3 # Run select tests by setting ONLY, or as arguments to the script.
4 # Skip specific tests by setting EXCEPT.
10 [ "$EXCEPT" ] && echo "Skipping tests: `echo $EXCEPT`"
13 export PATH=$PWD/$SRCDIR:$SRCDIR:$PWD/$SRCDIR/../utils:$PATH:/sbin
14 export NAME=${NAME:-local}
16 LUSTRE=${LUSTRE:-`dirname $0`/..}
17 . $LUSTRE/tests/test-framework.sh
19 . ${CONFIG:=$LUSTRE/tests/cfg/$NAME.sh}
21 RUNAS=${RUNAS:-"$LUSTRE/tests/runas"}
22 WTL=${WTL:-"$LUSTRE/tests/write_time_limit"}
25 PERM_CONF=$CONFDIR/perm.conf
26 SANITYSECLOG=${TESTSUITELOG:-$TMP/$(basename $0 .sh).log}
29 remote_mds_nodsh && skip "remote MDS with nodsh" && exit 0
30 remote_ost_nodsh && skip "remote OST with nodsh" && exit 0
34 USER0=`cat /etc/passwd|grep :$ID0:$ID0:|cut -d: -f1`
35 USER1=`cat /etc/passwd|grep :$ID1:$ID1:|cut -d: -f1`
38 echo "Please add user0 (uid=$ID0 gid=$ID0)! Skip sanity-sec" && exit 0
41 echo "Please add user1 (uid=$ID1 gid=$ID1)! Skip sanity-sec" && exit 0
43 check_and_setup_lustre
46 [ -z "`echo $DIR | grep $MOUNT`" ] && \
47 error "$DIR not in $MOUNT" && sec_cleanup && exit 1
49 [ `echo $MOUNT | wc -w` -gt 1 ] && \
50 echo "NAME=$MOUNT mounted more than once" && sec_cleanup && exit 0
52 [ $MDSCOUNT -gt 1 ] && \
53 echo "skip multi-MDS test" && sec_cleanup && exit 0
56 GSS_REF=$(lsmod | grep ^ptlrpc_gss | awk '{print $3}')
57 if [ ! -z "$GSS_REF" -a "$GSS_REF" != "0" ]; then
59 echo "with GSS support"
62 echo "without GSS support"
65 MDT="`do_facet $SINGLEMDS "lctl get_param -N mdt.\*MDT\*/stats | cut -d"." -f2" || true`"
66 if [ ! -z "$MDT" ]; then
67 do_facet $SINGLEMDS "mkdir -p $CONFDIR"
68 IDENTITY_FLUSH=mdt.$MDT.identity_flush
70 CAPA_TIMEOUT=mdt.$MDT.capa_timeout
74 if [ -z "$(lctl get_param -n llite.*.client_type | grep remote 2>/dev/null)" ]; then
90 if ! $RUNAS -u $user krb5_login.sh; then
91 error "$user login kerberos failed."
95 if ! $RUNAS -u $user -g $group ls $DIR > /dev/null 2>&1; then
96 $RUNAS -u $user lfs flushctx -k
97 $RUNAS -u $user krb5_login.sh
98 if ! $RUNAS -u $user -g $group ls $DIR > /dev/null 2>&1; then
99 error "init $user $group failed."
105 declare -a identity_old
108 for num in `seq $MDSCOUNT`; do
109 switch_identity $num true || identity_old[$num]=$?
112 if ! $RUNAS -u $ID0 ls $DIR > /dev/null 2>&1; then
113 sec_login $USER0 $USER0
116 if ! $RUNAS -u $ID1 ls $DIR > /dev/null 2>&1; then
117 sec_login $USER1 $USER1
122 # run as different user
127 chown $USER0 $DIR/d0 || error "chown (1)"
128 $RUNAS -u $ID0 ls $DIR || error "ls (2)"
129 $RUNAS -u $ID0 touch $DIR/f0 && error "touch (3)"
130 $RUNAS -u $ID0 touch $DIR/d0/f1 || error "touch (4)"
131 $RUNAS -u $ID1 touch $DIR/d0/f2 && error "touch (5)"
132 touch $DIR/d0/f3 || error "touch (6)"
133 chown root $DIR/d0 || error "chown (7)"
134 chgrp $USER0 $DIR/d0 || error "chgrp (8)"
135 chmod 775 $DIR/d0 || error "chmod (9)"
136 $RUNAS -u $ID0 touch $DIR/d0/f4 || error "touch (10)"
137 $RUNAS -u $ID1 touch $DIR/d0/f5 && error "touch (11)"
138 touch $DIR/d0/f6 || error "touch (12)"
142 run_test 0 "uid permission ============================="
146 [ $GSS_SUP = 0 ] && skip "without GSS support." && return
147 [ -z "$MDT" ] && skip "do not support do_facet operations." && return
148 [ "$CLIENT_TYPE" = "remote" ] && \
149 skip "test_1 for local client only" && return
151 do_facet $SINGLEMDS "rm -f $PERM_CONF"
152 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
157 chown $USER0 $DIR/d1 || error "chown (1)"
158 $RUNAS -u $ID1 -v $ID0 touch $DIR/d1/f0 && error "touch (2)"
159 do_facet $SINGLEMDS "echo '* $ID1 setuid' > $PERM_CONF"
160 echo "enable uid $ID1 setuid"
161 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
162 $RUNAS -u $ID1 -v $ID0 touch $DIR/d1/f1 || error "touch (3)"
164 chown root $DIR/d1 || error "chown (4)"
165 chgrp $USER0 $DIR/d1 || error "chgrp (5)"
166 chmod 770 $DIR/d1 || error "chmod (6)"
167 $RUNAS -u $ID1 -g $ID1 touch $DIR/d1/f2 && error "touch (7)"
168 $RUNAS -u $ID1 -g $ID1 -j $ID0 touch $DIR/d1/f3 && error "touch (8)"
169 do_facet $SINGLEMDS "echo '* $ID1 setuid,setgid' > $PERM_CONF"
170 echo "enable uid $ID1 setuid,setgid"
171 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
172 $RUNAS -u $ID1 -g $ID1 -j $ID0 touch $DIR/d1/f4 || error "touch (9)"
173 $RUNAS -u $ID1 -v $ID0 -g $ID1 -j $ID0 touch $DIR/d1/f5 || error "touch (10)"
177 do_facet $SINGLEMDS "rm -f $PERM_CONF"
178 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
180 run_test 1 "setuid/gid ============================="
182 run_rmtacl_subtest() {
183 $SAVE_PWD/rmtacl/run $SAVE_PWD/rmtacl/$1.test
188 # for remote client only
190 [ "$CLIENT_TYPE" = "local" ] && \
191 skip "remote_acl for remote client only" && return
192 [ -z "$(lctl get_param -n mdc.*-mdc-*.connect_flags | grep ^acl)" ] && \
193 skip "must have acl enabled" && return
194 [ -z "$(which setfacl 2>/dev/null)" ] && \
195 skip "could not find setfacl" && return
196 [ "$UID" != 0 ] && skip "must run as root" && return
200 sec_login daemon daemon
201 sec_login games users
207 if [ ! -z "$MDT" ]; then
208 do_facet $SINGLEMDS "echo '* 0 rmtacl' > $PERM_CONF"
209 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
212 if lfs rgetfacl $DIR; then
213 echo "performing cp ..."
214 run_rmtacl_subtest cp || error "cp"
216 echo "server doesn't permit current user 'lfs r{s,g}etfacl', skip cp test."
218 echo "performing getfacl-noacl..."
219 run_rmtacl_subtest getfacl-noacl || error "getfacl-noacl"
220 echo "performing misc..."
221 run_rmtacl_subtest misc || error "misc"
222 echo "performing permissions..."
223 run_rmtacl_subtest permissions || error "permissions"
224 echo "performing setfacl..."
225 run_rmtacl_subtest setfacl || error "setfacl"
227 # inheritance test got from HP
228 echo "performing inheritance..."
229 cp $SAVE_PWD/rmtacl/make-tree .
231 run_rmtacl_subtest inheritance || error "inheritance"
234 if [ ! -z "$MDT" ]; then
235 do_facet $SINGLEMDS "rm -f $PERM_CONF"
236 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
242 run_test 2 "rmtacl ============================="
245 # root_squash will be redesigned in Lustre 1.7
247 skip "root_squash will be redesigned in Lustre 1.7" && return
249 run_test 3 "rootsquash ============================="
251 # bug 3285 - supplementary group should always succeed.
252 # NB: the supplementary groups are set for local client only,
253 # as for remote client, the groups of the specified uid on MDT
254 # will be obtained by upcall /sbin/l_getidentity and used.
260 $RUNAS -u $ID0 ls $DIR/d4 || error "setgroups (1)"
261 if [ "$CLIENT_TYPE" != "remote" ]; then
262 if [ ! -z "$MDT" ]; then
263 do_facet $SINGLEMDS "echo '* $ID1 setgrp' > $PERM_CONF"
264 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
265 $RUNAS -u $ID1 -G1,2,$ID0 ls $DIR/d4 || error "setgroups (2)"
266 do_facet $SINGLEMDS "rm -f $PERM_CONF"
267 do_facet $SINGLEMDS "lctl set_param -n $IDENTITY_FLUSH=-1"
270 $RUNAS -u $ID1 -G1,2 ls $DIR/d4 && error "setgroups (3)"
273 run_test 4 "set supplementary group ==============="
275 mds_capability_timeout() {
276 [ $# -lt 1 ] && echo "Miss mds capability timeout value" && return 1
278 echo "Set mds capability timeout as $1 seconds"
279 do_facet $SINGLEMDS "lctl set_param -n $CAPA_TIMEOUT=$1"
283 mds_capability_switch() {
284 [ $# -lt 1 ] && echo "Miss mds capability switch value" && return 1
287 0) echo "Turn off mds capability";;
288 3) echo "Turn on mds capability";;
289 *) echo "Invalid mds capability switch value" && return 2;;
292 do_facet $SINGLEMDS "lctl set_param -n $MDSCAPA=$1"
296 oss_capability_switch() {
297 [ $# -lt 1 ] && echo "Miss oss capability switch value" && return 1
300 0) echo "Turn off oss capability";;
301 1) echo "Turn on oss capability";;
302 *) echo "Invalid oss capability switch value" && return 2;;
305 for i in `seq $OSTCOUNT`; do
306 local j=`expr $i - 1`
307 local OST="`do_facet ost$i "lctl get_param -N obdfilter.\*OST\*$j/stats | cut -d"." -f2" || true`"
308 do_facet ost$i "lctl set_param -n obdfilter.$OST.capa=$1"
313 turn_capability_on() {
314 local capa_timeout=${1:-"1800"}
316 # To turn on fid capability for the system,
317 # there is a requirement that fid capability
318 # is turned on on all MDS/OSS servers before
321 umount $MOUNT || return 1
323 mds_capability_switch 3 || return 2
324 oss_capability_switch 1 || return 3
325 mds_capability_timeout $capa_timeout || return 4
327 mount_client $MOUNT || return 5
331 turn_capability_off() {
332 # to turn off fid capability, you can just do
333 # it in a live system. But, please turn off
334 # capability of all OSS servers before MDS servers.
336 oss_capability_switch 0 || return 1
337 mds_capability_switch 0 || return 2
341 # We demonstrate that access to the objects in the filesystem are not
342 # accessible without supplying secrets from the MDS by disabling a
343 # proc variable on the mds so that it does not supply secrets. We then
344 # try and access objects which result in failure.
348 [ -z "$MDT" ] && skip "do not support do_facet operations." && return
351 error "turn_capability_off"
356 # Disable proc variable
357 mds_capability_switch 0
359 error "mds_capability_switch 0"
362 oss_capability_switch 1
364 error "oss_capability_switch 1"
368 # proc variable disabled -- access to the objects in the filesystem
370 echo "Should get Write error here : (proc variable are disabled "\
371 "-- access to the objects in the filesystem is denied."
374 error "Write worked well even though secrets not supplied."
380 error "turn_capability_on"
385 # proc variable enabled, secrets supplied -- write should work now
386 echo "Should not fail here : (proc variable enabled, secrets supplied "\
387 "-- write should work now)."
390 error "Write failed even though secrets supplied."
396 error "turn_capability_off"
401 run_test 5 "capa secrets ========================="
403 # Expiry: A test program is performing I/O on a file. It has credential
404 # with an expiry half a minute later. While the program is running the
405 # credentials expire and no automatic extensions or renewals are
406 # enabled. The program will demonstrate an I/O failure.
410 [ -z "$MDT" ] && skip "do not support do_facet operations." && return
413 error "turn_capability_off"
418 turn_capability_on 30
420 error "turn_capability_on 30"
426 error "$WTL $file 60"
430 # Reset MDS capability timeout
431 mds_capability_timeout 30
433 error "mds_capability_timeout 30"
440 # To disable automatic renew, only need turn capa off on MDS.
441 mds_capability_switch 0
443 error "mds_capability_switch 0"
447 echo "We expect I/O failure."
450 echo "no I/O failure got."
456 error "turn_capability_off"
461 run_test 6 "capa expiry ========================="
463 log "cleanup: ======================================================"
466 for num in `seq $MDSCOUNT`; do
467 if [ "${identity_old[$num]}" = 1 ]; then
468 switch_identity $num false || identity_old[$num]=$?
472 $RUNAS -u $ID0 ls $DIR
473 $RUNAS -u $ID1 ls $DIR
478 if [ "$I_MOUNTED" = "yes" ]; then
479 cleanupall -f || error "sec_cleanup"
484 echo '=========================== finished ==============================='
485 [ -f "$SANITYSECLOG" ] && \
486 cat $SANITYSECLOG && grep -q FAIL $SANITYSECLOG && exit 1 || true