3 # Run select tests by setting ONLY, or as arguments to the script.
4 # Skip specific tests by setting EXCEPT.
10 [ "$EXCEPT" ] && echo "Skipping tests: `echo $EXCEPT`"
13 export PATH=$PWD/$SRCDIR:$SRCDIR:$PWD/$SRCDIR/../utils:$PATH:/sbin
14 export NAME=${NAME:-local}
16 LUSTRE=${LUSTRE:-`dirname $0`/..}
17 . $LUSTRE/tests/test-framework.sh
19 . ${CONFIG:=$LUSTRE/tests/cfg/$NAME.sh}
21 RUNAS=${RUNAS:-"$LUSTRE/tests/runas"}
22 WTL=${WTL:-"$LUSTRE/tests/write_time_limit"}
24 PERM_CONF=/etc/lustre/perm.conf
25 LLITE_LPROC=$LPROC/llite
28 OST_LPROC=$LPROC/obdfilter
30 SANITYSECLOG=${TESTSUITELOG:-$TMP/$(basename $0 .sh).log}
35 USER0=`cat /etc/passwd|grep :$ID0:$ID0:|cut -d: -f1`
36 USER1=`cat /etc/passwd|grep :$ID1:$ID1:|cut -d: -f1`
39 echo "Please add user0 (uid=$ID0 gid=$ID0)! Skip sanity-sec" && exit 0
42 echo "Please add user1 (uid=$ID1 gid=$ID1)! Skip sanity-sec" && exit 0
44 check_and_setup_lustre
47 [ -z "`echo $DIR | grep $MOUNT`" ] && \
48 error "$DIR not in $MOUNT" && sec_cleanup && exit 1
50 [ `echo $MOUNT | wc -w` -gt 1 ] && \
51 echo "NAME=$MOUNT mounted more than once" && sec_cleanup && exit 0
53 [ $MDSCOUNT -gt 1 ] && \
54 echo "skip multi-MDS test" && sec_cleanup && exit 0
57 GSS_REF=$(lsmod | grep ^ptlrpc_gss | awk '{print $3}')
58 if [ ! -z "$GSS_REF" -a "$GSS_REF" != "0" ]; then
60 echo "with GSS support"
63 echo "without GSS support"
66 MDT="`do_facet $SINGLEMDS find $MDT_LPROC/ -name \*MDT\* -printf %f 2>/dev/null || true`"
67 if [ ! -z "$MDT" ]; then
68 IDENTITY_FLUSH=$MDT_LPROC/$MDT/identity_flush
69 MDSCAPA=$MDT_LPROC/$MDT/capa
70 CAPA_TIMEOUT=$MDT_LPROC/$MDT/capa_timeout
74 if [ -z "$(grep remote $LLITE_LPROC/*/client_type 2>/dev/null)" ]; then
90 if ! $RUNAS -u $user krb5_login.sh; then
91 error "$user login kerberos failed."
95 if ! $RUNAS -u $user -g $group ls $DIR > /dev/null 2>&1; then
96 $RUNAS -u $user lfs flushctx -k
97 $RUNAS -u $user krb5_login.sh
98 if ! $RUNAS -u $user -g $group ls $DIR > /dev/null 2>&1; then
99 error "init $user $group failed."
105 declare -a identity_old
108 for num in `seq $MDSCOUNT`; do
109 switch_identity $num true || identity_old[$num]=$?
112 if ! $RUNAS -u $ID0 ls $DIR > /dev/null 2>&1; then
113 sec_login $USER0 $USER0
116 if ! $RUNAS -u $ID1 ls $DIR > /dev/null 2>&1; then
117 sec_login $USER1 $USER1
122 # run as different user
127 chown $USER0 $DIR/d0 || error "chown (1)"
128 $RUNAS -u $ID0 ls $DIR || error "ls (2)"
129 $RUNAS -u $ID0 touch $DIR/f0 && error "touch (3)"
130 $RUNAS -u $ID0 touch $DIR/d0/f1 || error "touch (4)"
131 $RUNAS -u $ID1 touch $DIR/d0/f2 && error "touch (5)"
132 touch $DIR/d0/f3 || error "touch (6)"
133 chown root $DIR/d0 || error "chown (7)"
134 chgrp $USER0 $DIR/d0 || error "chgrp (8)"
135 chmod 775 $DIR/d0 || error "chmod (9)"
136 $RUNAS -u $ID0 touch $DIR/d0/f4 || error "touch (10)"
137 $RUNAS -u $ID1 touch $DIR/d0/f5 && error "touch (11)"
138 touch $DIR/d0/f6 || error "touch (12)"
142 run_test 0 "uid permission ============================="
146 [ $GSS_SUP = 0 ] && skip "without GSS support." && return
147 [ -z "$MDT" ] && skip "do not support do_facet operations." && return
148 [ "$CLIENT_TYPE" = "remote" ] && \
149 skip "test_1 for local client only" && return
151 do_facet $SINGLEMDS "rm -f $PERM_CONF"
152 do_facet $SINGLEMDS "echo -1 > $IDENTITY_FLUSH"
157 chown $USER0 $DIR/d1 || error "chown (1)"
158 $RUNAS -u $ID1 -v $ID0 touch $DIR/d1/f0 && error "touch (2)"
159 do_facet $SINGLEMDS "echo '* $ID1 setuid' > $PERM_CONF"
160 echo "enable uid $ID1 setuid"
161 do_facet $SINGLEMDS "echo -1 > $IDENTITY_FLUSH"
162 $RUNAS -u $ID1 -v $ID0 touch $DIR/d1/f1 || error "touch (3)"
164 chown root $DIR/d1 || error "chown (4)"
165 chgrp $USER0 $DIR/d1 || error "chgrp (5)"
166 chmod 770 $DIR/d1 || error "chmod (6)"
167 $RUNAS -u $ID1 -g $ID1 touch $DIR/d1/f2 && error "touch (7)"
168 $RUNAS -u $ID1 -g $ID1 -j $ID0 touch $DIR/d1/f3 && error "touch (8)"
169 do_facet $SINGLEMDS "echo '* $ID1 setuid,setgid' > $PERM_CONF"
170 echo "enable uid $ID1 setuid,setgid"
171 do_facet $SINGLEMDS "echo -1 > $IDENTITY_FLUSH"
172 $RUNAS -u $ID1 -g $ID1 -j $ID0 touch $DIR/d1/f4 || error "touch (9)"
173 $RUNAS -u $ID1 -v $ID0 -g $ID1 -j $ID0 touch $DIR/d1/f5 || error "touch (10)"
177 do_facet $SINGLEMDS "rm -f $PERM_CONF"
178 do_facet $SINGLEMDS "echo -1 > $IDENTITY_FLUSH"
180 run_test 1 "setuid/gid ============================="
182 run_rmtacl_subtest() {
183 $SAVE_PWD/rmtacl/run $SAVE_PWD/rmtacl/$1.test
188 # for remote client only
190 [ "$CLIENT_TYPE" = "local" ] && \
191 skip "remote_acl for remote client only" && return
192 [ -z "$(grep ^acl $MDC_LPROC/*-mdc-*/connect_flags)" ] && \
193 skip "must have acl enabled" && return
194 [ -z "$(which setfacl 2>/dev/null)" ] && \
195 skip "could not find setfacl" && return
196 [ "$UID" != 0 ] && skip "must run as root" && return
200 sec_login daemon daemon
201 sec_login games users
207 if [ ! -z "$MDT" ]; then
208 do_facet $SINGLEMDS "echo '* 0 rmtacl' > $PERM_CONF"
209 do_facet $SINGLEMDS "echo -1 > $IDENTITY_FLUSH"
212 if lfs rgetfacl $DIR; then
213 echo "performing cp ..."
214 run_rmtacl_subtest cp || error "cp"
216 echo "server doesn't permit current user 'lfs r{s,g}etfacl', skip cp test."
218 echo "performing getfacl-noacl..."
219 run_rmtacl_subtest getfacl-noacl || error "getfacl-noacl"
220 echo "performing misc..."
221 run_rmtacl_subtest misc || error "misc"
222 echo "performing permissions..."
223 run_rmtacl_subtest permissions || error "permissions"
224 echo "performing setfacl..."
225 run_rmtacl_subtest setfacl || error "setfacl"
227 # inheritance test got from HP
228 echo "performing inheritance..."
229 cp $SAVE_PWD/rmtacl/make-tree .
231 run_rmtacl_subtest inheritance || error "inheritance"
234 if [ ! -z "$MDT" ]; then
235 do_facet $SINGLEMDS "rm -f $PERM_CONF"
236 do_facet $SINGLEMDS "echo -1 > $IDENTITY_FLUSH"
242 run_test 2 "rmtacl ============================="
245 # root_squash will be redesigned in Lustre 1.7
247 skip "root_squash will be redesigned in Lustre 1.7" && return
249 run_test 3 "rootsquash ============================="
251 # bug 3285 - supplementary group should always succeed.
252 # NB: the supplementary groups are set for local client only,
253 # as for remote client, the groups of the specified uid on MDT
254 # will be obtained by upcall /sbin/l_getidentity and used.
260 $RUNAS -u $ID0 ls $DIR/d4 || error "setgroups (1)"
261 if [ "$CLIENT_TYPE" != "remote" ]; then
262 if [ ! -z "$MDT" ]; then
263 do_facet $SINGLEMDS "echo '* $ID1 setgrp' > $PERM_CONF"
264 do_facet $SINGLEMDS "echo -1 > $IDENTITY_FLUSH"
266 $RUNAS -u $ID1 -G1,2,$ID0 ls $DIR/d4 || error "setgroups (2)"
267 if [ ! -z "$MDT" ]; then
268 do_facet $SINGLEMDS "rm -f $PERM_CONF"
269 do_facet $SINGLEMDS "echo -1 > $IDENTITY_FLUSH"
272 $RUNAS -u $ID1 -G1,2 ls $DIR/d4 && error "setgroups (3)"
275 run_test 4 "set supplementary group ==============="
277 mds_capability_timeout() {
278 [ $# -lt 1 ] && echo "Miss mds capability timeout value" && return 1
280 echo "Set mds capability timeout as $1 seconds"
281 do_facet $SINGLEMDS "echo $1 > $CAPA_TIMEOUT"
285 mds_capability_switch() {
286 [ $# -lt 1 ] && echo "Miss mds capability switch value" && return 1
289 0) echo "Turn off mds capability";;
290 3) echo "Turn on mds capability";;
291 *) echo "Invalid mds capability switch value" && return 2;;
294 do_facet $SINGLEMDS "echo $1 > $MDSCAPA"
298 oss_capability_switch() {
299 [ $# -lt 1 ] && echo "Miss oss capability switch value" && return 1
302 0) echo "Turn off oss capability";;
303 1) echo "Turn on oss capability";;
304 *) echo "Invalid oss capability switch value" && return 2;;
307 for i in `seq $OSTCOUNT`; do
308 local j=`expr $i - 1`
309 local OST="`do_facet ost$i find $OST_LPROC/ -name \*OST\*$j -printf %f 2>/dev/null || true`"
310 do_facet ost$i "echo $1 > $OST_LPROC/$OST/capa"
315 turn_capability_on() {
316 local capa_timeout=${1:-"1800"}
318 # To turn on fid capability for the system,
319 # there is a requirement that fid capability
320 # is turned on on all MDS/OSS servers before
323 umount $MOUNT || return 1
325 mds_capability_switch 3 || return 2
326 oss_capability_switch 1 || return 3
327 mds_capability_timeout $capa_timeout || return 4
329 mount_client $MOUNT || return 5
333 turn_capability_off() {
334 # to turn off fid capability, you can just do
335 # it in a live system. But, please turn off
336 # capability of all OSS servers before MDS servers.
338 oss_capability_switch 0 || return 1
339 mds_capability_switch 0 || return 2
343 # We demonstrate that access to the objects in the filesystem are not
344 # accessible without supplying secrets from the MDS by disabling a
345 # proc variable on the mds so that it does not supply secrets. We then
346 # try and access objects which result in failure.
350 [ -z "$MDT" ] && skip "do not support do_facet operations." && return
353 error "turn_capability_off"
358 # Disable proc variable
359 mds_capability_switch 0
361 error "mds_capability_switch 0"
364 oss_capability_switch 1
366 error "oss_capability_switch 1"
370 # proc variable disabled -- access to the objects in the filesystem
372 echo "Should get Write error here : (proc variable are disabled "\
373 "-- access to the objects in the filesystem is denied."
376 error "Write worked well even though secrets not supplied."
382 error "turn_capability_on"
387 # proc variable enabled, secrets supplied -- write should work now
388 echo "Should not fail here : (proc variable enabled, secrets supplied "\
389 "-- write should work now)."
392 error "Write failed even though secrets supplied."
398 error "turn_capability_off"
403 run_test 5 "capa secrets ========================="
405 # Expiry: A test program is performing I/O on a file. It has credential
406 # with an expiry half a minute later. While the program is running the
407 # credentials expire and no automatic extensions or renewals are
408 # enabled. The program will demonstrate an I/O failure.
412 [ -z "$MDT" ] && skip "do not support do_facet operations." && return
415 error "turn_capability_off"
420 turn_capability_on 30
422 error "turn_capability_on 30"
428 error "$WTL $file 60"
432 # Reset MDS capability timeout
433 mds_capability_timeout 30
435 error "mds_capability_timeout 30"
442 # To disable automatic renew, only need turn capa off on MDS.
443 mds_capability_switch 0
445 error "mds_capability_switch 0"
449 echo "We expect I/O failure."
452 echo "no I/O failure got."
458 error "turn_capability_off"
463 run_test 6 "capa expiry ========================="
465 log "cleanup: ======================================================"
468 for num in `seq $MDSCOUNT`; do
469 if [ "${identity_old[$num]}" = 1 ]; then
470 switch_identity $num false || identity_old[$num]=$?
474 $RUNAS -u $ID0 ls $DIR
475 $RUNAS -u $ID1 ls $DIR
480 if [ "$I_MOUNTED" = "yes" ]; then
481 cleanupall -f || error "sec_cleanup"
486 echo '=========================== finished ==============================='
487 [ -f "$SANITYSECLOG" ] && \
488 cat $SANITYSECLOG && grep -q FAIL $SANITYSECLOG && exit 1 || true