5 # The contents of this file are subject to the terms of the
6 # Common Development and Distribution License (the "License").
7 # You may not use this file except in compliance with the License.
9 # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10 # or http://www.opensolaris.org/os/licensing.
11 # See the License for the specific language governing permissions
12 # and limitations under the License.
14 # When distributing Covered Code, include this CDDL HEADER in each
15 # file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16 # If applicable, add the following below this CDDL HEADER, with the
17 # fields enclosed by brackets "[]" replaced with your own identifying
18 # information: Portions Copyright [yyyy] [name of copyright owner]
24 # Copyright 2007 Sun Microsystems, Inc. All rights reserved.
25 # Use is subject to license terms.
29 # Copyright (c) 2013, 2016 by Delphix. All rights reserved.
32 . $STF_SUITE/include/libtest.shlib
37 # The RBAC profile "ZFS File System Management" works
41 # The following actions are taken, both using profile execution (pfexec)
42 # and without profile execution - we make sure that the latter should
46 # 1. As a normal user, try to create a filesystem - which should fail.
47 # 2. Assign "ZFS File System Management" profile, try to create fs again,
48 # which should succeed.
51 # 3. Ensure a user with this profile can't perform pool administration
52 # by attempting to destroy a pool.
55 # 5. Remove the FS profile, then attempt to destroy the fs, which
57 # 6. Assign the FS profile, then attempt to destroy the fs, which
61 verify_runnable "both"
63 if is_linux || is_freebsd; then
64 log_unsupported "Requires pfexec command"
67 log_assert "The RBAC profile \"ZFS File System Management\" works"
69 ZFS_USER=$(<$TEST_BASE_DIR/zfs-privs-test-user.txt)
71 # Set a $DATASET where we can create child files systems
72 if is_global_zone; then
73 log_must zpool create -f $TESTPOOL $DISKS
76 DATASET=zonepool/zonectr0
79 # A user shouldn't be able to create filesystems
80 log_mustnot user_run $ZFS_USER "zfs create $DATASET/zfsprivfs"
82 # Insist this invocation of usermod works
83 log_must usermod -P "ZFS File System Management" $ZFS_USER
85 # Now try to create file systems as the user
86 log_mustnot user_run $ZFS_USER "zfs create $DATASET/zfsprivfs"
87 log_must user_run $ZFS_USER "pfexec zfs create $DATASET/zfsprivfs"
89 # Ensure the user can't do anything to pools in this state:
90 log_mustnot user_run $ZFS_USER "zpool destroy $DATASET"
91 log_mustnot user_run $ZFS_USER "pfexec zpool destroy $DATASET"
93 # revoke File System Management profile
96 # Ensure the user can't create more filesystems
97 log_mustnot user_run $ZFS_USER "zfs create $DATASET/zfsprivfs2"
98 log_mustnot user_run $ZFS_USER "pfexec zfs create $DATASET/zfsprivfs2"
100 # assign the profile again and destroy the fs.
101 usermod -P "ZFS File System Management" $ZFS_USER
102 log_must user_run $ZFS_USER "pfexec zfs destroy $DATASET/zfsprivfs"
103 usermod -P, $ZFS_USER
105 log_pass "The RBAC profile \"ZFS File System Management\" works"