add_idmaps() {
local i
local cmd="$LCTL nodemap_add_idmap"
+ local do_proj=true
local rc=0
+ (( $MDS1_VERSION >= $(version_code 2.14.52) )) || do_proj=false
+
echo "Start to add idmaps ..."
for ((i = 0; i < NODEMAP_COUNT; i++)); do
local j
--idmap $client_id:$fs_id; then
rc=$((rc + 1))
fi
+ if $do_proj; then
+ if ! do_facet mgs $cmd --name $csum \
+ --idtype projid --idmap \
+ $client_id:$fs_id; then
+ rc=$((rc + 1))
+ fi
+ fi
done
done
delete_idmaps() {
local i
local cmd="$LCTL nodemap_del_idmap"
+ local do_proj=true
local rc=0
+ (( $MDS1_VERSION >= $(version_code 2.14.52) )) || do_proj=false
+
echo "Start to delete idmaps ..."
for ((i = 0; i < NODEMAP_COUNT; i++)); do
local j
--idmap $client_id:$fs_id; then
rc=$((rc + 1))
fi
+ if $do_proj; then
+ if ! do_facet mgs $cmd --name $csum \
+ --idtype projid --idmap \
+ $client_id:$fs_id; then
+ rc=$((rc + 1))
+ fi
+ fi
done
done
cmd[0]="$LCTL nodemap_modify --property squash_uid"
cmd[1]="$LCTL nodemap_modify --property squash_gid"
+ cmd[2]="$LCTL nodemap_modify --property squash_projid"
if ! do_facet mgs ${cmd[$3]} --name $1 --value $2; then
return 1
wait_nm_sync default squash_uid '' inactive
squash_id default 99 1
wait_nm_sync default squash_gid '' inactive
+if [ "$MDS1_VERSION" -ge $(version_code 2.14.50) ]; then
+ squash_id default 99 2
+ wait_nm_sync default squash_projid '' inactive
+fi
test_nid() {
local cmd
[[ $rc != 0 ]] && error "nodemap squash_gid with $rc" && return 3
rc=0
+ if (( $MDS1_VERSION >= $(version_code 2.14.52) )); then
+ for ((i = 0; i < NODEMAP_COUNT; i++)); do
+ if ! squash_id ${HOSTNAME_CHECKSUM}_${i} 88 2; then
+ rc=$((rc + 1))
+ fi
+ done
+ fi
+ [[ $rc != 0 ]] && error "nodemap squash_projid with $rc" && return 5
+
+ rc=0
delete_nodemaps
rc=$?
[[ $rc != 0 ]] && error "nodemap_del failed with $rc" && return 4
rc=$?
[[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 1
+ for (( i = 0; i < NODEMAP_COUNT; i++ )); do
+ local csum=${HOSTNAME_CHECKSUM}_${i}
+
+ if ! do_facet mgs $LCTL nodemap_modify --name $csum \
+ --property admin --value 0; then
+ rc=$((rc + 1))
+ fi
+ if ! do_facet mgs $LCTL nodemap_modify --name $csum \
+ --property trusted --value 0; then
+ rc=$((rc + 1))
+ fi
+ done
+ [[ $rc != 0 ]] && error "nodemap_modify failed with $rc" && return 1
+
rc=0
for ((i = 0; i < NODEMAP_COUNT; i++)); do
if ! add_range ${HOSTNAME_CHECKSUM}_${i} $i; then
nodemap_exercise_fileset() {
local nm="$1"
local loop=0
+ local check_proj=true
+
+ (( $MDS1_VERSION >= $(version_code 2.14.52) )) || check_proj=false
# setup
if [ "$nm" == "default" ]; then
do_facet mgs $LCTL nodemap_activate 1
wait_nm_sync active
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property admin --value 1
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property trusted --value 1
+ wait_nm_sync default admin_nodemap
+ wait_nm_sync default trusted_nodemap
+ check_proj=false
else
nodemap_test_setup
fi
error "unable to add fileset info to $nm nodemap for servers"
wait_nm_sync $nm fileset "nodemap.${nm}.fileset=/$subdir"
+ if $check_proj; then
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property admin --value 1
+ wait_nm_sync $nm admin_nodemap
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property trusted --value 0
+ wait_nm_sync $nm trusted_nodemap
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property map_mode --value projid
+ wait_nm_sync $nm map_mode
+ do_facet mgs $LCTL nodemap_add_idmap --name $nm \
+ --idtype projid --idmap 1:1
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property deny_unknown --value 1
+ wait_nm_sync $nm deny_unknown
+ fi
+
# re-mount client
zconf_umount_clients ${clients_arr[0]} $MOUNT ||
error "unable to umount client ${clients_arr[0]}"
do_node ${clients_arr[0]} test -f $MOUNT/this_is_$subdir ||
error "fileset not taken into account"
+ if $check_proj; then
+ do_node ${clients_arr[0]} $LFS setquota -p 1 -b 10000 -B 11000 \
+ -i 0 -I 0 $MOUNT || error "setquota -p 1 failed"
+ do_node ${clients_arr[0]} $LFS setquota -p 2 -b 10000 -B 11000 \
+ -i 0 -I 0 $MOUNT && error "setquota -p 2 should fail"
+ fi
+
# re-mount client with sub-subdir
zconf_umount_clients ${clients_arr[0]} $MOUNT ||
error "unable to umount client ${clients_arr[0]}"
fi
fileset_test_cleanup "$nm"
if [ "$nm" == "default" ]; then
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property admin --value 0
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property trusted --value 0
+ wait_nm_sync default admin_nodemap
+ wait_nm_sync default trusted_nodemap
do_facet mgs $LCTL nodemap_activate 0
wait_nm_sync active 0
trap 0
}
cleanup_for_enc_tests() {
+ rm -rf $DIR/$tdir
+
# remount client normally
if is_mounted $MOUNT; then
umount_client $MOUNT || error "umount $MOUNT failed"
test_46() {
local testdir=$DIR/$tdir/mydir
local testfile=$testdir/myfile
+ local testdir2=$DIR/$tdir/mydirwithaveryverylongnametotestcodebehaviour0
+ local testfile2=$testdir/myfilewithaveryverylongnametotestcodebehaviour0
local lsfile=$TMP/lsfile
local scrambleddir
local scrambledfile
- local testfile2=$DIR/$tdir/${tfile}.2
- local tmpfile=$DIR/junk
-
$LCTL get_param mdc.*.import | grep -q client_encryption ||
skip "client encryption not supported"
stack_trap cleanup_for_enc_tests EXIT
setup_for_enc_tests
- touch $DIR/onefile
touch $DIR/$tdir/$tfile
mkdir $testdir
echo test > $testfile
+ echo othertest > $testfile2
+ if [[ $MDSCOUNT -gt 1 ]]; then
+ $LFS setdirstripe -c1 -i1 $testdir2
+ else
+ mkdir $testdir2
+ fi
sync ; echo 3 > /proc/sys/vm/drop_caches
# remove fscrypt key from keyring
keyctl revoke $(keyctl show | awk '$7 ~ "^fscrypt:" {print $1}')
keyctl reap
+ cancel_lru_locks
+
+ # this is $testdir2
+ scrambleddir=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type d| grep _)
+ stat $scrambleddir || error "stat $scrambleddir failed"
+ rmdir $scrambleddir || error "rmdir $scrambleddir failed"
scrambleddir=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type d)
- ls -1 $scrambleddir > $lsfile || error "ls $testdir failed"
+ ls -1 $scrambleddir > $lsfile || error "ls $testdir failed (1)"
scrambledfile=$scrambleddir/$(head -n 1 $lsfile)
- stat $scrambledfile || error "stat $scrambledfile failed"
+ stat $scrambledfile || error "stat $scrambledfile failed (1)"
rm -f $lsfile
- cat $scrambledfile && error "cat $scrambledfile should have failed"
+ cat $scrambledfile && error "cat $scrambledfile should have failed (1)"
+ rm -f $scrambledfile || error "rm $scrambledfile failed (1)"
+
+ ls -1 $scrambleddir > $lsfile || error "ls $testdir failed (2)"
+ scrambledfile=$scrambleddir/$(head -n 1 $lsfile)
+ stat $scrambledfile || error "stat $scrambledfile failed (2)"
+ rm -f $lsfile
+ cat $scrambledfile && error "cat $scrambledfile should have failed (2)"
touch $scrambleddir/otherfile &&
error "touch otherfile should have failed"
error "mkdir otherdir should have failed"
ls -d $scrambleddir/otherdir && error "otherdir should not exist"
- rm -f $scrambledfile || error "rm $scrambledfile failed"
+ ls -R $DIR
+ rm -f $scrambledfile || error "rm $scrambledfile failed (2)"
rmdir $scrambleddir || error "rmdir $scrambleddir failed"
-
- rm -f $DIR/onefile
+ ls -R $DIR
}
run_test 46 "encrypted file access semantics without key"
stack_trap cleanup_for_enc_tests EXIT
setup_for_enc_tests
- dd if=/dev/zero of=$tmpfile bs=512K count=1
+ dd if=/dev/urandom of=$tmpfile bs=512K count=1
mrename $tmpfile $testfile &&
error "rename from unencrypted to encrypted dir should fail"
ln $tmpfile $testfile &&
- error "link from unencrypted to encrypted dir should fail"
+ error "link from encrypted to unencrypted dir should fail"
cp $tmpfile $testfile ||
error "cp from unencrypted to encrypted dir should succeed"
ln $testfile2 $testfile ||
error "link from within encrypted dir should succeed"
+ cmp -bl $testfile2 $testfile ||
+ error "cannot read from hard link (1.1)"
+ echo a >> $testfile || error "cannot write to hard link (1)"
+ cancel_lru_locks
+ cmp -bl $testfile2 $testfile ||
+ error "cannot read from hard link (1.2)"
rm -f $testfile
ln $testfile2 $tmpfile ||
- error "link from encrypted to unencrypted dir should succeed"
+ error "link from unencrypted to encrypted dir should succeed"
+ cancel_lru_locks
+ cmp -bl $testfile2 $tmpfile ||
+ error "cannot read from hard link (2.1)"
+ echo a >> $tmpfile || error "cannot write to hard link (2)"
+ cancel_lru_locks
+ cmp -bl $testfile2 $tmpfile ||
+ error "cannot read from hard link (2.2)"
rm -f $tmpfile
# check we are limited in the number of hard links
ln $testfile2 ${testfile}_$i || break
done
[ $i -lt 160 ] || error "hard link $i should fail"
+ rm -f ${testfile}_*
mrename $testfile2 $tmpfile &&
error "rename from encrypted to unencrypted dir should fail"
- touch $tmpfile
+ rm -f $testfile2
+ dd if=/dev/urandom of=$tmpfile bs=512K count=1
- dd if=/dev/zero of=$testfile bs=512K count=1
+ dd if=/dev/urandom of=$testfile bs=512K count=1
mkdir $DIR/$tdir/mydir
+
+ ln -s $testfile ${testfile}.sym ||
+ error "symlink from within encrypted dir should succeed"
+ cancel_lru_locks
+ cmp -bl $testfile ${testfile}.sym ||
+ error "cannot read from sym link (1.1)"
+ echo a >> ${testfile}.sym || error "cannot write to sym link (1)"
+ cancel_lru_locks
+ cmp -bl $testfile ${testfile}.sym ||
+ error "cannot read from sym link (1.2)"
+ [ $(stat -c %s ${testfile}.sym) -eq ${#testfile} ] ||
+ error "wrong symlink size (1)"
+
+ ln -s $tmpfile ${testfile}.sl ||
+ error "symlink from encrypted to unencrypted dir should succeed"
+ cancel_lru_locks
+ cmp -bl $tmpfile ${testfile}.sl ||
+ error "cannot read from sym link (2.1)"
+ echo a >> ${testfile}.sl || error "cannot write to sym link (2)"
+ cancel_lru_locks
+ cmp -bl $tmpfile ${testfile}.sl ||
+ error "cannot read from sym link (2.2)"
+ [ $(stat -c %s ${testfile}.sl) -eq ${#tmpfile} ] ||
+ error "wrong symlink size (2)"
+ rm -f ${testfile}.sl
+
sync ; echo 3 > /proc/sys/vm/drop_caches
# remove fscrypt key from keyring
keyctl revoke $(keyctl show | awk '$7 ~ "^fscrypt:" {print $1}')
keyctl reap
+ cancel_lru_locks
scrambleddir=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type d)
scrambledfile=$(find $DIR/$tdir/ -maxdepth 1 -type f)
+ scrambledlink=$(find $DIR/$tdir/ -maxdepth 1 -type l)
ln $scrambledfile $scrambleddir/linkfile &&
error "ln linkfile should have failed"
mrename $scrambledfile $DIR/onefile2 &&
touch $DIR/onefile
mrename $DIR/onefile $scrambleddir/otherfile &&
error "mrename to $scrambleddir should have failed"
+ readlink $scrambledlink ||
+ error "link should be read without key"
+ [ $(stat -c %s $scrambledlink) -eq \
+ $(expr length "$(readlink $scrambledlink)") ] ||
+ error "wrong symlink size without key"
+ readlink -e $scrambledlink &&
+ error "link should not point to anywhere useful"
+ ln -s $scrambledfile ${scrambledfile}.sym &&
+ error "symlink without key should fail (1)"
+ ln -s $tmpfile ${scrambledfile}.sl &&
+ error "symlink without key should fail (2)"
rm -f $tmpfile $DIR/onefile
}
trace_cmd() {
local cmd="$@"
- local xattr_name="security.c"
cancel_lru_locks
$LCTL set_param debug=+info
eval $cmd
[ $? -eq 0 ] || error "$cmd failed"
- $LCTL dk | grep -E "get xattr '${xattr_name}'|get xattrs"
+ if [ -z "$MATCHING_STRING" ]; then
+ $LCTL dk | grep -E "get xattr 'security.c'|get xattrs"
+ else
+ $LCTL dk | grep -E "$MATCHING_STRING"
+ fi
[ $? -ne 0 ] || error "get xattr event was triggered"
}
trace_cmd stat $dirname/f1
trace_cmd cat $dirname/f1
dd if=/dev/zero of=$dirname/f1 bs=1M count=10 conv=fsync
- trace_cmd $TRUNCATE $dirname/f1 10240
+ MATCHING_STRING="get xattr 'security.c'" \
+ trace_cmd $TRUNCATE $dirname/f1 10240
trace_cmd $LFS setstripe -E -1 -S 4M $dirname/f2
trace_cmd $LFS migrate -E -1 -S 256K $dirname/f2
trace_cmd stat $dirname/f1
trace_cmd cat $dirname/f1
dd if=/dev/zero of=$dirname/f1 bs=1M count=10 conv=fsync
- trace_cmd $TRUNCATE $dirname/f1 10240
+ MATCHING_STRING="get xattr 'security.c'" \
+ trace_cmd $TRUNCATE $dirname/f1 10240
trace_cmd $LFS setstripe -E -1 -S 4M $dirname/f2
trace_cmd $LFS migrate -E -1 -S 256K $dirname/f2
else
test_54() {
local testdir=$DIR/$tdir/$ID0
local testfile=$testdir/$tfile
- local testfile2=$testdir/${tfile}2
+ local testfile2=$testdir/${tfile}withveryverylongnametoexercisecode
local tmpfile=$TMP/${tfile}.tmp
local resfile=$TMP/${tfile}.res
local filecount=$($RUNAS find $testdir -type f | wc -l)
[ $filecount -eq 3 ] || error "found $filecount files"
- $RUNAS hexdump -C $testfile &&
- error "reading $testfile should have failed without key"
+ scrambledfiles=( $(find $testdir/ -maxdepth 1 -type f) )
+ $RUNAS hexdump -C ${scrambledfiles[0]} &&
+ error "reading ${scrambledfiles[0]} should fail without key"
$RUNAS touch ${testfile}.nokey &&
error "touch ${testfile}.nokey should have failed without key"
$RUNAS fscrypt lock --verbose $testdir ||
error "fscrypt lock $testdir failed (2)"
- $RUNAS hexdump -C $testfile2 &&
- error "reading $testfile2 should have failed without key"
+ $RUNAS hexdump -C ${scrambledfiles[1]} &&
+ error "reading ${scrambledfiles[1]} should fail without key"
echo mypass | $RUNAS fscrypt unlock --verbose $testdir ||
error "fscrypt unlock $testdir failed (2)"
setup_for_enc_tests
mkdir $testdir
- setfattr -n security.c -v myval $testdir &&
+ if [ $(getfattr -n security.c $testdir 2>&1 |
+ grep -ci "Operation not permitted") -eq 0 ]; then
+ error "getting xattr on $testdir should have failed"
+ fi
+ getfattr -d -m - $testdir 2>&1 | grep security\.c &&
+ error "listing xattrs on $testdir should not expose security.c"
+ if [ $(setfattr -n security.c -v myval $testdir 2>&1 |
+ grep -ci "Operation not permitted") -eq 0 ]; then
error "setting xattr on $testdir should have failed (2)"
+ fi
touch $testfile
- setfattr -n security.c -v myval $testfile &&
+ if [ $(getfattr -n security.c $testfile 2>&1 |
+ grep -ci "Operation not permitted") -eq 0 ]; then
+ error "getting xattr on $testfile should have failed"
+ fi
+ getfattr -d -m - $testfile 2>&1 | grep security\.c &&
+ error "listing xattrs on $testfile should not expose security.c"
+ if [ $(setfattr -n security.c -v myval $testfile 2>&1 |
+ grep -ci "Operation not permitted") -eq 0 ]; then
error "setting xattr on $testfile should have failed (2)"
+ fi
return 0
}
run_test 57 "security.c xattr protection"
+test_58() {
+ local testdir=$DIR/$tdir/mytestdir
+ local testfile=$DIR/$tdir/$tfile
+
+ [[ $(facet_fstype ost1) == zfs ]] && skip "skip ZFS backend"
+
+ $LCTL get_param mdc.*.import | grep -q client_encryption ||
+ skip "client encryption not supported"
+
+ mount.lustre --help |& grep -q "test_dummy_encryption:" ||
+ skip "need dummy encryption support"
+
+ stack_trap cleanup_for_enc_tests EXIT
+ setup_for_enc_tests
+
+ touch $DIR/$tdir/$tfile
+ mkdir $DIR/$tdir/subdir
+
+ cancel_lru_locks
+ sync ; sync
+ echo 3 > /proc/sys/vm/drop_caches
+
+ ll_decode_linkea $DIR/$tdir/$tfile || error "cannot read $tfile linkea"
+ ll_decode_linkea $DIR/$tdir/subdir || error "cannot read subdir linkea"
+
+ for ((i = 0; i < 1000; i = $((i+1)))); do
+ mkdir -p $DIR/$tdir/d${i}
+ touch $DIR/$tdir/f${i}
+ createmany -m $DIR/$tdir/d${i}/f 5 > /dev/null
+ done
+
+ cancel_lru_locks
+ sync ; sync
+ echo 3 > /proc/sys/vm/drop_caches
+
+ sleep 10
+ ls -ailR $DIR/$tdir > /dev/null || error "fail to ls"
+}
+run_test 58 "access to enc file's xattrs"
+
log "cleanup: ======================================================"
sec_unsetup() {