1 #! /usr/bin/ksh -p
2 #
3 # CDDL HEADER START
4 #
5 # The contents of this file are subject to the terms of the
6 # Common Development and Distribution License (the "License").
7 # You may not use this file except in compliance with the License.
8 #
9 # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10 # or http://www.opensolaris.org/os/licensing.
11 # See the License for the specific language governing permissions
12 # and limitations under the License.
13 #
14 # When distributing Covered Code, include this CDDL HEADER in each
15 # file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16 # If applicable, add the following below this CDDL HEADER, with the
17 # fields enclosed by brackets "[]" replaced with your own identifying
18 # information: Portions Copyright [yyyy] [name of copyright owner]
19 #
20 # CDDL HEADER END
21 #
22
23 #
24 # Copyright 2008 Sun Microsystems, Inc. All rights reserved.
25 # Use is subject to license terms.
26 #
27 # ACL setfacl/getfacl positive basic test
28 # Call setfacl(1) modify 'users' in the ACL entries to an attribute
29 # file; then verify ACLs are set correctly with getfacl(1).
30 #
31
32 [[ -n $DEBUG && $DEBUG != 0 ]] && set -x
33
34 NAME=`basename $0`
35 CDIR=`pwd`
36
37 TESTROOT=${TESTROOT:-"$CDIR/../"}
38
39 # Source for common functions
40 . $CDIR/ACL.utils
41
42 # Preparation: create temp file/directory for testing
43 # Assume MNTPTR is the base test directory.
44 TFILE=$MNTPTR/$NAME.file.$$
45 AFILE=$NAME.attr.$$
46 EFILE=$TMPDIR/$NAME.err.$$
47
48 function test_setup
49 {
50 [[ -n $DEBUG && $DEBUG != 0 ]] && set -x
51
52 echo "\n" > $EFILE
53 echo "This is test file for $NAME" > $TFILE 2>> $EFILE || return $?
54 chmod 0666 $TFILE >> $EFILE 2>&1 || return $?
55 runat $TFILE "echo \"This is attribute file for $TFILE\" \
56 > $AFILE" 2>> $EFILE || return $?
57 runat $TFILE "chmod 0666 $AFILE" 2>> $EFILE | return $?
58 }
59
60 function cleanup
61 {
62 [[ -n $DEBUG && $DEBUG != 0 ]] && set -x
63
64 rm -fr $TFILE $EFILE $TMPDIR/$NAME.*.$$
65 exit $1
66 }
67
68 # Test assertion driver
69 function run_assertion
70 {
71 [[ -n $DEBUG && $DEBUG != 0 ]] && set -x
72
73 OP=${1}
74 TOBJ=${2}
75 ULIST=${3}
76 WHO=$4
77 CKREAD=$5
78
79 echo "\n" > $EFILE
80 set_acls $OP $TOBJ "$ULIST" $WHO $TFILE || return $FAIL
81 get_acls $TOBJ $TMPDIR/$NAME.ga.$$ $TFILE || return $FAIL
82 ck_aces $OP "$ULIST" $TMPDIR/$NAME.ga.$$ || return $FAIL
83 # try to read the file as user in ULIST
84 if [ -n "$CKREAD" ]; then
85 # get the user and try to read
86 user=$(echo $ULIST | nawk -F\: '{print $1}')
87 su $user -c "runat $TFILE \"cat $TOBJ"\" > $TMPDIR/$NAME.ga2.$$ 2>&1
88 case "$CKREAD" in
89 "true")
90 grep "cannot" $TMPDIR/$NAME.ga2.$$ > /dev/null 2>&1
91 if [ $? -ne 0 ]; then
92 echo "\t Test FAIL, user<$user> still can read $TOBJ"
93 grep $user $TMPDIR/$NAME.ga.$$
94 cat $TMPDIR/$NAME.ga2.$$
95 return $FAIL
96 fi ;;
97 "ckattr")
98 grep "file for $TFILE" $TMPDIR/$NAME.ga2.$$ > /dev/null 2>&1
99 if [ $? -ne 0 ]; then
100 echo "\t Test FAIL, user<$user> unable to read $TOBJ"
101 grep $user $TMPDIR/$NAME.ga.$$
102 cat $TMPDIR/$NAME.ga2.$$
103 return $FAIL
104 fi ;;
105 esac
106 [ "$DEBUG" != "0" ] && cat $TMPDIR/$NAME.ga2.$$
107 fi
108
109 echo "\t Test PASS"
110
111 }
112
113 # Start main program here:
114 # ----------------------------------------------------------------------
115 test_setup
116 if [ $? -ne 0 ]; then
117 echo "$NAME{setup}: preparation for $NAME test"
118 echo "\t UNINITIATED - no assertions will be run"
119 cat $EFILE
120 cleanup $UNINITIATED
121 fi
122
123 # Assertions
124 # ----------------------------------------------------------------------
125 # a: setfacl to modify/delete user & perms to an attr file:
126 ULIST="$TUSER1:rwx $TUSER2:rw- $TUSER3:--x sys:r-x"
127 ASSERTION="setfacl to add <$ULIST>\n\tusers to the attribute"
128 ASSERTION="$ASSERTION file, expect successful"
129 echo "$NAME{a}: $ASSERTION"
130 run_assertion m $AFILE "$ULIST" user
131
132 # b: setfacl to modify user & perms in an attr file, expect successful
133 ULIST="$TUSER1:r-x $TUSER3:rwx sys:rw-"
134 ASSERTION="setfacl to modify users <$ULIST>\n\tto the attribute"
135 ASSERTION="$ASSERTION file, expect successful"
136 echo "$NAME{b}: $ASSERTION"
137 run_assertion m $AFILE "$ULIST" user
138
139 # c: setfacl to modify mask in an attr file, expect successful
140 ULIST="mask:--x"
141 ASSERTION="setfacl to modify <$ULIST> to attr file, expect successful"
142 echo "$NAME{c}: $ASSERTION"
143 run_assertion m $AFILE $ULIST none
144
145 # d: verify users' perms are correct after the mask changed
146 ULIST="$TUSER1:--x $TUSER3--x sys:---"
147 ASSERTION="verify effective perms on attr file of users \n\t<$ULIST>"
148 ASSERTION="$ASSERTION set correctly"
149 echo "$NAME{d}: $ASSERTION"
150 get_acls $AFILE $TMPDIR/$NAME.gd.$$ $TFILE && \
151 ck_aces me "$ULIST" $TMPDIR/$NAME.gd.$$ && echo "\t Test PASS"
152
153 # e: setfacl to modify user w/all perms; but can't read the file due to mask
154 ULIST="$TUSER2:rwx"
155 ASSERTION="setfacl to modify <$ULIST> to attr file; but user\n\tshould still"
156 ASSERTION="$ASSERTION not able to read the file due to mask set before."
157 echo "$NAME{e}: $ASSERTION"
158 run_assertion m $AFILE $ULIST user true
159
160 # f: setfacl to modify mask in an attr file, expect successful
161 ULIST="mask:rw-"
162 ASSERTION="reset the mask <$ULIST> to attr file, expect successful"
163 echo "$NAME{f}: $ASSERTION"
164 run_assertion m $AFILE $ULIST none
165
166 # g: verify users' perms are correct after the mask changed
167 ULIST="sys:rw-"
168 ASSERTION="verify effective perms on attr file of user \n\t<$ULIST>"
169 ASSERTION="$ASSERTION set correctly after mask changed."
170 echo "$NAME{g}: $ASSERTION"
171 get_acls $AFILE $TMPDIR/$NAME.gg.$$ $TFILE && \
172 ck_aces me "$ULIST" $TMPDIR/$NAME.gg.$$ && echo "\t Test PASS"
173
174 # h: setfacl to modify user w/all perms; but can't read the file due to mask
175 ULIST="$TUSER3:rw-"
176 ASSERTION="setfacl to modify <$ULIST> to the attr file; user be\n\t"
177 ASSERTION="$ASSERTION able to read the file now due to mask set before."
178 echo "$NAME{h}: $ASSERTION"
179
180 is_cipso "vers=4" $SERVER
181 if [ $? -eq $CIPSO_NFSV4 ]; then
182 echo "Not supported over CIPSO connection.\n\tTest UNSUPPORTED"
183 else
184 run_assertion m $AFILE $ULIST user ckattr
185 fi
186
187 # i: setfacl to delete user & perms in the file, expect successful
188 ULIST="$TUSER1:r-x $TUSER2:r-- $TUSER3:rwx sys:rw-"
189 ASSERTION="delete users <$ULIST>\n\tACLs from the attr file, expect successful"
190 echo "$NAME{i}: $ASSERTION"
191 run_assertion d $AFILE "$ULIST" user
192
193
194 # Finally cleanup and exit
195 cleanup $PASS