From 5b5f03d2665687ab717f123da1266bcd3a83da0f Mon Sep 17 00:00:00 2001 From: Poornima G Date: Fri, 26 Feb 2016 06:42:14 -0500 Subject: fuse: Add a new mount option capability Originally all security.* xattrs were forbidden if selinux is disabled, which was causing Samba's acl_xattr module to not work, as it would store the NTACL in security.NTACL. To fix this http://review.gluster.org/#/c/12826/ was sent, which forbid only security.selinux. This opened up a getxattr call on security.capability before every write fop and others. Capabilities can be used without selinux, hence if selinux is disabled, security.capability cannot be forbidden. Hence adding a new mount option called capability. Only when "--capability" or "--selinux" mount option is used, security.capability is sent to the brick, else it is forbidden. Change-Id: I77f60e0fb541deaa416159e45c78dd2ae653105e BUG: 1309462 Signed-off-by: Poornima G Reviewed-on: http://review.gluster.org/13540 Smoke: Gluster Build System NetBSD-regression: NetBSD Build System CentOS-regression: Gluster Build System Reviewed-by: Raghavendra G --- tests/bugs/fuse/bug-1309462.t | 49 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 tests/bugs/fuse/bug-1309462.t (limited to 'tests/bugs') diff --git a/tests/bugs/fuse/bug-1309462.t b/tests/bugs/fuse/bug-1309462.t new file mode 100644 index 00000000000..f3b74bd2935 --- /dev/null +++ b/tests/bugs/fuse/bug-1309462.t @@ -0,0 +1,49 @@ +#!/bin/bash +# +# https://bugzilla.redhat.com/show_bug.cgi?id=1309462 +# Test the new fuse mount option --capability. +# Set/get xattr on security.capability should be sent +# down from fuse, only if --selinux or --capability option +# is used for mounting. + +. $(dirname $0)/../../include.rc + +cleanup; + +#Basic checks +TEST glusterd +TEST pidof glusterd + +#Create a distributed volume +TEST $CLI volume create $V0 $H0:$B0/${V0}{1..2}; +TEST $CLI volume start $V0 + +# Mount FUSE without selinux: +TEST glusterfs -s $H0 --volfile-id $V0 $M0 + +TESTFILE="$M0/testfile" +TEST touch ${TESTFILE} + +TEST ! setfattr -n security.capability -v value ${TESTFILE} +TEST ! getfattr -n security.capability ${TESTFILE} + +TEST umount $M0 + +# Mount FUSE with selinux: +TEST glusterfs -s $H0 --volfile-id $V0 --selinux $M0 + +TEST setfattr -n security.capability -v value ${TESTFILE} +TEST getfattr -n security.capability ${TESTFILE} +TEST setfattr -x security.capability ${TESTFILE} + +TEST umount $M0 + +# Mount FUSE with capability: +TEST glusterfs -s $H0 --volfile-id $V0 --capability $M0 + +TEST setfattr -n security.capability -v value ${TESTFILE} +TEST getfattr -n security.capability ${TESTFILE} +TEST setfattr -x security.capability ${TESTFILE} + +TEST umount $M0 + -- cgit