 oss_sec_level_switch 0 || return 1
428 oss_capability_switch 0 || return 2
432 turn_capability_off() {
433 # to turn off fid capability, you can just do
434 # it in a live system. But, please turn off
435 # capability of all OSS servers before MDS servers.
437 turn_oss_capa_off || return 1
438 turn_mds_capa_off || return 2
442 # We demonstrate that access to the objects in the filesystem are not
443 # accessible without supplying secrets from the MDS by disabling a
444 # proc variable on the mds so that it does not supply secrets. We then
445 # try and access objects which result in failure.
449 [ $GSS_SUP = 0 ] && skip "without GSS support." && return
450 if ! remote_mds; then
451 skip "client should be separated from server."
459 error "turn_capability_off"
465 error "turn_oss_capa_on"
469 if [ "$CLIENT_TYPE" = "remote" ]; then
470 remount_client $MOUNT && return 3
474 remount_client $MOUNT || return 4
477 # proc variable disabled -- access to the objects in the filesystem
479 echo "Should get Write error here : (proc variable are disabled "\
480 "-- access to the objects in the filesystem is denied."
483 error "Write worked well even though secrets not supplied."
489 error "turn_capability_on"
495 # proc variable enabled, secrets supplied -- write should work now
496 echo "Should not fail here : (proc variable enabled, secrets supplied "\
497 "-- write should work now)."
500 error "Write failed even though secrets supplied."
506 error "turn_capability_off"
511 run_test 5 "capa secrets ========================="
513 # Expiry: A test program is performing I/O on a file. It has credential
514 # with an expiry half a minute later. While the program is running the
515 # credentials expire and no automatic extensions or renewals are
516 # enabled. The program will demonstrate an I/O failure.
520 [ $GSS_SUP = 0 ] && skip "without GSS support." && return
521 if ! remote_mds; then
522 skip "client should be separated from server."
528 error "turn_capability_off"
534 turn_capability_on 30
536 error "turn_capability_on 30"
543 error "$WTL $file 60"
547 # Reset MDS capability timeout
548 mds_capability_timeout 30
550 error "mds_capability_timeout 30"
558 # To disable automatic renew, only need turn capa off on MDS.
561 error "turn_mds_capa_off"
565 echo "We expect I/O failure."
568 echo "no I/O failure got."
574 error "turn_capability_off"
579 run_test 6 "capa expiry ========================="
586 squash_id default 99 0
587 squash_id default 99 1
588 for (( i = 0; i < NODEMAP_COUNT; i++ )); do
589 if ! do_facet mgs $LCTL nodemap_add \
590 ${HOSTNAME_CHECKSUM}_${i}; then
593 out=$(do_facet mgs $LCTL get_param \
594 nodemap.${HOSTNAME_CHECKSUM}_${i}.id)
595 ## This needs to return zero if the following statement is 1
596 rc=$(echo $out | grep -c ${HOSTNAME_CHECKSUM}_${i})
597 [[ $rc == 0 ]] && return 1
607 for ((i = 0; i < NODEMAP_COUNT; i++)); do
608 if ! do_facet mgs $LCTL nodemap_del \
609 ${HOSTNAME_CHECKSUM}_${i}; then
610 error "nodemap_del ${HOSTNAME_CHECKSUM}_${i} \
614 out=$(do_facet mgs $LCTL get_param \
615 nodemap.${HOSTNAME_CHECKSUM}_${i}.id)
616 rc=$(echo $out | grep -c ${HOSTNAME_CHECKSUM}_${i})
617 [[ $rc != 0 ]] && return 1
624 local cmd="$LCTL nodemap_add_range"
628 for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
629 range="$SUBNET_CHECKSUM.${2}.${j}.[1-253]@tcp"
630 if ! do_facet mgs $cmd --name $1 \
640 local cmd="$LCTL nodemap_del_range"
644 for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
645 range="$SUBNET_CHECKSUM.${2}.${j}.[1-253]@tcp"
646 if ! do_facet mgs $cmd --name $1 \
660 local cmd="$LCTL nodemap_add_idmap"
663 for ((i = 0; i < NODEMAP_COUNT; i++)); do
664 for ((j = 500; j < NODEMAP_MAX_ID; j++)); do
667 if ! do_facet mgs $cmd \
668 --name ${HOSTNAME_CHECKSUM}_${i} \
669 --idtype uid --idmap $client_id:$fs_id; then
672 if ! do_facet mgs $cmd \
673 --name ${HOSTNAME_CHECKSUM}_${i} \
674 --idtype gid --idmap $client_id:$fs_id; then
688 local cmd="$LCTL nodemap_del_idmap"
691 for ((i = 0; i < NODEMAP_COUNT; i++)); do
692 for ((j = 500; j < NODEMAP_MAX_ID; j++)); do
695 if ! do_facet mgs $cmd \
696 --name ${HOSTNAME_CHECKSUM}_${i} \
697 --idtype uid --idmap $client_id:$fs_id; then
700 if ! do_facet mgs $cmd \
701 --name ${HOSTNAME_CHECKSUM}_${i} \
702 --idtype gid --idmap $client_id:$fs_id; then
715 local cmd="$LCTL nodemap_modify"
718 proc[0]="admin_nodemap"
719 proc[1]="trusted_nodemap"
723 for ((idx = 0; idx < 2; idx++)); do
724 if ! do_facet mgs $cmd --name $1 \
725 --property ${option[$idx]} \
730 if ! do_facet mgs $cmd --name $1 \
731 --property ${option[$idx]} \
743 cmd[0]="$LCTL nodemap_modify --property squash_uid"
744 cmd[1]="$LCTL nodemap_modify --property squash_gid"
746 if ! do_facet mgs ${cmd[$3]} --name $1 --value $2; then
751 # ensure that the squash defaults are the expected defaults
752 squash_id default 99 0
753 squash_id default 99 1
758 cmd="$LCTL nodemap_test_nid"
760 nid=$(do_facet mgs $cmd $1)
762 if [ $nid == $2 ]; then
773 local cmd="$LCTL nodemap_test_id"
776 ## nodemap deactivated
777 if ! do_facet mgs lctl nodemap_activate 0; then
780 for ((id = 500; id < NODEMAP_MAX_ID; id++)); do
781 for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
782 nid="$SUBNET_CHECKSUM.0.${j}.100@tcp"
783 fs_id=$(do_facet mgs $cmd --nid $nid \
784 --idtype uid --id $id)
785 if [ $fs_id != $id ]; then
786 echo "expected $id, got $fs_id"
793 if ! do_facet mgs lctl nodemap_activate 1; then
797 for ((id = 500; id < NODEMAP_MAX_ID; id++)); do
798 for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
799 nid="$SUBNET_CHECKSUM.0.${j}.100@tcp"
800 fs_id=$(do_facet mgs $cmd --nid $nid \
801 --idtype uid --id $id)
802 expected_id=$((id + 1))
803 if [ $fs_id != $expected_id ]; then
804 echo "expected $expected_id, got $fs_id"
811 for ((i = 0; i < NODEMAP_COUNT; i++)); do
812 if ! do_facet mgs $LCTL nodemap_modify \
813 --name ${HOSTNAME_CHECKSUM}_${i} \
814 --property trusted --value 1; then
815 error "nodemap_modify ${HOSTNAME_CHECKSUM}_${i} "
821 for ((id = 500; id < NODEMAP_MAX_ID; id++)); do
822 for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
823 nid="$SUBNET_CHECKSUM.0.${j}.100@tcp"
824 fs_id=$(do_facet mgs $cmd --nid $nid \
825 --idtype uid --id $id)
826 if [ $fs_id != $id ]; then
827 echo "expected $id, got $fs_id"
833 ## ensure allow_root_access is enabled
834 for ((i = 0; i < NODEMAP_COUNT; i++)); do
835 if ! do_facet mgs $LCTL nodemap_modify \
836 --name ${HOSTNAME_CHECKSUM}_${i} \
837 --property admin --value 1; then
838 error "nodemap_modify ${HOSTNAME_CHECKSUM}_${i} "
844 ## check that root allowed
845 for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
846 nid="$SUBNET_CHECKSUM.0.${j}.100@tcp"
847 fs_id=$(do_facet mgs $cmd --nid $nid --idtype uid --id 0)
848 if [ $fs_id != 0 ]; then
849 echo "root allowed expected 0, got $fs_id"
854 ## ensure allow_root_access is disabled
855 for ((i = 0; i < NODEMAP_COUNT; i++)); do
856 if ! do_facet mgs $LCTL nodemap_modify \
857 --name ${HOSTNAME_CHECKSUM}_${i} \
858 --property admin --value 0; then
859 error "nodemap_modify ${HOSTNAME_CHECKSUM}_${i} "
865 ## check that root is mapped to 99
866 for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
867 nid="$SUBNET_CHECKSUM.0.${j}.100@tcp"
868 fs_id=$(do_facet mgs $cmd --nid $nid --idtype uid --id 0)
869 if [ $fs_id != 99 ]; then
870 error "root squash expected 99, got $fs_id"
875 ## reset client trust to 0
876 for ((i = 0; i < NODEMAP_COUNT; i++)); do
877 if ! do_facet mgs $LCTL nodemap_modify \
878 --name ${HOSTNAME_CHECKSUM}_${i} \
879 --property trusted --value 0; then
880 error "nodemap_modify ${HOSTNAME_CHECKSUM}_${i} "
892 remote_mgs_nodsh && skip "remote MGS with nodsh" && return
893 [ $(lustre_version_code $SINGLEMGS) -lt $(version_code 2.5.53) ] &&
894 skip "No nodemap on $(get_lustre_version) MGS, need 2.5.53+" &&
899 [[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 1
903 [[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 2
907 run_test 7 "nodemap create and delete"
912 remote_mgs_nodsh && skip "remote MGS with nodsh" && return
913 [ $(lustre_version_code $SINGLEMGS) -lt $(version_code 2.5.53) ] &&
914 skip "No nodemap on $(get_lustre_version) MGS, need 2.5.53+" &&
921 [[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 1
927 [[ $rc == 0 ]] && error "duplicate nodemap_add allowed with $rc" &&
933 [[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 3
937 run_test 8 "nodemap reject duplicates"
943 remote_mgs_nodsh && skip "remote MGS with nodsh" && return
944 [ $(lustre_version_code $SINGLEMGS) -lt $(version_code 2.5.53) ] &&
945 skip "No nodemap on $(get_lustre_version) MGS, need 2.5.53+" &&
951 [[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 1
954 for ((i = 0; i < NODEMAP_COUNT; i++)); do
955 if ! add_range ${HOSTNAME_CHECKSUM}_${i} $i; then
959 [[ $rc != 0 ]] && error "nodemap_add_range failed with $rc" && return 2
962 for ((i = 0; i < NODEMAP_COUNT; i++)); do
963 if ! delete_range ${HOSTNAME_CHECKSUM}_${i} $i; then
967 [[ $rc != 0 ]] && error "nodemap_del_range failed with $rc" && return 4
972 [[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 4
976 run_test 9 "nodemap range add"
981 remote_mgs_nodsh && skip "remote MGS with nodsh" && return
982 [ $(lustre_version_code $SINGLEMGS) -lt $(version_code 2.5.53) ] &&
983 skip "No nodemap on $(get_lustre_version) MGS, need 2.5.53+" &&
989 [[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 1
992 for ((i = 0; i < NODEMAP_COUNT; i++)); do
993 if ! add_range ${HOSTNAME_CHECKSUM}_${i} $i; then
997 [[ $rc != 0 ]] && error "nodemap_add_range failed with $rc" && return 2
1000 for ((i = 0; i < NODEMAP_COUNT; i++)); do
1001 if ! add_range ${HOSTNAME_CHECKSUM}_${i} $i; then
1005 [[ $rc == 0 ]] && error "nodemap_add_range duplicate add with $rc" &&
1010 for ((i = 0; i < NODEMAP_COUNT; i++)); do
1011 if ! delete_range ${HOSTNAME_CHECKSUM}_${i} $i; then
1015 [[ $rc != 0 ]] && error "nodemap_del_range failed with $rc" && return 4
1019 [[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 5
1023 run_test 10 "nodemap reject duplicate ranges"
1028 remote_mgs_nodsh && skip "remote MGS with nodsh" && return
1029 [ $(lustre_version_code $SINGLEMGS) -lt $(version_code 2.5.53) ] &&
1030 skip "No nodemap on $(get_lustre_version) MGS, need 2.5.53+" &&
1036 [[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 1
1039 for ((i = 0; i < NODEMAP_COUNT; i++)); do
1040 if ! modify_flags ${HOSTNAME_CHECKSUM}_${i}; then
1044 [[ $rc != 0 ]] && error "nodemap_modify with $rc" && return 2
1049 [[ $rc != 0 ]] && error "nodemap_del failed with $rc" && return 3
1053 run_test 11 "nodemap modify"
1058 remote_mgs_nodsh && skip "remote MGS with nodsh" && return
1059 [ $(lustre_version_code $SINGLEMGS) -lt $(version_code 2.5.53) ] &&
1060 skip "No nodemap on $(get_lustre_version) MGS, need 2.5.53+" &&
1066 [[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 1
1069 for ((i = 0; i < NODEMAP_COUNT; i++)); do
1070 if ! squash_id ${HOSTNAME_CHECKSUM}_${i} 88 0; then
1074 [[ $rc != 0 ]] && error "nodemap squash_uid with $rc" && return 2
1077 for ((i = 0; i < NODEMAP_COUNT; i++)); do
1078 if ! squash_id ${HOSTNAME_CHECKSUM}_${i} 88 1; then
1082 [[ $rc != 0 ]] && error "nodemap squash_gid with $rc" && return 3
1087 [[ $rc != 0 ]] && error "nodemap_del failed with $rc" && return 4
1091 run_test 12 "nodemap set squash ids"
1096 remote_mgs_nodsh && skip "remote MGS with nodsh" && return
1097 [ $(lustre_version_code $SINGLEMGS) -lt $(version_code 2.5.53) ] &&
1098 skip "No nodemap on $(get_lustre_version) MGS, need 2.5.53+" &&
1104 [[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 1
1107 for ((i = 0; i < NODEMAP_COUNT; i++)); do
1108 if ! add_range ${HOSTNAME_CHECKSUM}_${i} $i; then
1112 [[ $rc != 0 ]] && error "nodemap_add_range failed with $rc" && return 2
1115 for ((i = 0; i < NODEMAP_COUNT; i++)); do
1116 for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
1117 for k in $NODEMAP_IPADDR_LIST; do
1118 if ! test_nid $SUBNET_CHECKSUM.$i.$j.$k \
1119 ${HOSTNAME_CHECKSUM}_${i}; then
1125 [[ $rc != 0 ]] && error "nodemap_test_nid failed with $rc" && return 3
1130 [[ $rc != 0 ]] && error "nodemap_del failed with $rc" && return 4
1134 run_test 13 "test nids"
1139 remote_mgs_nodsh && skip "remote MGS with nodsh" && return
1140 [ $(lustre_version_code $SINGLEMGS) -lt $(version_code 2.5.53) ] &&
1141 skip "No nodemap on $(get_lustre_version) MGS, need 2.5.53+" &&
1147 [[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 1
1150 for ((i = 0; i < NODEMAP_COUNT; i++)); do
1151 for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
1152 for k in $NODEMAP_IPADDR_LIST; do
1153 if ! test_nid $SUBNET_CHECKSUM.$i.$j.$k \
1160 [[ $rc != 0 ]] && error "nodemap_test_nid failed with $rc" && return 3
1165 [[ $rc != 0 ]] && error "nodemap_del failed with $rc" && return 4
1169 run_test 14 "test default nodemap nid lookup"
1174 remote_mgs_nodsh && skip "remote MGS with nodsh" && return
1175 [ $(lustre_version_code $SINGLEMGS) -lt $(version_code 2.5.53) ] &&
1176 skip "No nodemap on $(get_lustre_version) MGS, need 2.5.53+" &&
1182 [[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 1
1185 for ((i = 0; i < NODEMAP_COUNT; i++)); do
1186 if ! add_range ${HOSTNAME_CHECKSUM}_${i} $i; then
1190 [[ $rc != 0 ]] && error "nodemap_add_range failed with $rc" && return 2
1195 [[ $rc != 0 ]] && error "nodemap_add_idmap failed with $rc" && return 3
1200 [[ $rc != 0 ]] && error "nodemap_test_id failed with $rc" && return 4
1205 [[ $rc != 0 ]] && error "nodemap_del_idmap failed with $rc" && return 5
1210 [[ $rc != 0 ]] && error "nodemap_delete failed with $rc" && return 6
1214 run_test 15 "test id mapping"
1216 # Until nodemaps are distributed by MGS, they need to be distributed manually
1217 # This function and all calls to it should be removed once the MGS distributes
1218 # nodemaps to the MDS and OSS nodes directly.
1219 do_servers_not_mgs() {
1220 local mgs_ip=$(host_nids_address $mgs_HOST $NETTYPE)
1221 for node in $(all_server_nodes); do
1222 local node_ip=$(host_nids_address $node $NETTYPE)
1223 [ $node_ip == $mgs_ip ] && continue
1228 create_fops_nodemaps() {
1231 for client in $clients; do
1232 local client_ip=$(host_nids_address $client $NETTYPE)
1233 local client_nid=$(h2$NETTYPE $client_ip)
1234 do_facet mgs $LCTL nodemap_add c${i} || return 1
1235 do_facet mgs $LCTL nodemap_add_range \
1236 --name c${i} --range $client_nid || return 1
1237 do_servers_not_mgs $LCTL set_param nodemap.add_nodemap=c${i} ||
1239 do_servers_not_mgs "$LCTL set_param \
1240 nodemap.add_nodemap_range='c${i} $client_nid'" ||
1242 for map in ${FOPS_IDMAPS[i]}; do
1243 do_facet mgs $LCTL nodemap_add_idmap --name c${i} \
1244 --idtype uid --idmap ${map} || return 1
1245 do_servers_not_mgs "$LCTL set_param \
1246 nodemap.add_nodemap_idmap='c$i uid ${map}'" ||
1248 do_facet mgs $LCTL nodemap_add_idmap --name c${i} \
1249 --idtype gid --idmap ${map} || return 1
1250 do_servers_not_mgs "$LCTL set_param \
1251 nodemap.add_nodemap_idmap='c$i gid ${map}'" ||
1254 out1=$(do_facet mgs $LCTL get_param nodemap.c${i}.idmap)
1255 out2=$(do_facet ost0 $LCTL get_param nodemap.c${i}.idmap)
1256 [ "$out1" != "$out2" ] && error "mgs and oss maps mismatch"
1262 delete_fops_nodemaps() {
1265 for client in $clients; do
1266 do_facet mgs $LCTL nodemap_del c${i} || return 1
1267 do_servers_not_mgs $LCTL set_param nodemap.remove_nodemap=c$i ||
1276 if [ $MDSCOUNT -le 1 ]; then
1277 do_node ${clients_arr[0]} mkdir -p $DIR/$tdir
1279 # round-robin MDTs to test DNE nodemap support
1280 [ ! -d $DIR ] && do_node ${clients_arr[0]} mkdir -p $DIR
1281 do_node ${clients_arr[0]} $LFS setdirstripe -c 1 -i \
1282 $((fops_mds_index % MDSCOUNT)) $DIR/$tdir
1283 ((fops_mds_index++))
1287 # acl test directory needs to be initialized on a privileged client
1289 local admin=$(do_facet mgs $LCTL get_param -n nodemap.c0.admin_nodemap)
1290 local trust=$(do_facet mgs $LCTL get_param -n \
1291 nodemap.c0.trusted_nodemap)
1293 do_facet mgs $LCTL nodemap_modify --name c0 --property admin --value 1
1294 do_facet mgs $LCTL nodemap_modify --name c0 --property trusted --value 1
1295 do_servers_not_mgs $LCTL set_param nodemap.c0.admin_nodemap=1
1296 do_servers_not_mgs $LCTL set_param nodemap.c0.trusted_nodemap=1
1298 do_node ${clients_arr[0]} rm -rf $DIR/$tdir
1300 do_node ${clients_arr[0]} chown $user $DIR/$tdir
1302 do_facet mgs $LCTL nodemap_modify --name c0 \
1303 --property admin --value $admin
1304 do_facet mgs $LCTL nodemap_modify --name c0 \
1305 --property trusted --value $trust
1306 do_servers_not_mgs $LCTL set_param nodemap.c0.admin_nodemap=$admin
1307 do_servers_not_mgs $LCTL set_param nodemap.c0.trusted_nodemap=$trust
1309 # flush MDT locks to make sure they are reacquired before test
1310 do_node ${clients_arr[0]} lctl set_param \
1311 ldlm.namespaces.$FSNAME-MDT*.lru_size=clear
1314 do_create_delete() {
1317 local testfile=$DIR/$tdir/$tfile
1321 if $run_u touch $testfile >& /dev/null; then
1323 $run_u rm $testfile && d=1
1327 local expected=$(get_cr_del_expected $key)
1328 [ "$res" != "$expected" ] && error "test $key expected " \
1329 "$expected, got $res" && rc=$(($rc+1))
1333 nodemap_check_quota() {
1335 $run_u lfs quota -q $DIR | awk '{ print $2; exit; }'
1338 do_fops_quota_test() {
1340 # fuzz quota used to account for possible indirect blocks, etc
1341 local quota_fuzz=$(fs_log_size)
1342 local qused_orig=$(nodemap_check_quota "$run_u")
1343 local qused_high=$((qused_orig + quota_fuzz))
1344 local qused_low=$((qused_orig - quota_fuzz))
1345 local testfile=$DIR/$tdir/$tfile
1346 chmod 777 $DIR/$tdir
1347 $run_u dd if=/dev/zero of=$testfile bs=1M count=1 >& /dev/null
1348 sync; sync_all_data || true
1350 local qused_new=$(nodemap_check_quota "$run_u")
1351 [ $((qused_new)) -lt $((qused_low + 1024)) \
1352 -o $((qused_new)) -gt $((qused_high + 1024)) ] &&
1353 error "$qused_new != $qused_orig + 1M after write, \
1354 fuzz is $quota_fuzz"
1355 $run_u rm $testfile && d=1
1356 $NODEMAP_TEST_QUOTA && wait_delete_completed_mds
1358 qused_new=$(nodemap_check_quota "$run_u")
1359 [ $((qused_new)) -lt $((qused_low)) \
1360 -o $((qused_new)) -gt $((qused_high)) ] &&
1361 error "quota not reclaimed, expect $qused_orig got $qused_new, \
1365 get_fops_mapped_user() {
1368 for ((i=0; i < ${#FOPS_IDMAPS[@]}; i++)); do
1369 for map in ${FOPS_IDMAPS[i]}; do
1370 if [ $(cut -d: -f1 <<< "$map") == $cli_user ]; then
1371 cut -d: -f2 <<< "$map"
1379 get_cr_del_expected() {
1381 IFS=":" read -a key <<< "$1"
1382 local mapmode="${key[0]}"
1383 local mds_user="${key[1]}"
1384 local cluster="${key[2]}"
1385 local cli_user="${key[3]}"
1386 local mode="0${key[4]}"
1393 [[ $mapmode == *mapped* ]] && mapped=1
1394 # only c1 is mapped in these test cases
1395 [[ $mapmode == mapped_trusted* ]] && [ "$cluster" == "c0" ] && mapped=0
1396 [[ $mapmode == *noadmin* ]] && noadmin=1
1398 # o+wx works as long as the user isn't mapped
1399 if [ $((mode & 3)) -eq 3 ]; then
1403 # if client user is root, check if root is squashed
1404 if [ "$cli_user" == "0" ]; then
1405 # squash root succeed, if other bit is on
1408 1) [ "$other" == "1" ] && echo $SUCCESS
1409 [ "$other" == "0" ] && echo $FAILURE;;
1413 if [ "$mapped" == "0" ]; then
1414 [ "$other" == "1" ] && echo $SUCCESS
1415 [ "$other" == "0" ] && echo $FAILURE
1419 # if mapped user is mds user, check for u+wx
1420 mapped_user=$(get_fops_mapped_user $cli_user)
1421 [ "$mapped_user" == "-1" ] &&
1422 error "unable to find mapping for client user $cli_user"
1424 if [ "$mapped_user" == "$mds_user" -a \
1425 $(((mode & 0300) == 0300)) -eq 1 ]; then
1429 if [ "$mapped_user" != "$mds_user" -a "$other" == "1" ]; then
1438 local single_client="$2"
1439 local client_user_list=([0]="0 $((IDBASE+3)) $((IDBASE+4))"
1440 [1]="0 $((IDBASE+5)) $((IDBASE+6))")
1443 local perm_bit_list="0 3 $((0300)) $((0303))"
1444 # SLOW tests 000-007, 010-070, 100-700 (octal modes)
1445 [ "$SLOW" == "yes" ] &&
1446 perm_bit_list="0 $(seq 1 7) $(seq 8 8 63) $(seq 64 64 511) \
1449 # step through mds users. -1 means root
1450 for mds_i in -1 0 1 2; do
1451 local user=$((mds_i + IDBASE))
1455 [ "$mds_i" == "-1" ] && user=0
1457 echo mkdir -p $DIR/$tdir
1460 for client in $clients; do
1462 local admin=$(do_facet mgs $LCTL get_param -n \
1463 nodemap.c$cli_i.admin_nodemap)
1464 for u in ${client_user_list[$cli_i]}; do
1465 local run_u="do_node $client \
1466 $RUNAS_CMD -u$u -g$u -G$u"
1467 for perm_bits in $perm_bit_list; do
1468 local mode=$(printf %03o $perm_bits)
1470 key="$mapmode:$user:c$cli_i:$u:$mode"
1471 do_facet mgs $LCTL nodemap_modify \
1475 do_servers_not_mgs $LCTL set_param \
1476 nodemap.c$cli_i.admin_nodemap=1
1477 do_node $client chmod $mode $DIR/$tdir \
1478 || error unable to chmod $key
1479 do_facet mgs $LCTL nodemap_modify \
1483 do_servers_not_mgs $LCTL set_param \
1484 nodemap.c$cli_i.admin_nodemap=$admin
1486 do_create_delete "$run_u" "$key"
1490 do_fops_quota_test "$run_u"
1493 cli_i=$((cli_i + 1))
1494 [ "$single_client" == "1" ] && break
1501 nodemap_test_setup() {
1503 local active_nodemap=$1
1505 remote_mgs_nodsh && skip "remote MGS with nodsh" && return
1506 [ $(lustre_version_code $SINGLEMGS) -lt $(version_code 2.6.90) ] &&
1507 skip "Skip test on $(get_lustre_version) MGS, need 2.6.90+" &&
1510 do_nodes $(comma_list $(all_mdts_nodes)) $LCTL set_param \
1511 mdt.*.identity_upcall=NONE
1514 create_fops_nodemaps
1516 [[ $rc != 0 ]] && error "adding fops nodemaps failed $rc"
1518 if [ "$active_nodemap" == "0" ]; then
1519 do_facet mgs $LCTL set_param nodemap.active=0
1520 do_servers_not_mgs $LCTL set_param nodemap.active=0
1524 do_facet mgs $LCTL nodemap_activate 1
1525 do_servers_not_mgs $LCTL set_param nodemap.active=1
1526 do_facet mgs $LCTL nodemap_modify --name default \
1527 --property admin --value 1
1528 do_facet mgs $LCTL nodemap_modify --name default \
1529 --property trusted --value 1
1530 do_servers_not_mgs $LCTL set_param nodemap.default.admin_nodemap=1
1531 do_servers_not_mgs $LCTL set_param nodemap.default.trusted_nodemap=1
1534 nodemap_test_cleanup() {
1535 delete_fops_nodemaps
1537 [[ $rc != 0 ]] && error "removing fops nodemaps failed $rc"
1542 nodemap_clients_admin_trusted() {
1546 for client in $clients; do
1547 do_facet mgs $LCTL nodemap_modify --name c0 \
1548 --property admin --value $admin
1549 do_servers_not_mgs $LCTL set_param \
1550 nodemap.c${i}.admin_nodemap=$admin
1551 do_facet mgs $LCTL nodemap_modify --name c0 \
1552 --property trusted --value $tr
1553 do_servers_not_mgs $LCTL set_param \
1554 nodemap.c${i}.trusted_nodemap=$tr
1560 nodemap_test_setup 0
1563 nodemap_test_cleanup
1565 run_test 16 "test nodemap all_off fileops"
1570 nodemap_clients_admin_trusted 0 1
1571 test_fops trusted_noadmin 1
1572 nodemap_test_cleanup
1574 run_test 17 "test nodemap trusted_noadmin fileops"
1578 nodemap_clients_admin_trusted 0 0
1579 test_fops mapped_noadmin 1
1580 nodemap_test_cleanup
1582 run_test 18 "test nodemap mapped_noadmin fileops"
1586 nodemap_clients_admin_trusted 1 1
1587 test_fops trusted_admin 1
1588 nodemap_test_cleanup
1590 run_test 19 "test nodemap trusted_admin fileops"
1594 nodemap_clients_admin_trusted 1 0
1595 test_fops mapped_admin 1
1596 nodemap_test_cleanup
1598 run_test 20 "test nodemap mapped_admin fileops"
1604 for client in $clients; do
1605 do_facet mgs $LCTL nodemap_modify --name c${i} \
1606 --property admin --value 0
1607 do_facet mgs $LCTL nodemap_modify --name c${i} \
1608 --property trusted --value $x
1609 do_servers_not_mgs $LCTL set_param \
1610 nodemap.c${i}.admin_nodemap=0
1611 do_servers_not_mgs $LCTL set_param \
1612 nodemap.c${i}.trusted_nodemap=$x
1616 test_fops mapped_trusted_noadmin
1617 nodemap_test_cleanup
1619 run_test 21 "test nodemap mapped_trusted_noadmin fileops"
1625 for client in $clients; do
1626 do_facet mgs $LCTL nodemap_modify --name c${i} \
1627 --property admin --value 1
1628 do_facet mgs $LCTL nodemap_modify --name c${i} \
1629 --property trusted --value $x
1630 do_servers_not_mgs $LCTL set_param \
1631 nodemap.c${i}.admin_nodemap=1
1632 do_servers_not_mgs $LCTL set_param \
1633 nodemap.c${i}.trusted_nodemap=$x
1637 test_fops mapped_trusted_admin
1638 nodemap_test_cleanup
1640 run_test 22 "test nodemap mapped_trusted_admin fileops"
1642 # acl test directory needs to be initialized on a privileged client
1643 nodemap_acl_test_setup() {
1644 local admin=$(do_facet mgs $LCTL get_param -n nodemap.c0.admin_nodemap)
1645 local trust=$(do_facet mgs $LCTL get_param -n \
1646 nodemap.c0.trusted_nodemap)
1648 do_facet mgs $LCTL nodemap_modify --name c0 --property admin --value 1
1649 do_facet mgs $LCTL nodemap_modify --name c0 --property trusted --value 1
1650 do_servers_not_mgs $LCTL set_param nodemap.c0.admin_nodemap=1
1651 do_servers_not_mgs $LCTL set_param nodemap.c0.trusted_nodemap=1
1653 do_node ${clients_arr[0]} rm -rf $DIR/$tdir
1655 do_node ${clients_arr[0]} chmod a+rwx $DIR/$tdir ||
1656 error unable to chmod a+rwx test dir $DIR/$tdir
1658 do_facet mgs $LCTL nodemap_modify --name c0 \
1659 --property admin --value $admin
1660 do_facet mgs $LCTL nodemap_modify --name c0 \
1661 --property trusted --value $trust
1662 do_servers_not_mgs $LCTL set_param nodemap.c0.admin_nodemap=$admin
1663 do_servers_not_mgs $LCTL set_param nodemap.c0.trusted_nodemap=$trust
1667 # returns 0 if the number of ACLs does not change on the second (mapped) client
1668 # after being set on the first client
1669 nodemap_acl_test() {
1671 local set_client="$2"
1672 local get_client="$3"
1673 local check_setfacl="$4"
1674 local setfacl_error=0
1675 local testfile=$DIR/$tdir/$tfile
1676 local RUNAS_USER="$RUNAS_CMD -u $user"
1678 local acl_count_post=0
1680 nodemap_acl_test_setup
1683 do_node $set_client $RUNAS_USER touch $testfile
1685 # ACL masks aren't filtered by nodemap code, so we ignore them
1686 acl_count=$(do_node $get_client getfacl $testfile | grep -v mask |
1688 do_node $set_client $RUNAS_USER setfacl -m $user:rwx $testfile ||
1691 # if check setfacl is set to 1, then it's supposed to error
1692 if [ "$check_setfacl" == "1" ]; then
1693 [ "$setfacl_error" != "1" ] && return 1
1696 [ "$setfacl_error" == "1" ] && echo "WARNING: unable to setfacl"
1698 acl_count_post=$(do_node $get_client getfacl $testfile | grep -v mask |
1700 [ $acl_count -eq $acl_count_post ] && return 0
1707 # 1 trusted cluster, 1 mapped cluster
1708 local unmapped_fs=$((IDBASE+0))
1709 local unmapped_c1=$((IDBASE+5))
1710 local mapped_fs=$((IDBASE+2))
1711 local mapped_c0=$((IDBASE+4))
1712 local mapped_c1=$((IDBASE+6))
1714 do_facet mgs $LCTL nodemap_modify --name c0 --property admin --value 1
1715 do_facet mgs $LCTL nodemap_modify --name c0 --property trusted --value 1
1716 do_servers_not_mgs $LCTL set_param nodemap.c0.admin_nodemap=1
1717 do_servers_not_mgs $LCTL set_param nodemap.c0.trusted_nodemap=1
1719 do_facet mgs $LCTL nodemap_modify --name c1 --property admin --value 0
1720 do_facet mgs $LCTL nodemap_modify --name c1 --property trusted --value 0
1721 do_servers_not_mgs $LCTL set_param nodemap.c1.admin_nodemap=0
1722 do_servers_not_mgs $LCTL set_param nodemap.c1.trusted_nodemap=0
1724 # setfacl on trusted cluster to unmapped user, verify it's not seen
1725 nodemap_acl_test $unmapped_fs ${clients_arr[0]} ${clients_arr[1]} ||
1726 error "acl count (1)"
1728 # setfacl on trusted cluster to mapped user, verify it's seen
1729 nodemap_acl_test $mapped_fs ${clients_arr[0]} ${clients_arr[1]} &&
1730 error "acl count (2)"
1732 # setfacl on mapped cluster to mapped user, verify it's seen
1733 nodemap_acl_test $mapped_c1 ${clients_arr[1]} ${clients_arr[0]} &&
1734 error "acl count (3)"
1736 # setfacl on mapped cluster to unmapped user, verify error
1737 nodemap_acl_test $unmapped_fs ${clients_arr[1]} ${clients_arr[0]} 1 ||
1738 error "acl count (4)"
1741 do_facet mgs $LCTL nodemap_modify --name c0 --property admin --value 0
1742 do_facet mgs $LCTL nodemap_modify --name c0 --property trusted --value 0
1743 do_servers_not_mgs $LCTL set_param nodemap.c0.admin_nodemap=0
1744 do_servers_not_mgs $LCTL set_param nodemap.c0.trusted_nodemap=0
1746 # setfacl to mapped user on c1, also mapped to c0, verify it's seen
1747 nodemap_acl_test $mapped_c1 ${clients_arr[1]} ${clients_arr[0]} &&
1748 error "acl count (5)"
1750 # setfacl to mapped user on c1, not mapped to c0, verify not seen
1751 nodemap_acl_test $unmapped_c1 ${clients_arr[1]} ${clients_arr[0]} ||
1752 error "acl count (6)"
1754 nodemap_test_cleanup
1756 run_test 23 "test mapped ACLs"
1758 log "cleanup: ======================================================"
1761 ## nodemap deactivated
1762 do_facet mgs lctl nodemap_activate 0
1764 for num in $(seq $MDSCOUNT); do
1765 if [ "${identity_old[$num]}" = 1 ]; then
1766 switch_identity $num false || identity_old[$num]=$?
1770 $RUNAS_CMD -u $ID0 ls $DIR
1771 $RUNAS_CMD -u $ID1 ls $DIR