LU-13580 tests: fix retrieval of SELinux context

[fs/lustre-release.git] / lustre / tests / sanity-selinux.sh

diff --git a/lustre/tests/sanity-selinux.sh b/lustre/tests/sanity-selinux.sh
index c08f446..7d9ef93 100755 (executable)
--- a/lustre/tests/sanity-selinux.sh
+++ b/lustre/tests/sanity-selinux.sh
@@ -93,6 +93,13 @@ check_selinux_xattr() {
        echo $xattrval
 }
 
+get_sel_ctx() {
+       local file=$1
+
+       [ -n "$file" ] || return;
+       [ -f $file ] || return;
+       stat $file | awk '$1 == "Context:" {print $2}'
+}
 
 test_1() {
        local devname=$(mdsdevname 1)
@@ -230,7 +237,7 @@ test_5() {
 
        # get sec context
        ls -lZ $filename
-       local secctxseen=$(ls -lZ $filename | awk '{print $4}' | cut -d: -f3)
+       local secctxseen=$(get_sel_ctx $filename | cut -d: -f3)
 
        [ "$newsecctx" == "$secctxseen" ] ||
                error "sec context seen from 1st mount point is not correct"
@@ -254,7 +261,7 @@ test_10() {
 
        # get sec context from 1st mount point
        ls -lZ $filename1
-       local secctxseen=$(ls -lZ $filename1 | awk '{print $4}' | cut -d: -f3)
+       local secctxseen=$(get_sel_ctx $filename1 | cut -d: -f3)
 
        [ "$newsecctx" == "$secctxseen" ] ||
                error_ignore LU-6784 \
@@ -288,12 +295,12 @@ test_20a() {
 
        # get sec info on second mount point
        if [ -e "$filename2" ]; then
-               secinfo2=$(ls -lZ $filename2 | awk '{print $4}')
+               secinfo2=$(get_sel_ctx $filename2)
        fi
 
        # get sec info on first mount point
        wait $touchpid
-       secinfo1=$(ls -lZ $filename1 | awk '{print $4}')
+       secinfo1=$(get_sel_ctx $filename1)
 
        # compare sec contexts
        [ -z "$secinfo2" -o "$secinfo1" == "$secinfo2" ] ||
@@ -422,8 +429,8 @@ trace_cmd() {
 }
 
 test_20d() {
-       if [ $MDS1_VERSION -lt $(version_code 2.12.50) ] ||
-          [ $CLIENT_VERSION -lt $(version_code 2.12.50) ]; then
+       if [ "$MDS1_VERSION" -lt $(version_code 2.12.50) ] ||
+          [ "$CLIENT_VERSION" -lt $(version_code 2.12.50) ]; then
                skip "Need version >= 2.12.50"
        fi
        [ $MDSCOUNT -lt 2 ] && skip "needs >= 2 MDTs"
@@ -465,6 +472,7 @@ check_nodemap() {
        local nm=$1
        local key=$2
        local val=$3
+       local facets=""
        local i
 
        if [ "$nm" == "active" ]; then
@@ -472,17 +480,23 @@ check_nodemap() {
        else
                proc_param="$nm.$key"
        fi
-       is_sync=false
-       for i in $(seq 1 20); do
-               out=$(do_facet mds1 $LCTL get_param -n \
+       # check all MDS nodes, in reverse order to privilege remote ones first
+       for i in $(seq $MDSCOUNT); do
+               facets="mds$i $facets"
+       done
+       for facet in $facets; do
+               is_sync=false
+               for i in {1..20}; do
+                       out=$(do_facet $facet $LCTL get_param -n \
                                   nodemap.$proc_param 2>/dev/null)
-               echo "On mds1, ${proc_param} = $out"
-               [ "$val" == "$out" ] && is_sync=true && break
-               sleep 1
+                       echo "On $facet, ${proc_param} = $out"
+                       [ "$val" == "$out" ] && is_sync=true && break
+                       sleep 1
+               done
+               if ! $is_sync; then
+                       error "$proc_param not updated on $facet after 20 secs"
+               fi
        done
-       if ! $is_sync; then
-               error "$proc_param not updated on mds1 after 20 secs"
-       fi
 }
 
 create_nodemap() {
@@ -504,8 +518,8 @@ create_nodemap() {
        check_nodemap $nm admin_nodemap 1
        check_nodemap $nm trusted_nodemap 1
 
+       sleep 10
        sepol=$(l_getsepol | cut -d':' -f2- | xargs)
-       do_facet mgs $LCTL set_param nodemap.$nm.sepol="$sepol"
        do_facet mgs $LCTL set_param -P nodemap.$nm.sepol="$sepol"
 
        check_nodemap $nm sepol $sepol
@@ -516,17 +530,22 @@ remove_nodemap() {
 
        do_facet mgs $LCTL nodemap_del $nm
 
+       wait_update_facet --verbose mds1 \
+               "$LCTL get_param nodemap.$nm.id 2>/dev/null | \
+               grep -c $nm || true" 0 30 ||
+               error "nodemap $nm could not be removed"
+
        do_facet mgs $LCTL nodemap_activate 0
 
        check_nodemap active x  0
 }
 
 test_21a() {
-       local sepol
-
-       [ $(lustre_version_code $SINGLEMDS) -lt $(version_code 2.11.56) ] &&
+       [ "$MDS1_VERSION" -lt $(version_code 2.11.56) ] &&
                skip "Need MDS >= 2.11.56"
 
+       local sepol
+
        # umount client
        if [ "$MOUNT_2" ] && $(grep -q $MOUNT2' ' /proc/mounts); then
                umount_client $MOUNT2 || error "umount $MOUNT2 failed"
@@ -569,7 +588,6 @@ test_21a() {
 
        # store wrong sepol in nodemap
        sepol="0:policy:0:0000000000000000000000000000000000000000000000000000000000000000"
-       do_facet mgs $LCTL set_param nodemap.c0.sepol="$sepol"
        do_facet mgs $LCTL set_param -P nodemap.c0.sepol="$sepol"
        check_nodemap c0 sepol $sepol
 
@@ -591,11 +609,11 @@ test_21a() {
 run_test 21a "Send sepol at connect"
 
 test_21b() {
-       local sepol
-
-       [ $(lustre_version_code $SINGLEMDS) -lt $(version_code 2.11.56) ] &&
+       [ "$MDS1_VERSION" -lt $(version_code 2.11.56) ] &&
                skip "Need MDS >= 2.11.56"
 
+       local sepol
+
        mkdir -p $DIR/$tdir || error "failed to create $DIR/$tdir"
        echo test > $DIR/$tdir/toopen ||
                error "failed to write to $DIR/$tdir/toopen"
@@ -683,7 +701,6 @@ test_21b() {
 
        # store wrong sepol in nodemap
        sepol="0:policy:0:0000000000000000000000000000000000000000000000000000000000000000"
-       do_facet mgs $LCTL set_param nodemap.c0.sepol="$sepol"
        do_facet mgs $LCTL set_param -P nodemap.c0.sepol="$sepol"
        check_nodemap c0 sepol $sepol
 
@@ -708,12 +725,12 @@ test_21b() {
 
        # reset correct sepol
        sepol=$(l_getsepol | cut -d':' -f2- | xargs)
-       do_facet mgs $LCTL set_param nodemap.c0.sepol="$sepol"
        do_facet mgs $LCTL set_param -P nodemap.c0.sepol="$sepol"
        check_nodemap c0 sepol $sepol
 
-       # metadata ops with sepol every 10 seconds only
-       echo 10 > /sys/module/ptlrpc/parameters/send_sepol
+       # metadata ops with sepol every 1000 seconds only
+       echo 1000 > /sys/module/ptlrpc/parameters/send_sepol
+       local before=$(date +%s)
        touch $DIR/$tdir/f6 || error "touch (4)"
        lfs setstripe -c1 $DIR/$tdir/f7 || error "lfs setstripe (4)"
        mkdir $DIR/$tdir/d6 || error "mkdir (4)"
@@ -762,7 +779,9 @@ test_21b() {
        ln $DIR/$tdir/toopen $DIR/$tdir/toopen_hl5 || error "hardlink (5)"
        echo 3 > /proc/sys/vm/drop_caches
 
-       sleep 10
+       local after=$(date +%s)
+       # change send_sepol to a smaller, already expired, value
+       echo $((after-before-1)) > /sys/module/ptlrpc/parameters/send_sepol
        # metadata ops without matching sepol: should fail now
        touch $DIR/$tdir/f10 && error "touch (6)"
        lfs setstripe -c1 $DIR/$tdir/f11 && error "lfs setstripe (6)"