USER0=$(getent passwd | grep :$ID0:$ID0: | cut -d: -f1)
USER1=$(getent passwd | grep :$ID1:$ID1: | cut -d: -f1)
-NODEMAP_COUNT=16
-NODEMAP_RANGE_COUNT=3
-NODEMAP_IPADDR_LIST="1 10 64 128 200 250"
-NODEMAP_ID_COUNT=10
+if [ "$SLOW" == "yes" ]; then
+ NODEMAP_COUNT=16
+ NODEMAP_RANGE_COUNT=3
+ NODEMAP_IPADDR_LIST="1 10 64 128 200 250"
+ NODEMAP_ID_COUNT=10
+else
+ NODEMAP_COUNT=3
+ NODEMAP_RANGE_COUNT=2
+ NODEMAP_IPADDR_LIST="1 250"
+ NODEMAP_ID_COUNT=3
+fi
NODEMAP_MAX_ID=$((ID0 + NODEMAP_ID_COUNT))
[ -z "$USER0" ] &&
[ $GSS_SUP = 0 ] && skip "without GSS support." && return
rm -rf $DIR/$tdir
- mkdir -p $DIR/$tdir
+ mkdir_on_mdt0 $DIR/$tdir
chown $USER0 $DIR/$tdir || error "chown (1)"
$RUNAS_CMD -u $ID1 -v $ID0 touch $DIR/$tdir/f0 && error "touch (2)"
add_idmaps() {
local i
local cmd="$LCTL nodemap_add_idmap"
+ local do_proj=true
local rc=0
+ (( $MDS1_VERSION >= $(version_code 2.14.52) )) || do_proj=false
+
echo "Start to add idmaps ..."
for ((i = 0; i < NODEMAP_COUNT; i++)); do
local j
--idmap $client_id:$fs_id; then
rc=$((rc + 1))
fi
+ if $do_proj; then
+ if ! do_facet mgs $cmd --name $csum \
+ --idtype projid --idmap \
+ $client_id:$fs_id; then
+ rc=$((rc + 1))
+ fi
+ fi
done
done
delete_idmaps() {
local i
local cmd="$LCTL nodemap_del_idmap"
+ local do_proj=true
local rc=0
+ (( $MDS1_VERSION >= $(version_code 2.14.52) )) || do_proj=false
+
echo "Start to delete idmaps ..."
for ((i = 0; i < NODEMAP_COUNT; i++)); do
local j
--idmap $client_id:$fs_id; then
rc=$((rc + 1))
fi
+ if $do_proj; then
+ if ! do_facet mgs $cmd --name $csum \
+ --idtype projid --idmap \
+ $client_id:$fs_id; then
+ rc=$((rc + 1))
+ fi
+ fi
done
done
cmd[0]="$LCTL nodemap_modify --property squash_uid"
cmd[1]="$LCTL nodemap_modify --property squash_gid"
+ cmd[2]="$LCTL nodemap_modify --property squash_projid"
if ! do_facet mgs ${cmd[$3]} --name $1 --value $2; then
return 1
fi
}
-wait_nm_sync() {
- local nodemap_name=$1
- local key=$2
- local value=$3
- local opt=$4
- local proc_param
- local is_active=$(do_facet mgs $LCTL get_param -n nodemap.active)
- local max_retries=20
- local is_sync
- local out1=""
- local out2
- local mgs_ip=$(host_nids_address $mgs_HOST $NETTYPE | cut -d' ' -f1)
- local i
-
- if [ "$nodemap_name" == "active" ]; then
- proc_param="active"
- elif [ -z "$key" ]; then
- proc_param=${nodemap_name}
- else
- proc_param="${nodemap_name}.${key}"
- fi
- if [ "$opt" == "inactive" ]; then
- # check nm sync even if nodemap is not activated
- is_active=1
- opt=""
- fi
- (( is_active == 0 )) && [ "$proc_param" != "active" ] && return
-
- if [ -z "$value" ]; then
- out1=$(do_facet mgs $LCTL get_param $opt \
- nodemap.${proc_param} 2>/dev/null)
- echo "On MGS ${mgs_ip}, ${proc_param} = $out1"
- else
- out1=$value;
- fi
-
- # wait up to 10 seconds for other servers to sync with mgs
- for i in $(seq 1 10); do
- for node in $(all_server_nodes); do
- local node_ip=$(host_nids_address $node $NETTYPE |
- cut -d' ' -f1)
-
- is_sync=true
- if [ -z "$value" ]; then
- [ $node_ip == $mgs_ip ] && continue
- fi
-
- out2=$(do_node $node_ip $LCTL get_param $opt \
- nodemap.$proc_param 2>/dev/null)
- echo "On $node ${node_ip}, ${proc_param} = $out2"
- [ "$out1" != "$out2" ] && is_sync=false && break
- done
- $is_sync && break
- sleep 1
- done
- if ! $is_sync; then
- echo MGS
- echo $out1
- echo OTHER - IP: $node_ip
- echo $out2
- error "mgs and $nodemap_name ${key} mismatch, $i attempts"
- fi
- echo "waited $((i - 1)) seconds for sync"
-}
-
# ensure that the squash defaults are the expected defaults
squash_id default 99 0
wait_nm_sync default squash_uid '' inactive
squash_id default 99 1
wait_nm_sync default squash_gid '' inactive
+if [ "$MDS1_VERSION" -ge $(version_code 2.14.50) ]; then
+ squash_id default 99 2
+ wait_nm_sync default squash_projid '' inactive
+fi
test_nid() {
local cmd
[[ $rc != 0 ]] && error "nodemap squash_gid with $rc" && return 3
rc=0
+ if (( $MDS1_VERSION >= $(version_code 2.14.52) )); then
+ for ((i = 0; i < NODEMAP_COUNT; i++)); do
+ if ! squash_id ${HOSTNAME_CHECKSUM}_${i} 88 2; then
+ rc=$((rc + 1))
+ fi
+ done
+ fi
+ [[ $rc != 0 ]] && error "nodemap squash_projid with $rc" && return 5
+
+ rc=0
delete_nodemaps
rc=$?
[[ $rc != 0 ]] && error "nodemap_del failed with $rc" && return 4
rc=$?
[[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 1
+ for (( i = 0; i < NODEMAP_COUNT; i++ )); do
+ local csum=${HOSTNAME_CHECKSUM}_${i}
+
+ if ! do_facet mgs $LCTL nodemap_modify --name $csum \
+ --property admin --value 0; then
+ rc=$((rc + 1))
+ fi
+ if ! do_facet mgs $LCTL nodemap_modify --name $csum \
+ --property trusted --value 0; then
+ rc=$((rc + 1))
+ fi
+ done
+ [[ $rc != 0 ]] && error "nodemap_modify failed with $rc" && return 1
+
rc=0
for ((i = 0; i < NODEMAP_COUNT; i++)); do
if ! add_range ${HOSTNAME_CHECKSUM}_${i} $i; then
test_fops() {
local mapmode="$1"
local single_client="$2"
- local client_user_list=([0]="0 $((IDBASE+3)) $((IDBASE+4))"
- [1]="0 $((IDBASE+5)) $((IDBASE+6))")
+ local client_user_list=([0]="0 $((IDBASE+3))"
+ [1]="0 $((IDBASE+5))")
+ local mds_users="-1 0"
local mds_i
local rc=0
- local perm_bit_list="0 3 $((0300)) $((0303))"
+ local perm_bit_list="3 $((0300))"
# SLOW tests 000-007, 010-070, 100-700 (octal modes)
- [ "$SLOW" == "yes" ] &&
+ if [ "$SLOW" == "yes" ]; then
perm_bit_list="0 $(seq 1 7) $(seq 8 8 63) $(seq 64 64 511) \
$((0303))"
+ client_user_list=([0]="0 $((IDBASE+3)) $((IDBASE+4))"
+ [1]="0 $((IDBASE+5)) $((IDBASE+6))")
+ mds_users="-1 0 1 2"
+ fi
+ # force single_client to speed up test
+ [ "$SLOW" == "yes" ] ||
+ single_client=1
# step through mds users. -1 means root
- for mds_i in -1 0 1 2; do
+ for mds_i in $mds_users; do
local user=$((mds_i + IDBASE))
local client
local x
nodemap_exercise_fileset() {
local nm="$1"
local loop=0
+ local check_proj=true
+
+ (( $MDS1_VERSION >= $(version_code 2.14.52) )) || check_proj=false
# setup
if [ "$nm" == "default" ]; then
do_facet mgs $LCTL nodemap_activate 1
wait_nm_sync active
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property admin --value 1
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property trusted --value 1
+ wait_nm_sync default admin_nodemap
+ wait_nm_sync default trusted_nodemap
+ check_proj=false
else
nodemap_test_setup
fi
error "unable to add fileset info to $nm nodemap for servers"
wait_nm_sync $nm fileset "nodemap.${nm}.fileset=/$subdir"
+ if $check_proj; then
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property admin --value 1
+ wait_nm_sync $nm admin_nodemap
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property trusted --value 0
+ wait_nm_sync $nm trusted_nodemap
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property map_mode --value projid
+ wait_nm_sync $nm map_mode
+ do_facet mgs $LCTL nodemap_add_idmap --name $nm \
+ --idtype projid --idmap 1:1
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property deny_unknown --value 1
+ wait_nm_sync $nm deny_unknown
+ fi
+
# re-mount client
zconf_umount_clients ${clients_arr[0]} $MOUNT ||
error "unable to umount client ${clients_arr[0]}"
do_node ${clients_arr[0]} test -f $MOUNT/this_is_$subdir ||
error "fileset not taken into account"
+ if $check_proj; then
+ do_node ${clients_arr[0]} $LFS setquota -p 1 -b 10000 -B 11000 \
+ -i 0 -I 0 $MOUNT || error "setquota -p 1 failed"
+ do_node ${clients_arr[0]} $LFS setquota -p 2 -b 10000 -B 11000 \
+ -i 0 -I 0 $MOUNT && error "setquota -p 2 should fail"
+ fi
+
# re-mount client with sub-subdir
zconf_umount_clients ${clients_arr[0]} $MOUNT ||
error "unable to umount client ${clients_arr[0]}"
fi
fileset_test_cleanup "$nm"
if [ "$nm" == "default" ]; then
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property admin --value 0
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property trusted --value 0
+ wait_nm_sync default admin_nodemap
+ wait_nm_sync default trusted_nodemap
do_facet mgs $LCTL nodemap_activate 0
wait_nm_sync active 0
trap 0
}
cleanup_for_enc_tests() {
+ rm -rf $DIR/$tdir
+
# remount client normally
if is_mounted $MOUNT; then
umount_client $MOUNT || error "umount $MOUNT failed"
test_46() {
local testdir=$DIR/$tdir/mydir
local testfile=$testdir/myfile
+ local testdir2=$DIR/$tdir/mydirwithaveryverylongnametotestcodebehaviour0
+ local testfile2=$testdir/myfilewithaveryverylongnametotestcodebehaviour0
local lsfile=$TMP/lsfile
local scrambleddir
local scrambledfile
- local testfile2=$DIR/$tdir/${tfile}.2
- local tmpfile=$DIR/junk
-
$LCTL get_param mdc.*.import | grep -q client_encryption ||
skip "client encryption not supported"
stack_trap cleanup_for_enc_tests EXIT
setup_for_enc_tests
- touch $DIR/onefile
touch $DIR/$tdir/$tfile
mkdir $testdir
echo test > $testfile
+ echo othertest > $testfile2
+ if [[ $MDSCOUNT -gt 1 ]]; then
+ $LFS setdirstripe -c1 -i1 $testdir2
+ else
+ mkdir $testdir2
+ fi
sync ; echo 3 > /proc/sys/vm/drop_caches
# remove fscrypt key from keyring
keyctl revoke $(keyctl show | awk '$7 ~ "^fscrypt:" {print $1}')
keyctl reap
+ cancel_lru_locks
+
+ # this is $testdir2
+ scrambleddir=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type d| grep _)
+ stat $scrambleddir || error "stat $scrambleddir failed"
+ rmdir $scrambleddir || error "rmdir $scrambleddir failed"
scrambleddir=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type d)
- ls -1 $scrambleddir > $lsfile || error "ls $testdir failed"
+ ls -1 $scrambleddir > $lsfile || error "ls $testdir failed (1)"
scrambledfile=$scrambleddir/$(head -n 1 $lsfile)
- stat $scrambledfile || error "stat $scrambledfile failed"
+ stat $scrambledfile || error "stat $scrambledfile failed (1)"
rm -f $lsfile
- cat $scrambledfile && error "cat $scrambledfile should have failed"
+ cat $scrambledfile && error "cat $scrambledfile should have failed (1)"
+ rm -f $scrambledfile || error "rm $scrambledfile failed (1)"
+
+ ls -1 $scrambleddir > $lsfile || error "ls $testdir failed (2)"
+ scrambledfile=$scrambleddir/$(head -n 1 $lsfile)
+ stat $scrambledfile || error "stat $scrambledfile failed (2)"
+ rm -f $lsfile
+ cat $scrambledfile && error "cat $scrambledfile should have failed (2)"
touch $scrambleddir/otherfile &&
error "touch otherfile should have failed"
error "mkdir otherdir should have failed"
ls -d $scrambleddir/otherdir && error "otherdir should not exist"
- rm -f $scrambledfile || error "rm $scrambledfile failed"
+ ls -R $DIR
+ rm -f $scrambledfile || error "rm $scrambledfile failed (2)"
rmdir $scrambleddir || error "rmdir $scrambleddir failed"
-
- rm -f $DIR/onefile
+ ls -R $DIR
}
run_test 46 "encrypted file access semantics without key"
stack_trap cleanup_for_enc_tests EXIT
setup_for_enc_tests
- dd if=/dev/zero of=$tmpfile bs=512K count=1
+ dd if=/dev/urandom of=$tmpfile bs=512K count=1
mrename $tmpfile $testfile &&
error "rename from unencrypted to encrypted dir should fail"
ln $tmpfile $testfile &&
- error "link from unencrypted to encrypted dir should fail"
+ error "link from encrypted to unencrypted dir should fail"
cp $tmpfile $testfile ||
error "cp from unencrypted to encrypted dir should succeed"
ln $testfile2 $testfile ||
error "link from within encrypted dir should succeed"
+ cmp -bl $testfile2 $testfile ||
+ error "cannot read from hard link (1.1)"
+ echo a >> $testfile || error "cannot write to hard link (1)"
+ cancel_lru_locks
+ cmp -bl $testfile2 $testfile ||
+ error "cannot read from hard link (1.2)"
rm -f $testfile
ln $testfile2 $tmpfile ||
- error "link from encrypted to unencrypted dir should succeed"
+ error "link from unencrypted to encrypted dir should succeed"
+ cancel_lru_locks
+ cmp -bl $testfile2 $tmpfile ||
+ error "cannot read from hard link (2.1)"
+ echo a >> $tmpfile || error "cannot write to hard link (2)"
+ cancel_lru_locks
+ cmp -bl $testfile2 $tmpfile ||
+ error "cannot read from hard link (2.2)"
rm -f $tmpfile
- mrename $testfile2 $tmpfile ||
- error "rename from encrypted to unencrypted dir should succeed"
+ # check we are limited in the number of hard links
+ # we can create for encrypted files, to what can fit into LinkEA
+ for i in $(seq 1 160); do
+ ln $testfile2 ${testfile}_$i || break
+ done
+ [ $i -lt 160 ] || error "hard link $i should fail"
+ rm -f ${testfile}_*
- dd if=/dev/zero of=$testfile bs=512K count=1
+ mrename $testfile2 $tmpfile &&
+ error "rename from encrypted to unencrypted dir should fail"
+ rm -f $testfile2
+ dd if=/dev/urandom of=$tmpfile bs=512K count=1
+
+ dd if=/dev/urandom of=$testfile bs=512K count=1
mkdir $DIR/$tdir/mydir
+
+ ln -s $testfile ${testfile}.sym ||
+ error "symlink from within encrypted dir should succeed"
+ cancel_lru_locks
+ cmp -bl $testfile ${testfile}.sym ||
+ error "cannot read from sym link (1.1)"
+ echo a >> ${testfile}.sym || error "cannot write to sym link (1)"
+ cancel_lru_locks
+ cmp -bl $testfile ${testfile}.sym ||
+ error "cannot read from sym link (1.2)"
+ [ $(stat -c %s ${testfile}.sym) -eq ${#testfile} ] ||
+ error "wrong symlink size (1)"
+
+ ln -s $tmpfile ${testfile}.sl ||
+ error "symlink from encrypted to unencrypted dir should succeed"
+ cancel_lru_locks
+ cmp -bl $tmpfile ${testfile}.sl ||
+ error "cannot read from sym link (2.1)"
+ echo a >> ${testfile}.sl || error "cannot write to sym link (2)"
+ cancel_lru_locks
+ cmp -bl $tmpfile ${testfile}.sl ||
+ error "cannot read from sym link (2.2)"
+ [ $(stat -c %s ${testfile}.sl) -eq ${#tmpfile} ] ||
+ error "wrong symlink size (2)"
+ rm -f ${testfile}.sl
+
sync ; echo 3 > /proc/sys/vm/drop_caches
# remove fscrypt key from keyring
keyctl revoke $(keyctl show | awk '$7 ~ "^fscrypt:" {print $1}')
keyctl reap
+ cancel_lru_locks
scrambleddir=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type d)
scrambledfile=$(find $DIR/$tdir/ -maxdepth 1 -type f)
+ scrambledlink=$(find $DIR/$tdir/ -maxdepth 1 -type l)
ln $scrambledfile $scrambleddir/linkfile &&
error "ln linkfile should have failed"
mrename $scrambledfile $DIR/onefile2 &&
touch $DIR/onefile
mrename $DIR/onefile $scrambleddir/otherfile &&
error "mrename to $scrambleddir should have failed"
+ readlink $scrambledlink ||
+ error "link should be read without key"
+ [ $(stat -c %s $scrambledlink) -eq \
+ $(expr length "$(readlink $scrambledlink)") ] ||
+ error "wrong symlink size without key"
+ readlink -e $scrambledlink &&
+ error "link should not point to anywhere useful"
+ ln -s $scrambledfile ${scrambledfile}.sym &&
+ error "symlink without key should fail (1)"
+ ln -s $tmpfile ${scrambledfile}.sl &&
+ error "symlink without key should fail (2)"
rm -f $tmpfile $DIR/onefile
}
cmp -bl $tmpfile $testfile ||
error "file $testfile is corrupted (4)"
- # lockless truncate should be turned into regular truncate for enc file
- save_lustre_params client "osc.*.lockless_truncate" > $save
- # restore lockless_truncate default values on exit
- stack_trap "restore_lustre_params < $save; rm -f $save" EXIT
- cancel_lru_locks osc ; cancel_lru_locks mdc
- lctl set_param -n osc.*.lockless_truncate 1
- cancel_lru_locks osc
- clear_stats osc.*.osc_stats
- $TRUNCATE $testfile 8000000 || error "truncate failed (1)"
- [ $(calc_stats osc.*.osc_stats lockless_truncate) -eq 0 ] ||
- error "lockless truncate should be turned into regular truncate"
- lctl set_param -n osc.*.lockless_truncate 0
-
# truncate to a smaller, non-multiple of PAGE_SIZE, non-multiple of 16
sz=$((sz-7))
$TRUNCATE $tmpfile $sz
trace_cmd() {
local cmd="$@"
- local xattr_name="security.c"
cancel_lru_locks
$LCTL set_param debug=+info
eval $cmd
[ $? -eq 0 ] || error "$cmd failed"
- $LCTL dk | grep -E "get xattr '${xattr_name}'|get xattrs"
+ if [ -z "$MATCHING_STRING" ]; then
+ $LCTL dk | grep -E "get xattr 'security.c'|get xattrs"
+ else
+ $LCTL dk | grep -E "$MATCHING_STRING"
+ fi
[ $? -ne 0 ] || error "get xattr event was triggered"
}
trace_cmd stat $dirname/f1
trace_cmd cat $dirname/f1
dd if=/dev/zero of=$dirname/f1 bs=1M count=10 conv=fsync
- trace_cmd $TRUNCATE $dirname/f1 10240
+ MATCHING_STRING="get xattr 'security.c'" \
+ trace_cmd $TRUNCATE $dirname/f1 10240
trace_cmd $LFS setstripe -E -1 -S 4M $dirname/f2
trace_cmd $LFS migrate -E -1 -S 256K $dirname/f2
trace_cmd stat $dirname/f1
trace_cmd cat $dirname/f1
dd if=/dev/zero of=$dirname/f1 bs=1M count=10 conv=fsync
- trace_cmd $TRUNCATE $dirname/f1 10240
+ MATCHING_STRING="get xattr 'security.c'" \
+ trace_cmd $TRUNCATE $dirname/f1 10240
trace_cmd $LFS setstripe -E -1 -S 4M $dirname/f2
trace_cmd $LFS migrate -E -1 -S 256K $dirname/f2
else
$LFS mirror verify -v $testfile &&
error "mirrors should be different"
+ rm -f $testfile $mirror1 $mirror2
+
+ $LFS setstripe -c1 -i0 $testfile
+ dd if=$tmpfile of=$testfile bs=9000 count=1 conv=fsync ||
+ error "write to $testfile failed"
+ $LFS getstripe $testfile
+ cancel_lru_locks
+
+ $LFS migrate -i1 $testfile ||
+ error "migrate $testfile failed"
+ $LFS getstripe $testfile
+ stripe=$($LFS getstripe -i $testfile)
+ [ $stripe -eq 1 ] || error "migrate file $testfile failed"
+
+ cancel_lru_locks
+ cmp -bl $tmpfile $testfile ||
+ error "migrated file is corrupted"
+
+ $LFS mirror extend -N -i0 $testfile ||
+ error "mirror extend $testfile failed"
+ $LFS getstripe $testfile
+ mirror_count=$($LFS getstripe -N $testfile)
+ [ $mirror_count -eq 2 ] ||
+ error "mirror extend file $testfile failed (1)"
+ stripe=$($LFS getstripe --mirror-id=1 -i $testfile)
+ [ $stripe -eq 1 ] || error "mirror extend file $testfile failed (2)"
+ stripe=$($LFS getstripe --mirror-id=2 -i $testfile)
+ [ $stripe -eq 0 ] || error "mirror extend file $testfile failed (3)"
+
+ cancel_lru_locks
+ $LFS mirror verify -v $testfile ||
+ error "mirror verify failed"
+ $LFS mirror read -N 1 -o $mirror1 $testfile ||
+ error "read from mirror 1 failed"
+ cmp -bl $tmpfile $mirror1 ||
+ error "corruption of mirror 1"
+ $LFS mirror read -N 2 -o $mirror2 $testfile ||
+ error "read from mirror 2 failed"
+ cmp -bl $tmpfile $mirror2 ||
+ error "corruption of mirror 2"
+
+ $LFS mirror split --mirror-id 1 -f ${testfile}.mirror $testfile &&
+ error "mirror split -f should fail"
+
+ $LFS mirror split --mirror-id 1 $testfile &&
+ error "mirror split without -d should fail"
+
+ $LFS mirror split --mirror-id 1 -d $testfile ||
+ error "mirror split failed"
+ $LFS getstripe $testfile
+ mirror_count=$($LFS getstripe -N $testfile)
+ [ $mirror_count -eq 1 ] ||
+ error "mirror split file $testfile failed (1)"
+ stripe=$($LFS getstripe --mirror-id=1 -i $testfile)
+ [ -z "$stripe" ] || error "mirror extend file $testfile failed (2)"
+ stripe=$($LFS getstripe --mirror-id=2 -i $testfile)
+ [ $stripe -eq 0 ] || error "mirror extend file $testfile failed (3)"
+
+ cancel_lru_locks
+ cmp -bl $tmpfile $testfile ||
+ error "extended/split file is corrupted"
+
rm -f $tmpfile $mirror1 $mirror2
}
run_test 52 "Mirrored encrypted file"
test_54() {
local testdir=$DIR/$tdir/$ID0
local testfile=$testdir/$tfile
- local testfile2=$testdir/${tfile}2
+ local testfile2=$testdir/${tfile}withveryverylongnametoexercisecode
local tmpfile=$TMP/${tfile}.tmp
local resfile=$TMP/${tfile}.res
local filecount=$($RUNAS find $testdir -type f | wc -l)
[ $filecount -eq 3 ] || error "found $filecount files"
- $RUNAS hexdump -C $testfile &&
- error "reading $testfile should have failed without key"
+ scrambledfiles=( $(find $testdir/ -maxdepth 1 -type f) )
+ $RUNAS hexdump -C ${scrambledfiles[0]} &&
+ error "reading ${scrambledfiles[0]} should fail without key"
$RUNAS touch ${testfile}.nokey &&
error "touch ${testfile}.nokey should have failed without key"
$RUNAS fscrypt lock --verbose $testdir ||
error "fscrypt lock $testdir failed (2)"
- $RUNAS hexdump -C $testfile2 &&
- error "reading $testfile2 should have failed without key"
+ $RUNAS hexdump -C ${scrambledfiles[1]} &&
+ error "reading ${scrambledfiles[1]} should fail without key"
echo mypass | $RUNAS fscrypt unlock --verbose $testdir ||
error "fscrypt unlock $testdir failed (2)"
}
test_55() {
+ (( $MDS1_VERSION > $(version_code 2.12.6.2) )) ||
+ skip "Need MDS version at least 2.12.6.3"
+
local client_ip
local client_nid
setup_for_enc_tests
mkdir $testdir
- setfattr -n security.c -v myval $testdir &&
+ if [ $(getfattr -n security.c $testdir 2>&1 |
+ grep -ci "Operation not permitted") -eq 0 ]; then
+ error "getting xattr on $testdir should have failed"
+ fi
+ getfattr -d -m - $testdir 2>&1 | grep security\.c &&
+ error "listing xattrs on $testdir should not expose security.c"
+ if [ $(setfattr -n security.c -v myval $testdir 2>&1 |
+ grep -ci "Operation not permitted") -eq 0 ]; then
error "setting xattr on $testdir should have failed (2)"
+ fi
touch $testfile
- setfattr -n security.c -v myval $testfile &&
+ if [ $(getfattr -n security.c $testfile 2>&1 |
+ grep -ci "Operation not permitted") -eq 0 ]; then
+ error "getting xattr on $testfile should have failed"
+ fi
+ getfattr -d -m - $testfile 2>&1 | grep security\.c &&
+ error "listing xattrs on $testfile should not expose security.c"
+ if [ $(setfattr -n security.c -v myval $testfile 2>&1 |
+ grep -ci "Operation not permitted") -eq 0 ]; then
error "setting xattr on $testfile should have failed (2)"
+ fi
return 0
}
run_test 57 "security.c xattr protection"
+test_58() {
+ local testdir=$DIR/$tdir/mytestdir
+ local testfile=$DIR/$tdir/$tfile
+
+ [[ $(facet_fstype ost1) == zfs ]] && skip "skip ZFS backend"
+
+ $LCTL get_param mdc.*.import | grep -q client_encryption ||
+ skip "client encryption not supported"
+
+ mount.lustre --help |& grep -q "test_dummy_encryption:" ||
+ skip "need dummy encryption support"
+
+ stack_trap cleanup_for_enc_tests EXIT
+ setup_for_enc_tests
+
+ touch $DIR/$tdir/$tfile
+ mkdir $DIR/$tdir/subdir
+
+ cancel_lru_locks
+ sync ; sync
+ echo 3 > /proc/sys/vm/drop_caches
+
+ ll_decode_linkea $DIR/$tdir/$tfile || error "cannot read $tfile linkea"
+ ll_decode_linkea $DIR/$tdir/subdir || error "cannot read subdir linkea"
+
+ for ((i = 0; i < 1000; i = $((i+1)))); do
+ mkdir -p $DIR/$tdir/d${i}
+ touch $DIR/$tdir/f${i}
+ createmany -m $DIR/$tdir/d${i}/f 5 > /dev/null
+ done
+
+ cancel_lru_locks
+ sync ; sync
+ echo 3 > /proc/sys/vm/drop_caches
+
+ sleep 10
+ ls -ailR $DIR/$tdir > /dev/null || error "fail to ls"
+}
+run_test 58 "access to enc file's xattrs"
+
log "cleanup: ======================================================"
sec_unsetup() {
git://git.whamcloud.com / fs / lustre-release.git / blobdiff