1 # Copyright (c) 2008, 2009 Edward Tomasz NapieraĆa <trasz@FreeBSD.org>
3 # Redistribution and use in source and binary forms, with or without
4 # modification, are permitted provided that the following conditions
6 # 1. Redistributions of source code must retain the above copyright
7 # notice, this list of conditions and the following disclaimer.
8 # 2. Redistributions in binary form must reproduce the above copyright
9 # notice, this list of conditions and the following disclaimer in the
10 # documentation and/or other materials provided with the distribution.
12 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
13 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
14 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
15 # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
16 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
17 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
18 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
19 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
20 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
21 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 # This is a tools-level test for NFSv4 ACL functionality with PSARC/2010/029
28 # semantics. Run it as root using ACL-enabled kernel:
30 # /usr/src/tools/regression/acltools/run /usr/src/tools/regression/acltools/tools-nfs4-psarc.test
32 # WARNING: Creates files in unsafe way.
38 # Smoke test for getfacl(1).
44 > owner@:rw-p--aARWcCos:-------:allow
45 > group@:r-----a-R-c--s:-------:allow
46 > everyone@:r-----a-R-c--s:-------:allow
49 > owner@:rw-p--aARWcCos:-------:allow
50 > group@:r-----a-R-c--s:-------:allow
51 > everyone@:r-----a-R-c--s:-------:allow
53 # Check verbose mode formatting.
58 > owner@:read_data/write_data/append_data/read_attributes/write_attributes/read_xattr/write_xattr/read_acl/write_acl/write_owner/synchronize::allow
59 > group@:read_data/read_attributes/read_xattr/read_acl/synchronize::allow
60 > everyone@:read_data/read_attributes/read_xattr/read_acl/synchronize::allow
63 $ setfacl -a2 u:0:write_acl:allow,g:1:read_acl:deny xxx
68 > owner@:rw-p--aARWcCos:-------:allow
69 > group@:r-----a-R-c--s:-------:allow
70 > user:0:-----------C--:-------:allow
71 > group:1:----------c---:-------:deny
72 > everyone@:r-----a-R-c--s:-------:allow
74 # Test user and group name resolving.
77 $ setfacl -a2 u:root:write_acl:allow,g:daemon:read_acl:deny xxx
82 > owner@:rw-p--aARWcCos:-------:allow
83 > group@:r-----a-R-c--s:-------:allow
84 > user:root:-----------C--:-------:allow
85 > group:daemon:----------c---:-------:deny
86 > everyone@:r-----a-R-c--s:-------:allow
88 # Check whether ls correctly marks files with "+".
89 $ ls -l xxx | cut -d' ' -f1
92 # Test removing entries by number.
98 > owner@:rw-p--aARWcCos:-------:allow
99 > user:0:-----------C--:-------:allow
100 > group:1:----------c---:-------:deny
101 > everyone@:r-----a-R-c--s:-------:allow
104 $ setfacl -a0 everyone@:rwx:deny xxx
105 $ setfacl -a0 everyone@:rwx:deny xxx
106 $ setfacl -a0 everyone@:rwx:deny xxx
107 $ setfacl -m everyone@::deny xxx
112 > everyone@:--------------:-------:deny
113 > everyone@:--------------:-------:deny
114 > everyone@:--------------:-------:deny
115 > owner@:rw-p--aARWcCos:-------:allow
116 > user:0:-----------C--:-------:allow
117 > group:1:----------c---:-------:deny
118 > everyone@:r-----a-R-c--s:-------:allow
125 > everyone@:--------------:-------:deny
126 > everyone@:--------------:-------:deny
127 > everyone@:--------------:-------:deny
128 > owner@:rw-p--aARWcCos:-------:allow
129 > user:root:-----------C--:-------:allow:0
130 > group:daemon:----------c---:-------:deny:1
131 > everyone@:r-----a-R-c--s:-------:allow
133 # Make sure cp without any flags does not copy copy the ACL.
135 $ ls -l yyy | cut -d' ' -f1
138 # Make sure it does with the "-p" flag.
145 > everyone@:--------------:-------:deny
146 > everyone@:--------------:-------:deny
147 > everyone@:--------------:-------:deny
148 > owner@:rw-p--aARWcCos:-------:allow
149 > user:0:-----------C--:-------:allow
150 > group:1:----------c---:-------:deny
151 > everyone@:r-----a-R-c--s:-------:allow
155 # Test removing entries by... by example?
156 $ setfacl -x everyone@::deny xxx
161 > owner@:rw-p--aARWcCos:-------:allow
162 > user:0:-----------C--:-------:allow
163 > group:1:----------c---:-------:deny
164 > everyone@:r-----a-R-c--s:-------:allow
172 > owner@:rw-p--aARWcCos:-------:allow
173 > group@:r-----a-R-c--s:-------:allow
174 > everyone@:r-----a-R-c--s:-------:allow
176 $ ls -l xxx | cut -d' ' -f1
179 # Check setfacl(1) and getfacl(1) with multiple files.
182 $ ls -l xxx yyy zzz | cut -d' ' -f1
187 $ setfacl -m u:42:x:allow,g:43:w:allow nnn xxx yyy zzz
188 > setfacl: nnn: acl_get_file() failed: No such file or directory
190 $ ls -l nnn xxx yyy zzz | cut -d' ' -f1
191 > ls: nnn: No such file or directory
196 $ getfacl -nq nnn xxx yyy zzz
197 > getfacl: nnn: stat() failed: No such file or directory
198 > user:42:--x-----------:-------:allow
199 > group:43:-w------------:-------:allow
200 > owner@:rw-p--aARWcCos:-------:allow
201 > group@:r-----a-R-c--s:-------:allow
202 > everyone@:r-----a-R-c--s:-------:allow
204 > user:42:--x-----------:-------:allow
205 > group:43:-w------------:-------:allow
206 > owner@:rw-p--aARWcCos:-------:allow
207 > group@:r-----a-R-c--s:-------:allow
208 > everyone@:r-----a-R-c--s:-------:allow
210 > user:42:--x-----------:-------:allow
211 > group:43:-w------------:-------:allow
212 > owner@:rw-p--aARWcCos:-------:allow
213 > group@:r-----a-R-c--s:-------:allow
214 > everyone@:r-----a-R-c--s:-------:allow
216 $ setfacl -b nnn xxx yyy zzz
217 > setfacl: nnn: acl_get_file() failed: No such file or directory
219 $ ls -l nnn xxx yyy zzz | cut -d' ' -f1
220 > ls: nnn: No such file or directory
227 # Test applying mode to an ACL.
229 $ setfacl -a0 user:42:r:allow,user:43:w:deny,user:43:w:allow,user:44:x:allow -x everyone@::allow xxx
235 > owner@:rw-p--aARWcCos:-------:allow
236 > group@:------a-R-c--s:-------:allow
237 > everyone@:------a-R-c--s:-------:allow
239 $ ls -l xxx | cut -d' ' -f1
245 $ setfacl -a0 user:42:r:allow,user:43:w:deny,user:43:w:allow,user:44:x:allow xxx
251 > owner@:rw-p--aARWcCos:-------:allow
252 > group@:------a-R-c--s:-------:allow
253 > everyone@:------a-R-c--s:-------:allow
254 $ ls -l xxx | cut -d' ' -f1
260 $ setfacl -a0 user:42:r:allow,user:43:w:deny,user:43:w:allow,user:44:x:allow xxx
266 > owner@:rw-p----------:-------:deny
267 > group@:r-------------:-------:deny
268 > owner@:--x---aARWcCos:-------:allow
269 > group@:-w-p--a-R-c--s:-------:allow
270 > everyone@:r-----a-R-c--s:-------:allow
271 $ ls -l xxx | cut -d' ' -f1
277 $ setfacl -a0 user:42:r:allow,user:43:w:deny,user:43:w:allow,user:44:x:allow xxx
283 > owner@:-wxp----------:-------:deny
284 > group@:-w-p----------:-------:deny
285 > owner@:r-----aARWcCos:-------:allow
286 > group@:--x---a-R-c--s:-------:allow
287 > everyone@:-w-p--a-R-c--s:-------:allow
288 $ ls -l xxx | cut -d' ' -f1
292 $ setfacl -a0 group:44:rwapd:allow ddd
293 $ setfacl -a0 group:43:write_data/delete_child:d:deny,group@:ad:allow ddd
294 $ setfacl -a0 user:42:rx:fi:allow,group:42:write_data/delete_child:d:allow ddd
295 $ setfacl -m everyone@:-w-p--a-R-c--s:fi:allow ddd
300 > user:42:r-x-----------:f-i----:allow
301 > group:42:-w--D---------:-d-----:allow
302 > group:43:-w--D---------:-d-----:deny
303 > group@:-----da-------:-------:allow
304 > group:44:rw-p-da-------:-------:allow
305 > owner@:rwxp--aARWcCos:-------:allow
306 > group@:r-x---a-R-c--s:-------:allow
307 > everyone@:-w-p--a-R-c--s:f-i----:allow
314 > owner@:rwxp--aARWcCos:-------:allow
315 > group@:rwxp--a-R-c--s:-------:allow
316 > everyone@:rwxp--a-R-c--s:-------:allow
318 # Test applying ACL to mode.
321 $ setfacl -a0 u:42:rwx:fi:allow ddd
322 $ ls -ld ddd | cut -d' ' -f1
328 $ setfacl -a0 owner@:r:allow,group@:w:deny,group@:wx:allow ddd
329 $ ls -ld ddd | cut -d' ' -f1
335 $ setfacl -a0 owner@:r:allow,group@:w:fi:deny,group@:wx:allow ddd
336 $ ls -ld ddd | cut -d' ' -f1
342 $ setfacl -a0 owner@:r:allow,group:43:w:deny,group:43:wx:allow ddd
343 $ ls -ld ddd | cut -d' ' -f1
349 $ setfacl -a0 owner@:r:allow,user:43:w:deny,user:43:wx:allow ddd
350 $ ls -ld ddd | cut -d' ' -f1
356 $ setfacl -a0 group:43:write_data/write_acl:fin:deny,u:43:rwxp:allow ddd
357 $ setfacl -a0 user:42:rx:fi:allow,group:42:write_data/delete_child:dn:deny ddd
358 $ setfacl -a0 user:42:write_acl/write_owner:fi:allow ddd
359 $ setfacl -a0 group:41:read_data/read_attributes:dni:allow ddd
360 $ setfacl -a0 user:41:write_data/write_attributes:fn:allow ddd
362 > user:41:-w-----A------:f--n---:allow
363 > group:41:r-----a-------:-din---:allow
364 > user:42:-----------Co-:f-i----:allow
365 > user:42:r-x-----------:f-i----:allow
366 > group:42:-w--D---------:-d-n---:deny
367 > group:43:-w---------C--:f-in---:deny
368 > user:43:rwxp----------:-------:allow
369 > owner@:rwxp--aARWcCos:-------:allow
370 > group@:r-x---a-R-c--s:-------:allow
371 > everyone@:r-x---a-R-c--s:-------:allow
376 > user:41:--------------:------I:allow
377 > user:42:--------------:------I:allow
378 > user:42:r-------------:------I:allow
379 > group:43:-w---------C--:------I:deny
380 > owner@:rw-p--aARWcCos:-------:allow
381 > group@:r-----a-R-c--s:-------:allow
382 > everyone@:r-----a-R-c--s:-------:allow
388 > user:41:--------------:------I:allow
389 > user:42:--------------:------I:allow
390 > user:42:--------------:------I:allow
391 > group:43:-w---------C--:------I:deny
392 > owner@:rw-p--aARWcCos:-------:allow
393 > group@:------a-R-c--s:-------:allow
394 > everyone@:------a-R-c--s:-------:allow
400 > owner@:rw-p----------:-------:deny
401 > group@:rw-p----------:-------:deny
402 > user:41:--------------:------I:allow
403 > user:42:--------------:------I:allow
404 > user:42:--------------:------I:allow
405 > group:43:-w---------C--:------I:deny
406 > owner@:------aARWcCos:-------:allow
407 > group@:------a-R-c--s:-------:allow
408 > everyone@:rw-p--a-R-c--s:-------:allow
414 > owner@:rw-p----------:-------:deny
415 > user:41:-w------------:------I:allow
416 > user:42:--------------:------I:allow
417 > user:42:r-------------:------I:allow
418 > group:43:-w---------C--:------I:deny
419 > owner@:------aARWcCos:-------:allow
420 > group@:rw-p--a-R-c--s:-------:allow
421 > everyone@:------a-R-c--s:-------:allow
426 > group:41:------a-------:------I:allow
427 > user:42:-----------Co-:f-i---I:allow
428 > user:42:r-x-----------:f-i---I:allow
429 > group:42:-w--D---------:------I:deny
430 > owner@:rwxp--aARWcCos:-------:allow
431 > group@:------a-R-c--s:-------:allow
432 > everyone@:------a-R-c--s:-------:allow
438 > owner@:rwxp----------:-------:deny
439 > group@:rwxp----------:-------:deny
440 > group:41:------a-------:------I:allow
441 > user:42:-----------Co-:f-i---I:allow
442 > user:42:r-x-----------:f-i---I:allow
443 > group:42:-w--D---------:------I:deny
444 > owner@:------aARWcCos:-------:allow
445 > group@:------a-R-c--s:-------:allow
446 > everyone@:rwxp--a-R-c--s:-------:allow
452 > owner@:rwxp----------:-------:deny
453 > group:41:r-----a-------:------I:allow
454 > user:42:-----------Co-:f-i---I:allow
455 > user:42:r-x-----------:f-i---I:allow
456 > group:42:-w--D---------:------I:deny
457 > owner@:------aARWcCos:-------:allow
458 > group@:rwxp--a-R-c--s:-------:allow
459 > everyone@:------a-R-c--s:-------:allow
461 # There is some complication regarding how write_acl and write_owner flags
462 # get inherited. Make sure we got it right.
464 $ setfacl -a0 u:42:Co:f:allow .
465 $ setfacl -a0 u:43:Co:d:allow .
466 $ setfacl -a0 u:44:Co:fd:allow .
467 $ setfacl -a0 u:45:Co:fi:allow .
468 $ setfacl -a0 u:46:Co:di:allow .
469 $ setfacl -a0 u:47:Co:fdi:allow .
470 $ setfacl -a0 u:48:Co:fn:allow .
471 $ setfacl -a0 u:49:Co:dn:allow .
472 $ setfacl -a0 u:50:Co:fdn:allow .
473 $ setfacl -a0 u:51:Co:fni:allow .
474 $ setfacl -a0 u:52:Co:dni:allow .
475 $ setfacl -a0 u:53:Co:fdni:allow .
480 > user:53:--------------:------I:allow
481 > user:51:--------------:------I:allow
482 > user:50:--------------:------I:allow
483 > user:48:--------------:------I:allow
484 > user:47:--------------:------I:allow
485 > user:45:--------------:------I:allow
486 > user:44:--------------:------I:allow
487 > user:42:--------------:------I:allow
488 > owner@:rw-p--aARWcCos:-------:allow
489 > group@:r-----a-R-c--s:-------:allow
490 > everyone@:r-----a-R-c--s:-------:allow
495 > user:53:--------------:------I:allow
496 > user:52:--------------:------I:allow
497 > user:50:--------------:------I:allow
498 > user:49:--------------:------I:allow
499 > user:47:--------------:fd----I:allow
500 > user:46:--------------:-d----I:allow
501 > user:45:-----------Co-:f-i---I:allow
502 > user:44:--------------:fd----I:allow
503 > user:43:--------------:-d----I:allow
504 > user:42:-----------Co-:f-i---I:allow
505 > owner@:rwxp--aARWcCos:-------:allow
506 > group@:r-x---a-R-c--s:-------:allow
507 > everyone@:r-x---a-R-c--s:-------:allow
510 $ setfacl -a0 u:42:Co:f:deny .
511 $ setfacl -a0 u:43:Co:d:deny .
512 $ setfacl -a0 u:44:Co:fd:deny .
513 $ setfacl -a0 u:45:Co:fi:deny .
514 $ setfacl -a0 u:46:Co:di:deny .
515 $ setfacl -a0 u:47:Co:fdi:deny .
516 $ setfacl -a0 u:48:Co:fn:deny .
517 $ setfacl -a0 u:49:Co:dn:deny .
518 $ setfacl -a0 u:50:Co:fdn:deny .
519 $ setfacl -a0 u:51:Co:fni:deny .
520 $ setfacl -a0 u:52:Co:dni:deny .
521 $ setfacl -a0 u:53:Co:fdni:deny .
526 > user:53:-----------Co-:------I:deny
527 > user:51:-----------Co-:------I:deny
528 > user:50:-----------Co-:------I:deny
529 > user:48:-----------Co-:------I:deny
530 > user:47:-----------Co-:------I:deny
531 > user:45:-----------Co-:------I:deny
532 > user:44:-----------Co-:------I:deny
533 > user:42:-----------Co-:------I:deny
534 > owner@:rw-p--aARWcCos:-------:allow
535 > group@:r-----a-R-c--s:-------:allow
536 > everyone@:r-----a-R-c--s:-------:allow
541 > user:53:-----------Co-:------I:deny
542 > user:52:-----------Co-:------I:deny
543 > user:50:-----------Co-:------I:deny
544 > user:49:-----------Co-:------I:deny
545 > user:47:-----------Co-:fd----I:deny
546 > user:46:-----------Co-:-d----I:deny
547 > user:45:-----------Co-:f-i---I:deny
548 > user:44:-----------Co-:fd----I:deny
549 > user:43:-----------Co-:-d----I:deny
550 > user:42:-----------Co-:f-i---I:deny
551 > owner@:rwxp--aARWcCos:-------:allow
552 > group@:r-x---a-R-c--s:-------:allow
553 > everyone@:r-x---a-R-c--s:-------:allow
561 # Test basic recursive setting of ACLs.
566 $ setfacl -R -m owner@:full_set:f:allow,group@:full_set::allow,everyone@:full_set::allow ddd
568 > owner@:rwxpDdaARWcCos:f------:allow
569 > group@:rwxpDdaARWcCos:-------:allow
570 > everyone@:rwxpDdaARWcCos:-------:allow
572 > owner@:rwxpDdaARWcCos:-------:allow
573 > group@:rwxpDdaARWcCos:-------:allow
574 > everyone@:rwxpDdaARWcCos:-------:allow
576 > owner@:rwxpDdaARWcCos:f------:allow
577 > group@:rwxpDdaARWcCos:-------:allow
578 > everyone@:rwxpDdaARWcCos:-------:allow
579 $ getfacl -q ddd/eee/yyy
580 > owner@:rwxpDdaARWcCos:-------:allow
581 > group@:rwxpDdaARWcCos:-------:allow
582 > everyone@:rwxpDdaARWcCos:-------:allow