[ $GSS_SUP = 0 ] && skip "without GSS support." && return
rm -rf $DIR/$tdir
- mkdir -p $DIR/$tdir
+ mkdir_on_mdt0 $DIR/$tdir
chown $USER0 $DIR/$tdir || error "chown (1)"
$RUNAS_CMD -u $ID1 -v $ID0 touch $DIR/$tdir/f0 && error "touch (2)"
add_idmaps() {
local i
local cmd="$LCTL nodemap_add_idmap"
+ local do_proj=true
local rc=0
+ (( $MDS1_VERSION >= $(version_code 2.14.52) )) || do_proj=false
+
echo "Start to add idmaps ..."
for ((i = 0; i < NODEMAP_COUNT; i++)); do
local j
--idmap $client_id:$fs_id; then
rc=$((rc + 1))
fi
+ if $do_proj; then
+ if ! do_facet mgs $cmd --name $csum \
+ --idtype projid --idmap \
+ $client_id:$fs_id; then
+ rc=$((rc + 1))
+ fi
+ fi
done
done
delete_idmaps() {
local i
local cmd="$LCTL nodemap_del_idmap"
+ local do_proj=true
local rc=0
+ (( $MDS1_VERSION >= $(version_code 2.14.52) )) || do_proj=false
+
echo "Start to delete idmaps ..."
for ((i = 0; i < NODEMAP_COUNT; i++)); do
local j
--idmap $client_id:$fs_id; then
rc=$((rc + 1))
fi
+ if $do_proj; then
+ if ! do_facet mgs $cmd --name $csum \
+ --idtype projid --idmap \
+ $client_id:$fs_id; then
+ rc=$((rc + 1))
+ fi
+ fi
done
done
cmd[0]="$LCTL nodemap_modify --property squash_uid"
cmd[1]="$LCTL nodemap_modify --property squash_gid"
+ cmd[2]="$LCTL nodemap_modify --property squash_projid"
if ! do_facet mgs ${cmd[$3]} --name $1 --value $2; then
return 1
fi
}
-wait_nm_sync() {
- local nodemap_name=$1
- local key=$2
- local value=$3
- local opt=$4
- local proc_param
- local is_active=$(do_facet mgs $LCTL get_param -n nodemap.active)
- local max_retries=20
- local is_sync
- local out1=""
- local out2
- local mgs_ip=$(host_nids_address $mgs_HOST $NETTYPE | cut -d' ' -f1)
- local i
-
- if [ "$nodemap_name" == "active" ]; then
- proc_param="active"
- elif [ -z "$key" ]; then
- proc_param=${nodemap_name}
- else
- proc_param="${nodemap_name}.${key}"
- fi
- if [ "$opt" == "inactive" ]; then
- # check nm sync even if nodemap is not activated
- is_active=1
- opt=""
- fi
- (( is_active == 0 )) && [ "$proc_param" != "active" ] && return
-
- if [ -z "$value" ]; then
- out1=$(do_facet mgs $LCTL get_param $opt \
- nodemap.${proc_param} 2>/dev/null)
- echo "On MGS ${mgs_ip}, ${proc_param} = $out1"
- else
- out1=$value;
- fi
-
- # wait up to 10 seconds for other servers to sync with mgs
- for i in $(seq 1 10); do
- for node in $(all_server_nodes); do
- local node_ip=$(host_nids_address $node $NETTYPE |
- cut -d' ' -f1)
-
- is_sync=true
- if [ -z "$value" ]; then
- [ $node_ip == $mgs_ip ] && continue
- fi
-
- out2=$(do_node $node_ip $LCTL get_param $opt \
- nodemap.$proc_param 2>/dev/null)
- echo "On $node ${node_ip}, ${proc_param} = $out2"
- [ "$out1" != "$out2" ] && is_sync=false && break
- done
- $is_sync && break
- sleep 1
- done
- if ! $is_sync; then
- echo MGS
- echo $out1
- echo OTHER - IP: $node_ip
- echo $out2
- error "mgs and $nodemap_name ${key} mismatch, $i attempts"
- fi
- echo "waited $((i - 1)) seconds for sync"
-}
-
# ensure that the squash defaults are the expected defaults
squash_id default 99 0
wait_nm_sync default squash_uid '' inactive
squash_id default 99 1
wait_nm_sync default squash_gid '' inactive
+if [ "$MDS1_VERSION" -ge $(version_code 2.14.50) ]; then
+ squash_id default 99 2
+ wait_nm_sync default squash_projid '' inactive
+fi
test_nid() {
local cmd
[[ $rc != 0 ]] && error "nodemap squash_gid with $rc" && return 3
rc=0
+ if (( $MDS1_VERSION >= $(version_code 2.14.52) )); then
+ for ((i = 0; i < NODEMAP_COUNT; i++)); do
+ if ! squash_id ${HOSTNAME_CHECKSUM}_${i} 88 2; then
+ rc=$((rc + 1))
+ fi
+ done
+ fi
+ [[ $rc != 0 ]] && error "nodemap squash_projid with $rc" && return 5
+
+ rc=0
delete_nodemaps
rc=$?
[[ $rc != 0 ]] && error "nodemap_del failed with $rc" && return 4
rc=$?
[[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 1
+ for (( i = 0; i < NODEMAP_COUNT; i++ )); do
+ local csum=${HOSTNAME_CHECKSUM}_${i}
+
+ if ! do_facet mgs $LCTL nodemap_modify --name $csum \
+ --property admin --value 0; then
+ rc=$((rc + 1))
+ fi
+ if ! do_facet mgs $LCTL nodemap_modify --name $csum \
+ --property trusted --value 0; then
+ rc=$((rc + 1))
+ fi
+ done
+ [[ $rc != 0 ]] && error "nodemap_modify failed with $rc" && return 1
+
rc=0
for ((i = 0; i < NODEMAP_COUNT; i++)); do
if ! add_range ${HOSTNAME_CHECKSUM}_${i} $i; then
nodemap_exercise_fileset() {
local nm="$1"
local loop=0
+ local check_proj=true
+
+ (( $MDS1_VERSION >= $(version_code 2.14.52) )) || check_proj=false
# setup
if [ "$nm" == "default" ]; then
do_facet mgs $LCTL nodemap_activate 1
wait_nm_sync active
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property admin --value 1
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property trusted --value 1
+ wait_nm_sync default admin_nodemap
+ wait_nm_sync default trusted_nodemap
+ check_proj=false
else
nodemap_test_setup
fi
error "unable to add fileset info to $nm nodemap for servers"
wait_nm_sync $nm fileset "nodemap.${nm}.fileset=/$subdir"
+ if $check_proj; then
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property admin --value 1
+ wait_nm_sync $nm admin_nodemap
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property trusted --value 0
+ wait_nm_sync $nm trusted_nodemap
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property map_mode --value projid
+ wait_nm_sync $nm map_mode
+ do_facet mgs $LCTL nodemap_add_idmap --name $nm \
+ --idtype projid --idmap 1:1
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property deny_unknown --value 1
+ wait_nm_sync $nm deny_unknown
+ fi
+
# re-mount client
zconf_umount_clients ${clients_arr[0]} $MOUNT ||
error "unable to umount client ${clients_arr[0]}"
do_node ${clients_arr[0]} test -f $MOUNT/this_is_$subdir ||
error "fileset not taken into account"
+ if $check_proj; then
+ do_node ${clients_arr[0]} $LFS setquota -p 1 -b 10000 -B 11000 \
+ -i 0 -I 0 $MOUNT || error "setquota -p 1 failed"
+ do_node ${clients_arr[0]} $LFS setquota -p 2 -b 10000 -B 11000 \
+ -i 0 -I 0 $MOUNT && error "setquota -p 2 should fail"
+ fi
+
# re-mount client with sub-subdir
zconf_umount_clients ${clients_arr[0]} $MOUNT ||
error "unable to umount client ${clients_arr[0]}"
fi
fileset_test_cleanup "$nm"
if [ "$nm" == "default" ]; then
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property admin --value 0
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property trusted --value 0
+ wait_nm_sync default admin_nodemap
+ wait_nm_sync default trusted_nodemap
do_facet mgs $LCTL nodemap_activate 0
wait_nm_sync active 0
trap 0
}
run_test 35 "Check permissions when accessing changelogs"
+setup_dummy_key() {
+ local mode='\x00\x00\x00\x00'
+ local raw="$(printf ""\\\\x%02x"" {0..63})"
+ local size
+ local key
+
+ [[ $(lscpu) =~ Byte\ Order.*Little ]] && size='\x40\x00\x00\x00' ||
+ size='\x00\x00\x00\x40'
+ key="${mode}${raw}${size}"
+ echo -n -e "${key}" | keyctl padd logon fscrypt:4242424242424242 @s
+}
+
setup_for_enc_tests() {
# remount client with test_dummy_encryption option
if is_mounted $MOUNT; then
}
cleanup_for_enc_tests() {
+ local dummy_key
+
+ rm -rf $DIR/$tdir $*
+
# remount client normally
if is_mounted $MOUNT; then
umount_client $MOUNT || error "umount $MOUNT failed"
mount_client $MOUNT2 ${MOUNT_OPTS} ||
error "remount failed"
fi
+
+ # remove fscrypt key from keyring
+ dummy_key=$(keyctl show | awk '$7 ~ "^fscrypt:" {print $1}')
+ if [ -n "$dummy_key" ]; then
+ keyctl revoke $dummy_key
+ keyctl reap
+ fi
}
cleanup_nodemap_after_enc_tests() {
local tmpfile=$TMP/abc
local tmpfile2=$TMP/abc2
local seek
+ local filesz
+ #define LUSTRE_ENCRYPTION_UNIT_SIZE (1 << 12)
+ local UNIT_SIZE=$((1 << 12))
+ local scrambledfile
$LCTL get_param mdc.*.import | grep -q client_encryption ||
skip "client encryption not supported"
cmp -bl $tmpfile $testfile ||
error "file $testfile is corrupted on server (5)"
+ filesz=$(stat --format=%s $testfile)
+ filesz=$(((filesz+UNIT_SIZE-1)/UNIT_SIZE * UNIT_SIZE))
+
+ sync ; echo 3 > /proc/sys/vm/drop_caches
+
+ # remove fscrypt key from keyring
+ keyctl revoke $(keyctl show | awk '$7 ~ "^fscrypt:" {print $1}')
+ keyctl reap
+
+ scrambledfile=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type f)
+ [ $(stat --format=%s $scrambledfile) -eq $filesz ] ||
+ error "file size without key should be rounded up"
+
rm -f $tmpfile
}
run_test 40 "exercise size of encrypted file"
test_46() {
local testdir=$DIR/$tdir/mydir
local testfile=$testdir/myfile
+ local testdir2=$DIR/$tdir/mydirwithaveryverylongnametotestcodebehaviour0
+ local testfile2=$testdir/myfilewithaveryverylongnametotestcodebehaviour0
+ # testdir3, testfile3, testhl3 and testsl3 names are 255 bytes long
+ local testdir3=$testdir2/dir_abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz012345678
+ local testfile3=$testdir2/file_abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz01234567
+ local testhl3=$testdir2/hl_abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789
+ local testsl3=$testdir2/sl_abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789
local lsfile=$TMP/lsfile
local scrambleddir
local scrambledfile
- local testfile2=$DIR/$tdir/${tfile}.2
- local tmpfile=$DIR/junk
-
$LCTL get_param mdc.*.import | grep -q client_encryption ||
skip "client encryption not supported"
stack_trap cleanup_for_enc_tests EXIT
setup_for_enc_tests
- touch $DIR/onefile
touch $DIR/$tdir/$tfile
mkdir $testdir
echo test > $testfile
+ echo othertest > $testfile2
+ if [[ $MDSCOUNT -gt 1 ]]; then
+ $LFS setdirstripe -c1 -i1 $testdir2
+ else
+ mkdir $testdir2
+ fi
+ if [ "$mds1_FSTYPE" = ldiskfs ]; then
+ # For now, restrict this part of the test to ldiskfs backend,
+ # as osd-zfs does not support 255 byte-long encrypted names.
+ mkdir $testdir3 || error "cannot mkdir $testdir3"
+ touch $testfile3 || error "cannot touch $testfile3"
+ ln $testfile3 $testhl3 || error "cannot ln $testhl3"
+ ln -s $testfile3 $testsl3 || error "cannot ln $testsl3"
+ fi
sync ; echo 3 > /proc/sys/vm/drop_caches
# remove fscrypt key from keyring
keyctl revoke $(keyctl show | awk '$7 ~ "^fscrypt:" {print $1}')
keyctl reap
+ cancel_lru_locks
+
+ # this is $testdir2
+ scrambleddir=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type d| grep _)
+ stat $scrambleddir || error "stat $scrambleddir failed"
+ if [ "$mds1_FSTYPE" = ldiskfs ]; then
+ stat $scrambleddir/* || error "cannot stat in $scrambleddir"
+ rm -rf $scrambleddir/* || error "cannot clean in $scrambleddir"
+ fi
+ rmdir $scrambleddir || error "rmdir $scrambleddir failed"
scrambleddir=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type d)
- ls -1 $scrambleddir > $lsfile || error "ls $testdir failed"
+ ls -1 $scrambleddir > $lsfile || error "ls $testdir failed (1)"
scrambledfile=$scrambleddir/$(head -n 1 $lsfile)
- stat $scrambledfile || error "stat $scrambledfile failed"
+ stat $scrambledfile || error "stat $scrambledfile failed (1)"
rm -f $lsfile
- cat $scrambledfile && error "cat $scrambledfile should have failed"
+ cat $scrambledfile && error "cat $scrambledfile should have failed (1)"
+ rm -f $scrambledfile || error "rm $scrambledfile failed (1)"
+
+ ls -1 $scrambleddir > $lsfile || error "ls $testdir failed (2)"
+ scrambledfile=$scrambleddir/$(head -n 1 $lsfile)
+ stat $scrambledfile || error "stat $scrambledfile failed (2)"
+ rm -f $lsfile
+ cat $scrambledfile && error "cat $scrambledfile should have failed (2)"
touch $scrambleddir/otherfile &&
error "touch otherfile should have failed"
error "mkdir otherdir should have failed"
ls -d $scrambleddir/otherdir && error "otherdir should not exist"
- rm -f $scrambledfile || error "rm $scrambledfile failed"
+ ls -R $DIR
+ rm -f $scrambledfile || error "rm $scrambledfile failed (2)"
rmdir $scrambleddir || error "rmdir $scrambleddir failed"
-
- rm -f $DIR/onefile
+ ls -R $DIR
}
run_test 46 "encrypted file access semantics without key"
stack_trap cleanup_for_enc_tests EXIT
setup_for_enc_tests
- dd if=/dev/zero of=$tmpfile bs=512K count=1
+ dd if=/dev/urandom of=$tmpfile bs=512K count=1
mrename $tmpfile $testfile &&
error "rename from unencrypted to encrypted dir should fail"
ln $tmpfile $testfile &&
- error "link from unencrypted to encrypted dir should fail"
+ error "link from encrypted to unencrypted dir should fail"
cp $tmpfile $testfile ||
error "cp from unencrypted to encrypted dir should succeed"
ln $testfile2 $testfile ||
error "link from within encrypted dir should succeed"
+ cmp -bl $testfile2 $testfile ||
+ error "cannot read from hard link (1.1)"
+ echo a >> $testfile || error "cannot write to hard link (1)"
+ cancel_lru_locks
+ cmp -bl $testfile2 $testfile ||
+ error "cannot read from hard link (1.2)"
rm -f $testfile
ln $testfile2 $tmpfile ||
- error "link from encrypted to unencrypted dir should succeed"
+ error "link from unencrypted to encrypted dir should succeed"
+ cancel_lru_locks
+ cmp -bl $testfile2 $tmpfile ||
+ error "cannot read from hard link (2.1)"
+ echo a >> $tmpfile || error "cannot write to hard link (2)"
+ cancel_lru_locks
+ cmp -bl $testfile2 $tmpfile ||
+ error "cannot read from hard link (2.2)"
rm -f $tmpfile
# check we are limited in the number of hard links
ln $testfile2 ${testfile}_$i || break
done
[ $i -lt 160 ] || error "hard link $i should fail"
+ rm -f ${testfile}_*
mrename $testfile2 $tmpfile &&
error "rename from encrypted to unencrypted dir should fail"
- touch $tmpfile
+ rm -f $testfile2
+ dd if=/dev/urandom of=$tmpfile bs=512K count=1
- dd if=/dev/zero of=$testfile bs=512K count=1
+ dd if=/dev/urandom of=$testfile bs=512K count=1
mkdir $DIR/$tdir/mydir
+
+ ln -s $testfile ${testfile}.sym ||
+ error "symlink from within encrypted dir should succeed"
+ cancel_lru_locks
+ cmp -bl $testfile ${testfile}.sym ||
+ error "cannot read from sym link (1.1)"
+ echo a >> ${testfile}.sym || error "cannot write to sym link (1)"
+ cancel_lru_locks
+ cmp -bl $testfile ${testfile}.sym ||
+ error "cannot read from sym link (1.2)"
+ [ $(stat -c %s ${testfile}.sym) -eq ${#testfile} ] ||
+ error "wrong symlink size (1)"
+
+ ln -s $tmpfile ${testfile}.sl ||
+ error "symlink from encrypted to unencrypted dir should succeed"
+ cancel_lru_locks
+ cmp -bl $tmpfile ${testfile}.sl ||
+ error "cannot read from sym link (2.1)"
+ echo a >> ${testfile}.sl || error "cannot write to sym link (2)"
+ cancel_lru_locks
+ cmp -bl $tmpfile ${testfile}.sl ||
+ error "cannot read from sym link (2.2)"
+ [ $(stat -c %s ${testfile}.sl) -eq ${#tmpfile} ] ||
+ error "wrong symlink size (2)"
+ rm -f ${testfile}.sl
+
sync ; echo 3 > /proc/sys/vm/drop_caches
# remove fscrypt key from keyring
keyctl revoke $(keyctl show | awk '$7 ~ "^fscrypt:" {print $1}')
keyctl reap
+ cancel_lru_locks
scrambleddir=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type d)
scrambledfile=$(find $DIR/$tdir/ -maxdepth 1 -type f)
+ scrambledlink=$(find $DIR/$tdir/ -maxdepth 1 -type l)
ln $scrambledfile $scrambleddir/linkfile &&
error "ln linkfile should have failed"
mrename $scrambledfile $DIR/onefile2 &&
touch $DIR/onefile
mrename $DIR/onefile $scrambleddir/otherfile &&
error "mrename to $scrambleddir should have failed"
+ readlink $scrambledlink ||
+ error "link should be read without key"
+ [ $(stat -c %s $scrambledlink) -eq \
+ $(expr length "$(readlink $scrambledlink)") ] ||
+ error "wrong symlink size without key"
+ readlink -e $scrambledlink &&
+ error "link should not point to anywhere useful"
+ ln -s $scrambledfile ${scrambledfile}.sym &&
+ error "symlink without key should fail (1)"
+ ln -s $tmpfile ${scrambledfile}.sl &&
+ error "symlink without key should fail (2)"
rm -f $tmpfile $DIR/onefile
}
cmp -bl $tmpfile $testfile ||
error "file $testfile is corrupted (4)"
- # lockless truncate should be turned into regular truncate for enc file
- save_lustre_params client "osc.*.lockless_truncate" > $save
- # restore lockless_truncate default values on exit
- stack_trap "restore_lustre_params < $save; rm -f $save" EXIT
- cancel_lru_locks osc ; cancel_lru_locks mdc
- lctl set_param -n osc.*.lockless_truncate 1
- cancel_lru_locks osc
- clear_stats osc.*.osc_stats
- $TRUNCATE $testfile 8000000 || error "truncate failed (1)"
- [ $(calc_stats osc.*.osc_stats lockless_truncate) -eq 0 ] ||
- error "lockless truncate should be turned into regular truncate"
- lctl set_param -n osc.*.lockless_truncate 0
-
# truncate to a smaller, non-multiple of PAGE_SIZE, non-multiple of 16
sz=$((sz-7))
$TRUNCATE $tmpfile $sz
trace_cmd() {
local cmd="$@"
- local xattr_name="security.c"
cancel_lru_locks
$LCTL set_param debug=+info
eval $cmd
[ $? -eq 0 ] || error "$cmd failed"
- $LCTL dk | grep -E "get xattr '${xattr_name}'|get xattrs"
+ if [ -z "$MATCHING_STRING" ]; then
+ $LCTL dk | grep -E "get xattr 'security.c'|get xattrs"
+ else
+ $LCTL dk | grep -E "$MATCHING_STRING"
+ fi
[ $? -ne 0 ] || error "get xattr event was triggered"
}
mkdir $dirname
trace_cmd stat $dirname
- trace_cmd touch $dirname/f1
+ trace_cmd echo a > $dirname/f1
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd stat $dirname/f1
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd cat $dirname/f1
dd if=/dev/zero of=$dirname/f1 bs=1M count=10 conv=fsync
- trace_cmd $TRUNCATE $dirname/f1 10240
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
+ MATCHING_STRING="get xattr 'security.c'" \
+ trace_cmd $TRUNCATE $dirname/f1 10240
trace_cmd $LFS setstripe -E -1 -S 4M $dirname/f2
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd $LFS migrate -E -1 -S 256K $dirname/f2
if [[ $MDSCOUNT -gt 1 ]]; then
trace_cmd $LFS setdirstripe -i 1 $dirname/d2
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd $LFS migrate -m 0 $dirname/d2
- touch $dirname/d2/subf
+ echo b > $dirname/d2/subf
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
# migrate a non-empty encrypted dir
trace_cmd $LFS migrate -m 1 $dirname/d2
$LFS setdirstripe -i 1 -c 1 $dirname/d3
dirname=$dirname/d3/subdir
mkdir $dirname
-
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd stat $dirname
- trace_cmd touch $dirname/f1
+ trace_cmd echo c > $dirname/f1
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd stat $dirname/f1
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd cat $dirname/f1
dd if=/dev/zero of=$dirname/f1 bs=1M count=10 conv=fsync
- trace_cmd $TRUNCATE $dirname/f1 10240
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
+ MATCHING_STRING="get xattr 'security.c'" \
+ trace_cmd $TRUNCATE $dirname/f1 10240
trace_cmd $LFS setstripe -E -1 -S 4M $dirname/f2
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd $LFS migrate -E -1 -S 256K $dirname/f2
else
skip_noexit "2nd part needs >= 2 MDTs"
[[ $OSTCOUNT -lt 2 ]] && skip_env "needs >= 2 OSTs"
- stack_trap cleanup_for_enc_tests EXIT
+ stack_trap "cleanup_for_enc_tests $tmpfile $mirror1 $mirror2" EXIT
setup_for_enc_tests
dd if=/dev/urandom of=$tmpfile bs=5000 count=1 conv=fsync
$LFS mirror verify -v $testfile &&
error "mirrors should be different"
- rm -f $tmpfile $mirror1 $mirror2
+ rm -f $testfile $mirror1 $mirror2
+
+ $LFS setstripe -c1 -i0 $testfile
+ dd if=$tmpfile of=$testfile bs=9000 count=1 conv=fsync ||
+ error "write to $testfile failed"
+ $LFS getstripe $testfile
+ cancel_lru_locks
+
+ $LFS migrate -i1 $testfile ||
+ error "migrate $testfile failed"
+ $LFS getstripe $testfile
+ stripe=$($LFS getstripe -i $testfile)
+ [ $stripe -eq 1 ] || error "migrate file $testfile failed"
+
+ cancel_lru_locks
+ cmp -bl $tmpfile $testfile ||
+ error "migrated file is corrupted"
+
+ $LFS mirror extend -N -i0 $testfile ||
+ error "mirror extend $testfile failed"
+ $LFS getstripe $testfile
+ mirror_count=$($LFS getstripe -N $testfile)
+ [ $mirror_count -eq 2 ] ||
+ error "mirror extend file $testfile failed (1)"
+ stripe=$($LFS getstripe --mirror-id=1 -i $testfile)
+ [ $stripe -eq 1 ] || error "mirror extend file $testfile failed (2)"
+ stripe=$($LFS getstripe --mirror-id=2 -i $testfile)
+ [ $stripe -eq 0 ] || error "mirror extend file $testfile failed (3)"
+
+ cancel_lru_locks
+ $LFS mirror verify -v $testfile ||
+ error "mirror verify failed"
+ $LFS mirror read -N 1 -o $mirror1 $testfile ||
+ error "read from mirror 1 failed"
+ cmp -bl $tmpfile $mirror1 ||
+ error "corruption of mirror 1"
+ $LFS mirror read -N 2 -o $mirror2 $testfile ||
+ error "read from mirror 2 failed"
+ cmp -bl $tmpfile $mirror2 ||
+ error "corruption of mirror 2"
+
+ $LFS mirror split --mirror-id 1 -f ${testfile}.mirror $testfile &&
+ error "mirror split -f should fail"
+
+ $LFS mirror split --mirror-id 1 $testfile &&
+ error "mirror split without -d should fail"
+
+ $LFS mirror split --mirror-id 1 -d $testfile ||
+ error "mirror split failed"
+ $LFS getstripe $testfile
+ mirror_count=$($LFS getstripe -N $testfile)
+ [ $mirror_count -eq 1 ] ||
+ error "mirror split file $testfile failed (1)"
+ stripe=$($LFS getstripe --mirror-id=1 -i $testfile)
+ [ -z "$stripe" ] || error "mirror extend file $testfile failed (2)"
+ stripe=$($LFS getstripe --mirror-id=2 -i $testfile)
+ [ $stripe -eq 0 ] || error "mirror extend file $testfile failed (3)"
+
+ cancel_lru_locks
+ cmp -bl $tmpfile $testfile ||
+ error "extended/split file is corrupted"
}
run_test 52 "Mirrored encrypted file"
test_54() {
local testdir=$DIR/$tdir/$ID0
local testfile=$testdir/$tfile
- local testfile2=$testdir/${tfile}2
+ local testfile2=$testdir/${tfile}withveryverylongnametoexercisecode
local tmpfile=$TMP/${tfile}.tmp
local resfile=$TMP/${tfile}.res
local filecount=$($RUNAS find $testdir -type f | wc -l)
[ $filecount -eq 3 ] || error "found $filecount files"
- $RUNAS hexdump -C $testfile &&
- error "reading $testfile should have failed without key"
+ scrambledfiles=( $(find $testdir/ -maxdepth 1 -type f) )
+ $RUNAS hexdump -C ${scrambledfiles[0]} &&
+ error "reading ${scrambledfiles[0]} should fail without key"
$RUNAS touch ${testfile}.nokey &&
error "touch ${testfile}.nokey should have failed without key"
$RUNAS fscrypt lock --verbose $testdir ||
error "fscrypt lock $testdir failed (2)"
- $RUNAS hexdump -C $testfile2 &&
- error "reading $testfile2 should have failed without key"
+ $RUNAS hexdump -C ${scrambledfiles[1]} &&
+ error "reading ${scrambledfiles[1]} should fail without key"
echo mypass | $RUNAS fscrypt unlock --verbose $testdir ||
error "fscrypt unlock $testdir failed (2)"
}
test_55() {
+ (( $MDS1_VERSION > $(version_code 2.12.6.2) )) ||
+ skip "Need MDS version at least 2.12.6.3"
+
local client_ip
local client_nid
setup_for_enc_tests
mkdir $testdir
- setfattr -n security.c -v myval $testdir &&
+ if [ $(getfattr -n security.c $testdir 2>&1 |
+ grep -ci "Operation not permitted") -eq 0 ]; then
+ error "getting xattr on $testdir should have failed"
+ fi
+ getfattr -d -m - $testdir 2>&1 | grep security\.c &&
+ error "listing xattrs on $testdir should not expose security.c"
+ if [ $(setfattr -n security.c -v myval $testdir 2>&1 |
+ grep -ci "Operation not permitted") -eq 0 ]; then
error "setting xattr on $testdir should have failed (2)"
+ fi
touch $testfile
- setfattr -n security.c -v myval $testfile &&
+ if [ $(getfattr -n security.c $testfile 2>&1 |
+ grep -ci "Operation not permitted") -eq 0 ]; then
+ error "getting xattr on $testfile should have failed"
+ fi
+ getfattr -d -m - $testfile 2>&1 | grep security\.c &&
+ error "listing xattrs on $testfile should not expose security.c"
+ if [ $(setfattr -n security.c -v myval $testfile 2>&1 |
+ grep -ci "Operation not permitted") -eq 0 ]; then
error "setting xattr on $testfile should have failed (2)"
+ fi
return 0
}
run_test 57 "security.c xattr protection"
+test_58() {
+ local testdir=$DIR/$tdir/mytestdir
+ local testfile=$DIR/$tdir/$tfile
+
+ [[ $(facet_fstype ost1) == zfs ]] && skip "skip ZFS backend"
+
+ $LCTL get_param mdc.*.import | grep -q client_encryption ||
+ skip "client encryption not supported"
+
+ mount.lustre --help |& grep -q "test_dummy_encryption:" ||
+ skip "need dummy encryption support"
+
+ stack_trap cleanup_for_enc_tests EXIT
+ setup_for_enc_tests
+
+ touch $DIR/$tdir/$tfile
+ mkdir $DIR/$tdir/subdir
+
+ cancel_lru_locks
+ sync ; sync
+ echo 3 > /proc/sys/vm/drop_caches
+
+ ll_decode_linkea $DIR/$tdir/$tfile || error "cannot read $tfile linkea"
+ ll_decode_linkea $DIR/$tdir/subdir || error "cannot read subdir linkea"
+
+ for ((i = 0; i < 1000; i = $((i+1)))); do
+ mkdir -p $DIR/$tdir/d${i}
+ touch $DIR/$tdir/f${i}
+ createmany -m $DIR/$tdir/d${i}/f 5 > /dev/null
+ done
+
+ cancel_lru_locks
+ sync ; sync
+ echo 3 > /proc/sys/vm/drop_caches
+
+ sleep 10
+ ls -ailR $DIR/$tdir > /dev/null || error "fail to ls"
+}
+run_test 58 "access to enc file's xattrs"
+
+insert_enc_key() {
+ sync ; echo 3 > /proc/sys/vm/drop_caches
+ setup_dummy_key
+}
+
+remove_env_key() {
+ cancel_lru_locks
+ sync ; echo 3 > /proc/sys/vm/drop_caches
+ keyctl revoke $(keyctl show | awk '$7 ~ "^fscrypt:" {print $1}')
+ keyctl reap
+}
+
+verify_mirror() {
+ local mirror1=$TMP/$tfile.mirror1
+ local mirror2=$TMP/$tfile.mirror2
+ local testfile=$1
+ local reffile=$2
+
+ $LFS mirror verify -vvv $testfile ||
+ error "verifying mirror failed (1)"
+ if [ $($LFS mirror verify -v $testfile 2>&1 |
+ grep -ci "only valid") -ne 0 ]; then
+ error "verifying mirror failed (2)"
+ fi
+
+ $LFS mirror read -N 1 -o $mirror1 $testfile ||
+ error "read from mirror 1 failed"
+ cmp -bl $reffile $mirror1 ||
+ error "corruption of mirror 1"
+ $LFS mirror read -N 2 -o $mirror2 $testfile ||
+ error "read from mirror 2 failed"
+ cmp -bl $reffile $mirror2 ||
+ error "corruption of mirror 2"
+}
+
+test_59a() {
+ local testfile=$DIR/$tdir/$tfile
+ local tmpfile=$TMP/$tfile
+ local mirror1=$TMP/$tfile.mirror1
+ local mirror2=$TMP/$tfile.mirror2
+ local scrambledfile
+
+ $LCTL get_param mdc.*.import | grep -q client_encryption ||
+ skip "client encryption not supported"
+
+ mount.lustre --help |& grep -q "test_dummy_encryption:" ||
+ skip "need dummy encryption support"
+
+ [[ $OSTCOUNT -lt 2 ]] && skip_env "needs >= 2 OSTs"
+
+ stack_trap "cleanup_for_enc_tests $tmpfile $mirror1 $mirror2" EXIT
+ setup_for_enc_tests
+
+ dd if=/dev/urandom of=$tmpfile bs=5000 count=1 conv=fsync
+
+ $LFS mirror create -N -i0 -N -i1 $testfile ||
+ error "could not create mirror"
+ dd if=$tmpfile of=$testfile bs=5000 count=1 conv=fsync ||
+ error "could not write to $testfile"
+ $LFS getstripe $testfile
+
+ # now, without the key
+ remove_env_key
+ scrambledfile=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type f)
+ $LFS mirror resync $scrambledfile ||
+ error "could not resync mirror"
+
+ $LFS mirror verify -vvv $scrambledfile ||
+ error "mirror verify failed (1)"
+ if [ $($LFS mirror verify -v $scrambledfile 2>&1 |
+ grep -ci "only valid") -ne 0 ]; then
+ error "mirror verify failed (2)"
+ fi
+
+ $LFS mirror read -N 1 -o $mirror1 $scrambledfile &&
+ error "read from mirror should fail"
+
+ # now, with the key
+ insert_enc_key
+ verify_mirror $testfile $tmpfile
+}
+run_test 59a "mirror resync of encrypted files without key"
+
+test_59b() {
+ local testfile=$DIR/$tdir/$tfile
+ local tmpfile=$TMP/$tfile
+ local mirror1=$TMP/$tfile.mirror1
+ local mirror2=$TMP/$tfile.mirror2
+ local scrambledfile
+
+ $LCTL get_param mdc.*.import | grep -q client_encryption ||
+ skip "client encryption not supported"
+
+ mount.lustre --help |& grep -q "test_dummy_encryption:" ||
+ skip "need dummy encryption support"
+
+ [[ $OSTCOUNT -lt 2 ]] && skip_env "needs >= 2 OSTs"
+
+ stack_trap "cleanup_for_enc_tests $tmpfile $mirror1 $mirror2" EXIT
+ setup_for_enc_tests
+
+ tr '\0' '2' < /dev/zero |
+ dd of=$tmpfile bs=1 count=9000 conv=fsync
+
+ $LFS setstripe -c1 -i0 $testfile
+ dd if=$tmpfile of=$testfile bs=9000 count=1 conv=fsync ||
+ error "write to $testfile failed"
+ $LFS getstripe $testfile
+
+ # now, without the key
+ remove_env_key
+ scrambledfile=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type f)
+ $LFS migrate -i1 $scrambledfile ||
+ error "migrate $scrambledfile failed"
+ $LFS getstripe $scrambledfile
+ stripe=$($LFS getstripe -i $scrambledfile)
+ [ $stripe -eq 1 ] || error "migrate file $scrambledfile failed"
+ cancel_lru_locks
+
+ # now, with the key
+ insert_enc_key
+ cmp -bl $tmpfile $testfile ||
+ error "migrated file is corrupted"
+
+ # now, without the key
+ remove_env_key
+ $LFS mirror extend -N -i0 $scrambledfile ||
+ error "mirror extend $scrambledfile failed (1)"
+ $LFS getstripe $scrambledfile
+ mirror_count=$($LFS getstripe -N $scrambledfile)
+ [ $mirror_count -eq 2 ] ||
+ error "mirror extend file $scrambledfile failed (2)"
+ stripe=$($LFS getstripe --mirror-id=1 -i $scrambledfile)
+ [ $stripe -eq 1 ] ||
+ error "mirror extend file $scrambledfile failed (3)"
+ stripe=$($LFS getstripe --mirror-id=2 -i $scrambledfile)
+ [ $stripe -eq 0 ] ||
+ error "mirror extend file $scrambledfile failed (4)"
+
+ $LFS mirror verify -vvv $scrambledfile ||
+ error "mirror verify failed (1)"
+ if [ $($LFS mirror verify -v $scrambledfile 2>&1 |
+ grep -ci "only valid") -ne 0 ]; then
+ error "mirror verify failed (2)"
+ fi
+
+ # now, with the key
+ insert_enc_key
+ verify_mirror $testfile $tmpfile
+
+ # now, without the key
+ remove_env_key
+ $LFS mirror split --mirror-id 1 -d $scrambledfile ||
+ error "mirror split file $scrambledfile failed (1)"
+ $LFS getstripe $scrambledfile
+ mirror_count=$($LFS getstripe -N $scrambledfile)
+ [ $mirror_count -eq 1 ] ||
+ error "mirror split file $scrambledfile failed (2)"
+ stripe=$($LFS getstripe --mirror-id=1 -i $scrambledfile)
+ [ -z "$stripe" ] || error "mirror split file $scrambledfile failed (3)"
+ stripe=$($LFS getstripe --mirror-id=2 -i $scrambledfile)
+ [ $stripe -eq 0 ] || error "mirror split file $scrambledfile failed (4)"
+
+ # now, with the key
+ insert_enc_key
+ cancel_lru_locks
+ cmp -bl $tmpfile $testfile ||
+ error "extended/split file is corrupted"
+}
+run_test 59b "migrate/extend/split of encrypted files without key"
+
+test_59c() {
+ local dirname=$DIR/$tdir/subdir
+ local scrambleddir
+
+ $LCTL get_param mdc.*.import | grep -q client_encryption ||
+ skip "client encryption not supported"
+
+ mount.lustre --help |& grep -q "test_dummy_encryption:" ||
+ skip "need dummy encryption support"
+
+ [[ $MDSCOUNT -ge 2 ]] || skip_env "needs >= 2 MDTs"
+
+ stack_trap "cleanup_for_enc_tests" EXIT
+ setup_for_enc_tests
+
+ $LFS setdirstripe -i 0 $dirname
+ echo b > $dirname/subf
+
+ # now, without the key
+ remove_env_key
+ scrambleddir=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type d)
+
+ # migrate a non-empty encrypted dir
+ $LFS migrate -m 1 $scrambleddir ||
+ error "migrate $scrambleddir between MDTs failed (1)"
+
+ stripe=$($LFS getdirstripe -i $scrambleddir)
+ [ $stripe -eq 1 ] ||
+ error "migrate $scrambleddir between MDTs failed (2)"
+}
+run_test 59c "MDT migrate of encrypted files without key"
+
log "cleanup: ======================================================"
sec_unsetup() {
git://git.whamcloud.com / fs / lustre-release.git / blobdiff