LU-13274 uapi: make lustre UAPI headers C99 compliant

[fs/lustre-release.git] / lustre / tests / sanity-selinux.sh

diff --git a/lustre/tests/sanity-selinux.sh b/lustre/tests/sanity-selinux.sh
index 8ddc402..44ec962 100755 (executable)
--- a/lustre/tests/sanity-selinux.sh
+++ b/lustre/tests/sanity-selinux.sh
@@ -422,8 +422,8 @@ trace_cmd() {
 }
 
 test_20d() {
-       if [ $MDS1_VERSION -lt $(version_code 2.12.50) ] ||
-          [ $CLIENT_VERSION -lt $(version_code 2.12.50) ]; then
+       if [ "$MDS1_VERSION" -lt $(version_code 2.12.50) ] ||
+          [ "$CLIENT_VERSION" -lt $(version_code 2.12.50) ]; then
                skip "Need version >= 2.12.50"
        fi
        [ $MDSCOUNT -lt 2 ] && skip "needs >= 2 MDTs"
@@ -505,7 +505,6 @@ create_nodemap() {
        check_nodemap $nm trusted_nodemap 1
 
        sepol=$(l_getsepol | cut -d':' -f2- | xargs)
-       do_facet mgs $LCTL set_param nodemap.$nm.sepol="$sepol"
        do_facet mgs $LCTL set_param -P nodemap.$nm.sepol="$sepol"
 
        check_nodemap $nm sepol $sepol
@@ -516,17 +515,22 @@ remove_nodemap() {
 
        do_facet mgs $LCTL nodemap_del $nm
 
+       wait_update_facet --verbose mds1 \
+               "$LCTL get_param nodemap.$nm.id 2>/dev/null | \
+               grep -c $nm || true" 0 30 ||
+               error "nodemap $nm could not be removed"
+
        do_facet mgs $LCTL nodemap_activate 0
 
        check_nodemap active x  0
 }
 
 test_21a() {
-       local sepol
-
-       [ $(lustre_version_code $SINGLEMDS) -lt $(version_code 2.11.56) ] &&
+       [ "$MDS1_VERSION" -lt $(version_code 2.11.56) ] &&
                skip "Need MDS >= 2.11.56"
 
+       local sepol
+
        # umount client
        if [ "$MOUNT_2" ] && $(grep -q $MOUNT2' ' /proc/mounts); then
                umount_client $MOUNT2 || error "umount $MOUNT2 failed"
@@ -536,7 +540,24 @@ test_21a() {
        fi
 
        # create nodemap entry with sepol
-       create_nodemap nm1
+       create_nodemap c0
+
+       if $GSS_SK; then
+               # update mount option with skpath
+               MOUNT_OPTS=$(add_sk_mntflag $MOUNT_OPTS)
+               export SK_UNIQUE_NM=true
+
+               # load specific key on servers
+               do_nodes $(comma_list $(all_server_nodes)) "lgss_sk -t server \
+                                                   -l $SK_PATH/nodemap/c0.key"
+
+               # set perms for per-nodemap keys else permission denied
+               do_nodes $(comma_list $(all_server_nodes)) \
+                "keyctl show | grep lustre | cut -c1-11 |
+                               sed -e 's/ //g;' |
+                               xargs -IX keyctl setperm X 0x3f3f3f3f"
+
+       fi
 
        # mount client without sending sepol
        mount_client $MOUNT $MOUNT_OPTS &&
@@ -552,16 +573,19 @@ test_21a() {
 
        # store wrong sepol in nodemap
        sepol="0:policy:0:0000000000000000000000000000000000000000000000000000000000000000"
-       do_facet mgs $LCTL set_param nodemap.nm1.sepol="$sepol"
-       do_facet mgs $LCTL set_param -P nodemap.nm1.sepol="$sepol"
-       check_nodemap nm1 sepol $sepol
+       do_facet mgs $LCTL set_param -P nodemap.c0.sepol="$sepol"
+       check_nodemap c0 sepol $sepol
 
        # mount client with sepol
        mount_client $MOUNT $MOUNT_OPTS &&
                error "client mount without matching sepol should be refused"
 
        # remove nodemap
-       remove_nodemap nm1
+       remove_nodemap c0
+
+       if $GSS_SK; then
+               export SK_UNIQUE_NM=false
+       fi
 
        # remount client normally
        echo 0 > /sys/module/ptlrpc/parameters/send_sepol
@@ -570,11 +594,11 @@ test_21a() {
 run_test 21a "Send sepol at connect"
 
 test_21b() {
-       local sepol
-
-       [ $(lustre_version_code $SINGLEMDS) -lt $(version_code 2.11.56) ] &&
+       [ "$MDS1_VERSION" -lt $(version_code 2.11.56) ] &&
                skip "Need MDS >= 2.11.56"
 
+       local sepol
+
        mkdir -p $DIR/$tdir || error "failed to create $DIR/$tdir"
        echo test > $DIR/$tdir/toopen ||
                error "failed to write to $DIR/$tdir/toopen"
@@ -603,7 +627,22 @@ test_21b() {
        echo 3 > /proc/sys/vm/drop_caches
 
        # create nodemap entry with sepol
-       create_nodemap nm1
+       create_nodemap c0
+
+       if $GSS_SK; then
+               export SK_UNIQUE_NM=true
+
+               # load specific key on servers
+               do_nodes $(comma_list $(all_server_nodes)) "lgss_sk -t server \
+                                                   -l $SK_PATH/nodemap/c0.key"
+
+               # set perms for per-nodemap keys else permission denied
+               do_nodes $(comma_list $(all_server_nodes)) \
+                "keyctl show | grep lustre | cut -c1-11 |
+                               sed -e 's/ //g;' |
+                               xargs -IX keyctl setperm X 0x3f3f3f3f"
+
+       fi
 
        # metadata ops without sending sepol
        touch $DIR/$tdir/f0 && error "touch (1)"
@@ -647,9 +686,8 @@ test_21b() {
 
        # store wrong sepol in nodemap
        sepol="0:policy:0:0000000000000000000000000000000000000000000000000000000000000000"
-       do_facet mgs $LCTL set_param nodemap.nm1.sepol="$sepol"
-       do_facet mgs $LCTL set_param -P nodemap.nm1.sepol="$sepol"
-       check_nodemap nm1 sepol $sepol
+       do_facet mgs $LCTL set_param -P nodemap.c0.sepol="$sepol"
+       check_nodemap c0 sepol $sepol
 
        # metadata ops with sepol
        touch $DIR/$tdir/f4 && error "touch (3)"
@@ -672,12 +710,12 @@ test_21b() {
 
        # reset correct sepol
        sepol=$(l_getsepol | cut -d':' -f2- | xargs)
-       do_facet mgs $LCTL set_param nodemap.nm1.sepol="$sepol"
-       do_facet mgs $LCTL set_param -P nodemap.nm1.sepol="$sepol"
-       check_nodemap nm1 sepol $sepol
+       do_facet mgs $LCTL set_param -P nodemap.c0.sepol="$sepol"
+       check_nodemap c0 sepol $sepol
 
-       # metadata ops with sepol every 10 seconds only
-       echo 10 > /sys/module/ptlrpc/parameters/send_sepol
+       # metadata ops with sepol every 1000 seconds only
+       echo 1000 > /sys/module/ptlrpc/parameters/send_sepol
+       local before=$(date +%s)
        touch $DIR/$tdir/f6 || error "touch (4)"
        lfs setstripe -c1 $DIR/$tdir/f7 || error "lfs setstripe (4)"
        mkdir $DIR/$tdir/d6 || error "mkdir (4)"
@@ -726,7 +764,9 @@ test_21b() {
        ln $DIR/$tdir/toopen $DIR/$tdir/toopen_hl5 || error "hardlink (5)"
        echo 3 > /proc/sys/vm/drop_caches
 
-       sleep 10
+       local after=$(date +%s)
+       # change send_sepol to a smaller, already expired, value
+       echo $((after-before-1)) > /sys/module/ptlrpc/parameters/send_sepol
        # metadata ops without matching sepol: should fail now
        touch $DIR/$tdir/f10 && error "touch (6)"
        lfs setstripe -c1 $DIR/$tdir/f11 && error "lfs setstripe (6)"
@@ -754,8 +794,12 @@ test_21b() {
        fi
 
        # remove nodemap
-       remove_nodemap nm1
+       remove_nodemap c0
        echo 0 > /sys/module/ptlrpc/parameters/send_sepol
+
+       if $GSS_SK; then
+               export SK_UNIQUE_NM=false
+       fi
 }
 run_test 21b "Send sepol for metadata ops"