X-Git-Url: https://git.whamcloud.com/?a=blobdiff_plain;f=lustre%2Ftests%2Fsanity-sec.sh;h=70e111498e5085534213276ed0b343d4bac8e782;hb=46021d556b67557d545e01522c41b9fad20120e1;hp=fbc8229abeedb1f4f7114b08e8246db729a0739b;hpb=0c36574b5bb9d52e5d5c62f3f8c08977553b143c;p=fs%2Flustre-release.git diff --git a/lustre/tests/sanity-sec.sh b/lustre/tests/sanity-sec.sh index fbc8229..70e1114 100644 --- a/lustre/tests/sanity-sec.sh +++ b/lustre/tests/sanity-sec.sh @@ -3,341 +3,574 @@ # Run select tests by setting ONLY, or as arguments to the script. # Skip specific tests by setting EXCEPT. # -# e.g. ONLY="22 23" or ONLY="`seq 32 39`" or EXCEPT="31" + set -e ONLY=${ONLY:-"$*"} -ALWAYS_EXCEPT=${ALWAYS_EXCEPT:-""} +# bug number for skipped test: 19430 19967 19967 +ALWAYS_EXCEPT=" 2 5 6 $SANITY_SEC_EXCEPT" # UPDATE THE COMMENT ABOVE WITH BUG NUMBERS WHEN CHANGING ALWAYS_EXCEPT! -[ "$ALWAYS_EXCEPT$EXCEPT" ] && echo "Skipping tests: $ALWAYS_EXCEPT $EXCEPT" +[ "$ALWAYS_EXCEPT$EXCEPT" ] && \ + echo "Skipping tests: $ALWAYS_EXCEPT $EXCEPT" SRCDIR=`dirname $0` -export PATH=$PWD/$SRCDIR:$SRCDIR:$SRCDIR/../utils:$PATH -export SECURITY=${SECURITY:-"null"} - -TMP=${TMP:-/tmp} -FSTYPE=${FSTYPE:-ext3} - -CHECKSTAT=${CHECKSTAT:-"checkstat -v"} -CREATETEST=${CREATETEST:-createtest} -LFS=${LFS:-lfs} -LSTRIPE=${LSTRIPE:-"$LFS setstripe"} -LFIND=${LFIND:-"$LFS find"} -LVERIFY=${LVERIFY:-ll_dirstripe_verify} -LCTL=${LCTL:-lctl} -MCREATE=${MCREATE:-mcreate} -OPENFILE=${OPENFILE:-openfile} -OPENUNLINK=${OPENUNLINK:-openunlink} -TOEXCL=${TOEXCL:-toexcl} -TRUNCATE=${TRUNCATE:-truncate} -MUNLINK=${MUNLINK:-munlink} -SOCKETSERVER=${SOCKETSERVER:-socketserver} -SOCKETCLIENT=${SOCKETCLIENT:-socketclient} -IOPENTEST1=${IOPENTEST1:-iopentest1} -IOPENTEST2=${IOPENTEST2:-iopentest2} - -. krb5_env.sh - -if [ $UID -ne 0 ]; then - RUNAS_ID="$UID" - RUNAS="" +export PATH=$PWD/$SRCDIR:$SRCDIR:$PWD/$SRCDIR/../utils:$PATH:/sbin +export NAME=${NAME:-local} + +LUSTRE=${LUSTRE:-`dirname $0`/..} +. $LUSTRE/tests/test-framework.sh +init_test_env $@ +. ${CONFIG:=$LUSTRE/tests/cfg/$NAME.sh} +init_logging + +RUNAS="runas" + +WTL=${WTL:-"$LUSTRE/tests/write_time_limit"} + +CONFDIR=/etc/lustre +PERM_CONF=$CONFDIR/perm.conf +FAIL_ON_ERROR=false + +require_dsh_mds || exit 0 +require_dsh_ost || exit 0 + +ID0=${ID0:-500} +ID1=${ID1:-501} +USER0=`cat /etc/passwd|grep :$ID0:$ID0:|cut -d: -f1` +USER1=`cat /etc/passwd|grep :$ID1:$ID1:|cut -d: -f1` + +[ -z "$USER0" ] && \ + echo "Please add user0 (uid=$ID0 gid=$ID0)! Skip sanity-sec" && exit 0 + +[ -z "$USER1" ] && \ + echo "Please add user1 (uid=$ID1 gid=$ID1)! Skip sanity-sec" && exit 0 + +check_and_setup_lustre + +sec_cleanup() { + if [ "$I_MOUNTED" = "yes" ]; then + cleanupall -f || error "sec_cleanup" + fi +} + +DIR=${DIR:-$MOUNT} +[ -z "`echo $DIR | grep $MOUNT`" ] && \ + error "$DIR not in $MOUNT" && sec_cleanup && exit 1 + +[ `echo $MOUNT | wc -w` -gt 1 ] && \ + echo "NAME=$MOUNT mounted more than once" && sec_cleanup && exit 0 + +[ $MDSCOUNT -gt 1 ] && \ + echo "skip multi-MDS test" && sec_cleanup && exit 0 + +# for GSS_SUP +GSS_REF=$(lsmod | grep ^ptlrpc_gss | awk '{print $3}') +if [ ! -z "$GSS_REF" -a "$GSS_REF" != "0" ]; then + GSS_SUP=1 + echo "with GSS support" else - RUNAS_ID=${RUNAS_ID:-500} - RUNAS=${RUNAS:-"runas -u $RUNAS_ID"} + GSS_SUP=0 + echo "without GSS support" fi -if [ `using_krb5_sec $SECURITY` == 'y' ] ; then - start_krb5_kdc || exit 1 - if [ $RUNAS_ID -ne $UID ]; then - $RUNAS ./krb5_refresh_cache.sh || exit 2 - fi +MDT="`do_facet $SINGLEMDS "lctl get_param -N mdt.\*MDT\*.stats 2>/dev/null | cut -d"." -f2" || true`" +[ -z "$MDT" ] && error "fail to get MDT device" && exit 1 +do_facet $SINGLEMDS "mkdir -p $CONFDIR" +IDENTITY_FLUSH=mdt.$MDT.identity_flush +MDSCAPA=mdt.$MDT.capa +CAPA_TIMEOUT=mdt.$MDT.capa_timeout +MDSSECLEVEL=mdt.$MDT.sec_level + +# for CLIENT_TYPE +if [ -z "$(lctl get_param -n llite.*.client_type | grep remote 2>/dev/null)" ]; then + CLIENT_TYPE="local" + echo "local client" +else + CLIENT_TYPE="remote" + echo "remote client" fi -export NAME=${NAME:-local} - SAVE_PWD=$PWD -clean() { - echo -n "cln.." - sh llmountcleanup.sh > /dev/null || exit 20 - I_MOUNTED=no -} -CLEAN=${CLEAN:-clean} +build_test_filter -start() { - echo -n "mnt.." - sh llrmount.sh > /dev/null || exit 10 - I_MOUNTED=yes - echo "done" -} -START=${START:-start} +sec_login() { + local user=$1 + local group=$2 -log() { - echo "$*" - lctl mark "$*" 2> /dev/null || true + if ! $RUNAS -u $user krb5_login.sh; then + error "$user login kerberos failed." + exit 1 + fi + + if ! $RUNAS -u $user -g $group ls $DIR > /dev/null 2>&1; then + $RUNAS -u $user lfs flushctx -k + $RUNAS -u $user krb5_login.sh + if ! $RUNAS -u $user -g $group ls $DIR > /dev/null 2>&1; then + error "init $user $group failed." + exit 2 + fi + fi } -trace() { - log "STARTING: $*" - strace -o $TMP/$1.strace -ttt $* - RC=$? - log "FINISHED: $*: rc $RC" - return 1 +declare -a identity_old + +sec_setup() { + for num in `seq $MDSCOUNT`; do + switch_identity $num true || identity_old[$num]=$? + done + + if ! $RUNAS -u $ID0 ls $DIR > /dev/null 2>&1; then + sec_login $USER0 $USER0 + fi + + if ! $RUNAS -u $ID1 ls $DIR > /dev/null 2>&1; then + sec_login $USER1 $USER1 + fi } -TRACE=${TRACE:-""} - -check_kernel_version() { - VERSION_FILE=/proc/fs/lustre/kernel_version - WANT_VER=$1 - [ ! -f $VERSION_FILE ] && echo "can't find kernel version" && return 1 - GOT_VER=`cat $VERSION_FILE` - [ $GOT_VER -ge $WANT_VER ] && return 0 - log "test needs at least kernel version $WANT_VER, running $GOT_VER" - return 1 +sec_setup + +# run as different user +test_0() { + umask 0022 + + chmod 0755 $DIR || error "chmod (1)" + rm -rf $DIR/$tdir || error "rm (1)" + mkdir -p $DIR/$tdir || error "mkdir (1)" + + if [ "$CLIENT_TYPE" = "remote" ]; then + do_facet $SINGLEMDS "echo '* 0 normtown' > $PERM_CONF" + do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1" + chown $USER0 $DIR/$tdir && error "chown (1)" + do_facet $SINGLEMDS "echo '* 0 rmtown' > $PERM_CONF" + do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1" + else + chown $USER0 $DIR/$tdir || error "chown (2)" + fi + + $RUNAS -u $ID0 ls $DIR || error "ls (1)" + rm -f $DIR/f0 || error "rm (2)" + $RUNAS -u $ID0 touch $DIR/f0 && error "touch (1)" + $RUNAS -u $ID0 touch $DIR/$tdir/f1 || error "touch (2)" + $RUNAS -u $ID1 touch $DIR/$tdir/f2 && error "touch (3)" + touch $DIR/$tdir/f3 || error "touch (4)" + chown root $DIR/$tdir || error "chown (3)" + chgrp $USER0 $DIR/$tdir || error "chgrp (1)" + chmod 0775 $DIR/$tdir || error "chmod (2)" + $RUNAS -u $ID0 touch $DIR/$tdir/f4 || error "touch (5)" + $RUNAS -u $ID1 touch $DIR/$tdir/f5 && error "touch (6)" + touch $DIR/$tdir/f6 || error "touch (7)" + rm -rf $DIR/$tdir || error "rm (3)" + + if [ "$CLIENT_TYPE" = "remote" ]; then + do_facet $SINGLEMDS "rm -f $PERM_CONF" + do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1" + fi } +run_test 0 "uid permission =============================" -run_one() { - if ! cat /proc/mounts | grep -q $DIR; then - $START +# setuid/gid +test_1() { + [ $GSS_SUP = 0 ] && skip "without GSS support." && return + + if [ "$CLIENT_TYPE" = "remote" ]; then + do_facet $SINGLEMDS "echo '* 0 rmtown' > $PERM_CONF" + do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1" fi - echo -1 >/proc/sys/portals/debug - log "== test $1: $2" - export TESTNAME=test_$1 - test_$1 || error "test_$1: exit with rc=$?" - unset TESTNAME - pass - cd $SAVE_PWD - $CLEAN + + rm -rf $DIR/$tdir + mkdir -p $DIR/$tdir + + chown $USER0 $DIR/$tdir || error "chown (1)" + $RUNAS -u $ID1 -v $ID0 touch $DIR/$tdir/f0 && error "touch (2)" + echo "enable uid $ID1 setuid" + do_facet $SINGLEMDS "echo '* $ID1 setuid' >> $PERM_CONF" + do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1" + $RUNAS -u $ID1 -v $ID0 touch $DIR/$tdir/f1 || error "touch (3)" + + chown root $DIR/$tdir || error "chown (4)" + chgrp $USER0 $DIR/$tdir || error "chgrp (5)" + chmod 0770 $DIR/$tdir || error "chmod (6)" + $RUNAS -u $ID1 -g $ID1 touch $DIR/$tdir/f2 && error "touch (7)" + $RUNAS -u $ID1 -g $ID1 -j $ID0 touch $DIR/$tdir/f3 && error "touch (8)" + echo "enable uid $ID1 setuid,setgid" + do_facet $SINGLEMDS "echo '* $ID1 setuid,setgid' > $PERM_CONF" + do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1" + $RUNAS -u $ID1 -g $ID1 -j $ID0 touch $DIR/$tdir/f4 || error "touch (9)" + $RUNAS -u $ID1 -v $ID0 -g $ID1 -j $ID0 touch $DIR/$tdir/f5 || error "touch (10)" + + rm -rf $DIR/$tdir + + do_facet $SINGLEMDS "rm -f $PERM_CONF" + do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1" } +run_test 1 "setuid/gid =============================" -build_test_filter() { - for O in $ONLY; do - eval ONLY_${O}=true - done - for E in $EXCEPT $ALWAYS_EXCEPT; do - eval EXCEPT_${E}=true - done +run_rmtacl_subtest() { + $SAVE_PWD/rmtacl/run $SAVE_PWD/rmtacl/$1.test + return $? } -_basetest() { - echo $* +# remote_acl +# for remote client only +test_2 () { + [ "$CLIENT_TYPE" = "local" ] && \ + skip "remote_acl for remote client only" && return + [ -z "$(lctl get_param -n mdc.*-mdc-*.connect_flags | grep ^acl)" ] && \ + skip "must have acl enabled" && return + [ -z "$(which setfacl 2>/dev/null)" ] && \ + skip "could not find setfacl" && return + [ "$UID" != 0 ] && skip "must run as root" && return + + do_facet $SINGLEMDS "echo '* 0 rmtacl,rmtown' > $PERM_CONF" + do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1" + + sec_login root root + sec_login bin bin + sec_login daemon daemon + sec_login games users + + SAVE_UMASK=`umask` + umask 0022 + cd $DIR + + echo "performing cp ..." + run_rmtacl_subtest cp || error "cp" + echo "performing getfacl-noacl..." + run_rmtacl_subtest getfacl-noacl || error "getfacl-noacl" + echo "performing misc..." + run_rmtacl_subtest misc || error "misc" + echo "performing permissions..." + run_rmtacl_subtest permissions || error "permissions" + echo "performing setfacl..." + run_rmtacl_subtest setfacl || error "setfacl" + + # inheritance test got from HP + echo "performing inheritance..." + cp $SAVE_PWD/rmtacl/make-tree . + chmod +x make-tree + run_rmtacl_subtest inheritance || error "inheritance" + rm -f make-tree + + cd $SAVE_PWD + umask $SAVE_UMASK + + do_facet $SINGLEMDS "rm -f $PERM_CONF" + do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1" } +run_test 2 "rmtacl =============================" -basetest() { - IFS=abcdefghijklmnopqrstuvwxyz _basetest $1 +# rootsquash +# root_squash will be redesigned in Lustre 1.7 +test_3() { + skip "root_squash will be redesigned in Lustre 1.7" && return } +run_test 3 "rootsquash =============================" + +# bug 3285 - supplementary group should always succeed. +# NB: the supplementary groups are set for local client only, +# as for remote client, the groups of the specified uid on MDT +# will be obtained by upcall /sbin/l_getidentity and used. +test_4() { + if [ "$CLIENT_TYPE" = "remote" ]; then + do_facet $SINGLEMDS "echo '* 0 rmtown' > $PERM_CONF" + do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1" + fi -run_test() { - base=`basetest $1` - if [ "$ONLY" ]; then - testname=ONLY_$1 - if [ ${!testname}x != x ]; then - run_one $1 "$2" - return $? - fi - testname=ONLY_$base - if [ ${!testname}x != x ]; then - run_one $1 "$2" - return $? - fi - echo -n "." - return 0 - fi - testname=EXCEPT_$1 - if [ ${!testname}x != x ]; then - echo "skipping excluded test $1" - return 0 - fi - testname=EXCEPT_$base - if [ ${!testname}x != x ]; then - echo "skipping excluded test $1 (base $base)" - return 0 - fi - run_one $1 "$2" - return $? + rm -rf $DIR/$tdir + mkdir -p $DIR/$tdir + chmod 0771 $DIR/$tdir + chgrp $ID0 $DIR/$tdir + $RUNAS -u $ID0 ls $DIR/$tdir || error "setgroups (1)" + if [ "$CLIENT_TYPE" = "local" ]; then + do_facet $SINGLEMDS "echo '* $ID1 setgrp' > $PERM_CONF" + do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1" + $RUNAS -u $ID1 -G1,2,$ID0 ls $DIR/$tdir || error "setgroups (2)" + fi + $RUNAS -u $ID1 -G1,2 ls $DIR/$tdir && error "setgroups (3)" + rm -rf $DIR/$tdir + + do_facet $SINGLEMDS "rm -f $PERM_CONF" + do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1" } +run_test 4 "set supplementary group ===============" -[ "$SANITYLOG" ] && rm -f $SANITYLOG || true +mds_capability_timeout() { + [ $# -lt 1 ] && echo "Miss mds capability timeout value" && return 1 -error() { - log "FAIL: $@" - if [ "$SANITYLOG" ]; then - echo "FAIL: $TESTNAME $@" >> $SANITYLOG - else - exit 1 - fi + echo "Set mds capability timeout as $1 seconds" + do_facet $SINGLEMDS "lctl set_param -n $CAPA_TIMEOUT=$1" + return 0 } -pass() { - echo PASS +mds_sec_level_switch() { + [ $# -lt 1 ] && echo "Miss mds sec level switch value" && return 1 + + case $1 in + 0) echo "Disable capa for all clients";; + 1) echo "Enable capa for remote client";; + 3) echo "Enable capa for all clients";; + *) echo "Invalid mds sec level switch value" && return 2;; + esac + + do_facet $SINGLEMDS "lctl set_param -n $MDSSECLEVEL=$1" + return 0 } -MOUNT="`mount | awk '/^'$NAME' .* lustre_lite / { print $3 }'`" -if [ -z "$MOUNT" ]; then - sh llmount.sh - MOUNT="`mount | awk '/^'$NAME' .* lustre_lite / { print $3 }'`" - [ -z "$MOUNT" ] && error "NAME=$NAME not mounted" - I_MOUNTED=yes -fi +oss_sec_level_switch() { + [ $# -lt 1 ] && echo "Miss oss sec level switch value" && return 1 + + case $1 in + 0) echo "Disable capa for all clients";; + 1) echo "Enable capa for remote client";; + 3) echo "Enable capa for all clients";; + *) echo "Invalid oss sec level switch value" && return 2;; + esac + + for i in `seq $OSTCOUNT`; do + local j=`expr $i - 1` + local OST="`do_facet ost$i "lctl get_param -N obdfilter.\*OST\*$j/stats 2>/dev/null | cut -d"." -f2" || true`" + [ -z "$OST" ] && return 3 + do_facet ost$i "lctl set_param -n obdfilter.$OST.sec_level=$1" + done + return 0 +} -[ `echo $MOUNT | wc -w` -gt 1 ] && error "NAME=$NAME mounted more than once" +mds_capability_switch() { + [ $# -lt 1 ] && echo "Miss mds capability switch value" && return 1 -DIR=${DIR:-$MOUNT} -[ -z "`echo $DIR | grep $MOUNT`" ] && echo "$DIR not in $MOUNT" && exit 99 + case $1 in + 0) echo "Turn off mds capability";; + 3) echo "Turn on mds capability";; + *) echo "Invalid mds capability switch value" && return 2;; + esac -OSTCOUNT=`cat /proc/fs/lustre/llite/fs0/lov/numobd` -STRIPECOUNT=`cat /proc/fs/lustre/llite/fs0/lov/stripecount` -STRIPESIZE=`cat /proc/fs/lustre/llite/fs0/lov/stripesize` + do_facet $SINGLEMDS "lctl set_param -n $MDSCAPA=$1" + return 0 +} -build_test_filter +oss_capability_switch() { + [ $# -lt 1 ] && echo "Miss oss capability switch value" && return 1 + + case $1 in + 0) echo "Turn off oss capability";; + 1) echo "Turn on oss capability";; + *) echo "Invalid oss capability switch value" && return 2;; + esac + + for i in `seq $OSTCOUNT`; do + local j=`expr $i - 1` + local OST="`do_facet ost$i "lctl get_param -N obdfilter.\*OST\*$j/stats 2>/dev/null | cut -d"." -f2" || true`" + [ -z "$OST" ] && return 3 + do_facet ost$i "lctl set_param -n obdfilter.$OST.capa=$1" + done + return 0 +} -test_0() { - touch $DIR/f - $CHECKSTAT -t file $DIR/f || error - rm $DIR/f - $CHECKSTAT -a $DIR/f || error +turn_mds_capa_on() { + mds_capability_switch 3 || return 1 + mds_sec_level_switch 3 || return 2 + return 0 } -run_test 0 "touch .../f ; rm .../f =============================" -mdsdevice(){ - lctl << EOF - dl - quit -EOF +turn_oss_capa_on() { + oss_capability_switch 1 || return 1 + oss_sec_level_switch 3 || return 2 + return 0 } -mynidstr(){ - lctl << EOF - network tcp - mynid - quit -EOF +turn_capability_on() { + local capa_timeout=${1:-"1800"} + + # To turn on fid capability for the system, + # there is a requirement that fid capability + # is turned on on all MDS/OSS servers before + # client mount. + + turn_mds_capa_on || return 1 + turn_oss_capa_on || return 2 + mds_capability_timeout $capa_timeout || return 3 + remount_client $MOUNT || return 4 + return 0 } -test_1(){ - mdsnum=`mdsdevice|awk ' $3=="mds" {print $1}'` - if [ ! -z "$mdsnum" ];then - mynid=`mynidstr|awk '{print $4}'` - mkdir $DIR/test_0a_dir1 - touch $DIR/test_0a_file1 - ln -s $DIR/test_0a_file1 $DIR/test_0a_filelink1 - chmod 0777 $DIR - lctl << EOF - device $mdsnum - root_squash 500:500 - root_squash - quit -EOF - mkdir $DIR/test_0a_dir2 - touch $DIR/test_0a_file2 - ln -s $DIR/test_0a_file2 $DIR/test_0a_filelink2 - $CHECKSTAT -t dir -u 500 $DIR/test_0a_dir2 || error - $CHECKSTAT -t file -u 500 $DIR/test_0a_file2 || error - $CHECKSTAT -t link -u 500 $DIR/test_0a_filelink2 || error - lctl << EOF - device $mdsnum - root_squash 500:500 $mynid - root_squash - quit -EOF - mkdir $DIR/test_0a_dir3 - touch $DIR/test_0a_file3 - ln -s $DIR/test_0a_file3 $DIR/test_0a_filelink3 - $CHECKSTAT -t dir -u root $DIR/test_0a_dir3 || error - $CHECKSTAT -t file -u root $DIR/test_0a_file3 || error - $CHECKSTAT -t link -u root $DIR/test_0a_filelink3 || error - lctl << EOF - device $mdsnum - root_squash root:root - root_squash - quit -EOF - mkdir $DIR/test_0a_dir4 - touch $DIR/test_0a_file4 - ln -s $DIR/test_0a_file4 $DIR/test_0a_filelink4 - $CHECKSTAT -t dir -u root $DIR/test_0a_dir4 || error - $CHECKSTAT -t file -u root $DIR/test_0a_file4 || error - $CHECKSTAT -t link -u root $DIR/test_0a_filelink4 || error - rm -rf $DIR/test_0a* - chmod 0755 $DIR - fi +turn_mds_capa_off() { + mds_sec_level_switch 0 || return 1 + mds_capability_switch 0 || return 2 + return 0 } -run_test 1 "test root_squash ============================" - -test_2() { - touch $DIR/f2 - - #test set/get xattr - setfattr -n trusted.name1 -v value1 $DIR/f2 || error - [ "`getfattr -n trusted.name1 $DIR/f2 2> /dev/null | \ - grep "trusted.name1"`" == "trusted.name1=\"value1\"" ] || error - - setfattr -n user.author1 -v author1 $DIR/f2 || error - [ "`getfattr -n user.author1 $DIR/f2 2> /dev/null | \ - grep "user.author1"`" == "user.author1=\"author1\"" ] || error - - # test listxattr - setfattr -n trusted.name2 -v value2 $DIR/f2 || error - setfattr -n trusted.name3 -v value3 $DIR/f2 || error - [ `getfattr -d -m "^trusted" $DIR/f2 2> /dev/null | \ - grep "trusted" | wc -l` -eq 5 ] || error - - - setfattr -n user.author2 -v author2 $DIR/f2 || error - setfattr -n user.author3 -v author3 $DIR/f2 || error - [ `getfattr -d -m "^user" $DIR/f2 2> /dev/null | \ - grep "user" | wc -l` -eq 3 ] || error - #test removexattr - setfattr -x trusted.name1 $DIR/f2 2> /dev/null || error - getfattr -d -m trusted $DIR/f2 2> /dev/null | \ - grep "trusted.name1" && error || true - - setfattr -x user.author1 $DIR/f2 2> /dev/null || error - getfattr -d -m user $DIR/f2 2> /dev/null | \ - grep "user.author1" && error || true +turn_oss_capa_off() { + oss_sec_level_switch 0 || return 1 + oss_capability_switch 0 || return 2 + return 0 } -run_test 2 "set/get xattr test (trusted xattr only) ============" -run_acl_subtest() -{ - sed -e "s/joe/$USER1/g;s/lisa/$USER2/g;s/users/$GROUP1/g;s/toolies/$GROUP2/g" \ - $SAVE_PWD/acl/$1.test | $SAVE_PWD/acl/run || error "$? $1.test failed" +turn_capability_off() { + # to turn off fid capability, you can just do + # it in a live system. But, please turn off + # capability of all OSS servers before MDS servers. + + turn_oss_capa_off || return 1 + turn_mds_capa_off || return 2 + return 0 } -test_3 () { - SAVE_UMASK=`umask` - umask 022 - USER1=rpm - USER2=vsx2 - GROUP1=nobody - GROUP2=users +# We demonstrate that access to the objects in the filesystem are not +# accessible without supplying secrets from the MDS by disabling a +# proc variable on the mds so that it does not supply secrets. We then +# try and access objects which result in failure. +test_5() { + local file=$DIR/f5 + + [ $GSS_SUP = 0 ] && skip "without GSS support." && return + if ! remote_mds; then + skip "client should be separated from server." + return + fi + + rm -f $file + + turn_capability_off + if [ $? != 0 ]; then + error "turn_capability_off" + return 1 + fi - cd $DIR + turn_oss_capa_on + if [ $? != 0 ]; then + error "turn_oss_capa_on" + return 2 + fi + + if [ "$CLIENT_TYPE" = "remote" ]; then + remount_client $MOUNT && return 3 + turn_oss_capa_off + return 0 + else + remount_client $MOUNT || return 4 + fi - run_acl_subtest cp - run_acl_subtest getfacl-noacl - run_acl_subtest misc - run_acl_subtest permissions - run_acl_subtest setfacl + # proc variable disabled -- access to the objects in the filesystem + # is not allowed + echo "Should get Write error here : (proc variable are disabled "\ + "-- access to the objects in the filesystem is denied." + $WTL $file 30 + if [ $? == 0 ]; then + error "Write worked well even though secrets not supplied." + return 5 + fi + + turn_capability_on + if [ $? != 0 ]; then + error "turn_capability_on" + return 6 + fi + + sleep 5 + + # proc variable enabled, secrets supplied -- write should work now + echo "Should not fail here : (proc variable enabled, secrets supplied "\ + "-- write should work now)." + $WTL $file 30 + if [ $? != 0 ]; then + error "Write failed even though secrets supplied." + return 7 + fi - cd $SAVED_PWD - umask $SAVE_UMASK + turn_capability_off + if [ $? != 0 ]; then + error "turn_capability_off" + return 8 + fi + rm -f $file } -run_test 3 "==============acl test =============" +run_test 5 "capa secrets =========================" + +# Expiry: A test program is performing I/O on a file. It has credential +# with an expiry half a minute later. While the program is running the +# credentials expire and no automatic extensions or renewals are +# enabled. The program will demonstrate an I/O failure. +test_6() { + local file=$DIR/f6 + + [ $GSS_SUP = 0 ] && skip "without GSS support." && return + if ! remote_mds; then + skip "client should be separated from server." + return + fi -TMPDIR=$OLDTMPDIR -TMP=$OLDTMP -HOME=$OLDHOME + turn_capability_off + if [ $? != 0 ]; then + error "turn_capability_off" + return 1 + fi -log "cleanup: ======================================================" -if [ "`mount | grep ^$NAME`" ]; then - rm -rf $DIR/[Rdfs][1-9]* - if [ "$I_MOUNTED" = "yes" ]; then - sh llmountcleanup.sh || error + rm -f $file + + turn_capability_on 30 + if [ $? != 0 ]; then + error "turn_capability_on 30" + return 2 fi -fi -echo '=========================== finished ===============================' -[ -f "$SANITYLOG" ] && cat $SANITYLOG && exit 1 || true + # Token expiry + $WTL $file 60 + if [ $? != 0 ]; then + error "$WTL $file 60" + return 3 + fi + + # Reset MDS capability timeout + mds_capability_timeout 30 + if [ $? != 0 ]; then + error "mds_capability_timeout 30" + return 4 + fi + + $WTL $file 60 & + local PID=$! + sleep 5 + + # To disable automatic renew, only need turn capa off on MDS. + turn_mds_capa_off + if [ $? != 0 ]; then + error "turn_mds_capa_off" + return 5 + fi + + echo "We expect I/O failure." + wait $PID + if [ $? == 0 ]; then + echo "no I/O failure got." + return 6 + fi + + turn_capability_off + if [ $? != 0 ]; then + error "turn_capability_off" + return 7 + fi + rm -f $file +} +run_test 6 "capa expiry =========================" + +log "cleanup: ======================================================" + +sec_unsetup() { + for num in `seq $MDSCOUNT`; do + if [ "${identity_old[$num]}" = 1 ]; then + switch_identity $num false || identity_old[$num]=$? + fi + done + + $RUNAS -u $ID0 ls $DIR + $RUNAS -u $ID1 ls $DIR +} +sec_unsetup + +sec_cleanup + +complete $SECONDS +exit_status