Skip to contentSkip to conversation

xfstests: 313,314: user namespace uid/gids in inode, ACL

PATCH In review Dwight Engen 3 participants 14 messages Jun 25, 2013 – Aug 19, 2013

lore
Share & tools
lore

Dwight Engen

author
#0 lore raw

PATCH 1/1 xfstests: 313,314: user namespace uid/gids in inode, ACL

These tests verify that the uid/gids in an inode and in ACLs get translated from/to a user namespace to/from disk correctly.

I had to use getfacl instead of the chacl -l because I need numeric uids to make the output consistent.

A new program nsexec was added to facilitate creating/entering a user namespace for testing. The orignal source for the program is
https://lwn.net/Articles/539940. I added the -s option to become "root" in the user namespace.

Tested against btrfs, ext4, and xfs with my proposed user namespace changes.

Signed-off-by Dwight Engen <[email protected]>
---
 .gitignore            |   1 +
 common/attr           |  14 +++
 src/Makefile          |   2 +-
 src/nsexec.c          | 239 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/generic/313     | 107 ++++++++++++++++++++++
 tests/generic/313.out |  20 +++++
 tests/generic/314     | 102 +++++++++++++++++++++
 tests/generic/314.out |  51 +++++++++++
 tests/generic/group   |   2 +
 9 files changed, 537 insertions(+), 1 deletion(-)
 create mode 100644 src/nsexec.c
 create mode 100755 tests/generic/313
 create mode 100644 tests/generic/313.out
 create mode 100755 tests/generic/314
 create mode 100644 tests/generic/314.out
.gitignore +1 -0
index 5aa68c3..fc5050a 100644
@@ -63,6 +63,7 @@
 /src/mmapcat
 /src/multi_open_unlink
 /src/nametest
+/src/nsexec
 /src/permname
 /src/preallo_rw_pattern_reader
 /src/preallo_rw_pattern_writer
common/attr +14 -0
index e5070bf..4a3ac9e 100644
@@ -54,6 +54,20 @@ _acl_filter_id()
        -e "s/ $acl3 / id3 /"
 }
 
+_getfacl_filter_id()
+{
+    sed \
+       -e "s/user:$acl1/user:id1/" \
+       -e "s/user:$acl2/user:id2/" \
+       -e "s/user:$acl3/user:id3/" \
+       -e "s/group:$acl1/group:id1/" \
+       -e "s/group:$acl2/group:id2/" \
+       -e "s/group:$acl3/group:id3/" \
+       -e "s/: $acl1/: id1/" \
+       -e "s/: $acl2/: id2/" \
+       -e "s/: $acl3/: id3/"
+}
+
 # filtered ls
 #
 _acl_ls()
src/Makefile +1 -1
index c18ffc9..4eabdc7 100644
@@ -18,7 +18,7 @@ LINUX_TARGETS = xfsctl bstat t_mtab getdevicesize preallo_rw_pattern_reader \
 	locktest unwritten_mmap bulkstat_unlink_test t_stripealign \
 	bulkstat_unlink_test_modified t_dir_offset t_futimens t_immutable \
 	stale_handle pwrite_mmap_blocked t_dir_offset2 seek_sanity_test \
-	seek_copy_test t_readdir_1 t_readdir_2 fsync-tester
+	seek_copy_test t_readdir_1 t_readdir_2 fsync-tester nsexec
 
 SUBDIRS =
src/nsexec.c new file +239 -0

239 lines not on this page · raw message

tests/generic/313 new file +107 -0

107 lines not on this page · raw message

tests/generic/313.out new file +20 -0
new file mode 100644
index 0000000..eab14c4
@@ -0,0 +1,20 @@
+QA output created by 313
+From init_user_ns
+  File: "$SCRATCH_MNT/file1"
+  Size: 0            Filetype: Regular File
+  Mode: (0644/-rw-r--r--)         Uid: (qa_user)  Gid: (qa_user)
+From user_ns
+  File: "$SCRATCH_MNT/file1"
+  Size: 0            Filetype: Regular File
+  Mode: (0644/-rw-r--r--)         Uid: (0)  Gid: (0)
+
+*** Remounting ***
+
+From init_user_ns
+  File: "$SCRATCH_MNT/file1"
+  Size: 0            Filetype: Regular File
+  Mode: (0644/-rw-r--r--)         Uid: (qa_user)  Gid: (qa_user)
+From user_ns
+  File: "$SCRATCH_MNT/file1"
+  Size: 0            Filetype: Regular File
+  Mode: (0644/-rw-r--r--)         Uid: (0)  Gid: (0)
tests/generic/314 new file +102 -0

102 lines not on this page · raw message

tests/generic/314.out new file +51 -0

51 lines not on this page · raw message

tests/generic/group +2 -0
index bd443c1..ead1cb1 100644
@@ -115,3 +115,5 @@
 310 auto
 311 auto metadata log
 312 auto quick prealloc enospc
+313 auto metadata quick
+314 acl attr auto quick
Signature · 6 lines
1.8.1.4

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs
#1 lore raw
Quoted 6 lines · Dwight Engen

These tests verify that the uid/gids in an inode and in ACLs get translated from/to a user namespace to/from disk correctly.

I had to use getfacl instead of the chacl -l because I need numeric uids to make the output consistent.

Quoted 6 lines

A new program nsexec was added to facilitate creating/entering a user namespace for testing. The orignal source for the program is
https://lwn.net/Articles/539940. I added the -s option to become "root" in the user namespace.

Tested against btrfs, ext4, and xfs with my proposed user namespace changes.

Can you split it out into a patch per test? It's easier to review that way...

Cheers,

Dave.

Signature · 7 lines
Dave Chinner
[email protected]

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs
author
#2 lore raw
Quoted 12 lines · On Wed, 26 Jun 2013 11:09:31 +1000 Dave Chinner <[email protected]> wrote:
Quoted 11 lines · Dwight Engen

These tests verify that the uid/gids in an inode and in ACLs get translated from/to a user namespace to/from disk correctly.

I had to use getfacl instead of the chacl -l because I need numeric uids to make the output consistent.

A new program nsexec was added to facilitate creating/entering a user namespace for testing. The orignal source for the program is
https://lwn.net/Articles/539940. I added the -s option to become "root" in the user namespace.

Quoted 5 lines
Quoted 2 lines

Tested against btrfs, ext4, and xfs with my proposed user namespace changes.

Can you split it out into a patch per test? It's easier to review that way...

Sure, I'll split out adding the nsexec program separately as well.

Quoted 3 lines

Cheers,

Dave.

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs

author
#3 lore raw

PATCH 1/3 xfstests: add nsexec user namespace helper

In reply to Dave Chinner

Add new program nsexec to facilitate creating/entering a user namespace. The orignal source for the program is https://lwn.net/Articles/539940. I added the -s option to become "root" in the user namespace.

Signed-off-by Dwight Engen <[email protected]>
---
 .gitignore   |   1 +
 src/Makefile |   2 +-
 src/nsexec.c | 239 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 241 insertions(+), 1 deletion(-)
 create mode 100644 src/nsexec.c
.gitignore +1 -0
index ad7afbc..23e4c82 100644
@@ -63,6 +63,7 @@
 /src/mmapcat
 /src/multi_open_unlink
 /src/nametest
+/src/nsexec
 /src/permname
 /src/preallo_rw_pattern_reader
 /src/preallo_rw_pattern_writer
src/Makefile +1 -1
index c18ffc9..4eabdc7 100644
@@ -18,7 +18,7 @@ LINUX_TARGETS = xfsctl bstat t_mtab getdevicesize preallo_rw_pattern_reader \
 	locktest unwritten_mmap bulkstat_unlink_test t_stripealign \
 	bulkstat_unlink_test_modified t_dir_offset t_futimens t_immutable \
 	stale_handle pwrite_mmap_blocked t_dir_offset2 seek_sanity_test \
-	seek_copy_test t_readdir_1 t_readdir_2 fsync-tester
+	seek_copy_test t_readdir_1 t_readdir_2 fsync-tester nsexec
 
 SUBDIRS =
src/nsexec.c new file +239 -0

239 lines not on this page · raw message

Signature · 6 lines
1.8.1.4

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs
Reviewed-by on v1 1/3
#5 lore raw

Re: [PATCH 1/3] xfstests: add nsexec user namespace helper

In reply to Dwight Engen

Thanks for the patch Dwight, it has been committed.

--Rich

commit 3f424be6396205edd6aec1d46de04349aebe9306

Author: Dwight Engen <[email protected]>
Date:   Thu Jun 27 16:03:28 2013 +0000

xfstests: add nsexec user namespace helper

Add new program nsexec to facilitate creating/entering a user
namespace. The
original source for the program is https://lwn.net/Articles/539940.
I added
the -s option to become "root" in the user namespace.

Signed-off-by Dwight Engen <[email protected]>
Reviewed-by <[email protected]>
Signed-off-by <[email protected]>

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs

author
#6 lore raw

PATCH 2/3 xfstests 313: user namespace uid/gids in an inode

In reply to Dave Chinner
Signed-off-by Dwight Engen <[email protected]>
---
 tests/generic/313     | 107 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/generic/313.out |  20 ++++++++++
 tests/generic/group   |   1 +
 3 files changed, 128 insertions(+)
 create mode 100644 tests/generic/313
 create mode 100644 tests/generic/313.out
tests/generic/313 new file +107 -0
new file mode 100644
index 0000000..0dd6213
@@ -0,0 +1,107 @@
+#! /bin/bash
+# FS QA Test No. 313
+#
+# Check uid/gid to/from disk with a user namespace. A new file
+# will be created from inside a userns. We check that the uid/gid
+# is correct from both inside the userns and also from init_user_ns.
+# We will then unmount and remount the file system and check the
+# uid/gid from both inside the userns and from init_user_ns to show
+# that the correct uid was flushed and brought back from disk.
+#
+#-----------------------------------------------------------------------
+# Copyright (C) 2013 Oracle, Inc.  All Rights Reserved.
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it would be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write the Free Software Foundation,
+# Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+#-----------------------------------------------------------------------
+#
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+
+_cleanup()
+{
+    cd /
+    umount $SCRATCH_DEV >/dev/null 2>&1
+}
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/attr
+
+nsexec=$here/src/nsexec
+lstat64=$here/src/lstat64
+file=$SCRATCH_MNT/file1
+
+# real QA test starts here
+_supported_fs generic
+# only Linux supports user namespace
+_supported_os Linux
+
+[ -x $nsexec  ] || _notrun "$nsexec executable not found"
+[ -x $lstat64 ] || _notrun "$lstat64 executable not found"
+
+rm -f $seqres.full
+
+_require_scratch
+_need_to_be_root
+_require_user
+qa_user_id=`grep $qa_user /etc/passwd |awk -F: '{print $3}'`
+
+_filter_output()
+{
+    sed \
+      -e "s/$qa_user_id/qa_user/g" \
+      -e "s!$SCRATCH_MNT!\$SCRATCH_MNT!"
+}
+
+_print_numeric_uid()
+{
+    echo "From init_user_ns"
+    $here/src/lstat64 $file |head -3 |_filter_output
+
+    echo "From user_ns"
+    $nsexec -s -U -M "0 $qa_user_id 1000" -G "0 $qa_user_id 1000" $here/src/lstat64 $file |head -3 |_filter_output
+}
+
+umount $SCRATCH_DEV >/dev/null 2>&1
+echo "*** MKFS ***" >>$seqres.full
+echo ""             >>$seqres.full
+_scratch_mkfs       >>$seqres.full 2>&1 || _fail "mkfs failed"
+_scratch_mount      >>$seqres.full 2>&1 || _fail "mount failed"
+chmod 777 $SCRATCH_MNT
+
+# create $file as "root" in userns, which is $qa_user in parent namespace
+$nsexec -s -U -M "0 $qa_user_id 1000" -G "0 $qa_user_id 1000" touch $file
+
+_print_numeric_uid
+
+echo ""
+echo "*** Remounting ***"
+echo ""
+sync
+umount $SCRATCH_MNT >>$seqres.full 2>&1
+_scratch_mount      >>$seqres.full 2>&1 || _fail "mount failed"
+
+_print_numeric_uid
+
+umount $SCRATCH_DEV >/dev/null 2>&1
+status=0
+exit
tests/generic/313.out new file +20 -0
new file mode 100644
index 0000000..eab14c4
@@ -0,0 +1,20 @@
+QA output created by 313
+From init_user_ns
+  File: "$SCRATCH_MNT/file1"
+  Size: 0            Filetype: Regular File
+  Mode: (0644/-rw-r--r--)         Uid: (qa_user)  Gid: (qa_user)
+From user_ns
+  File: "$SCRATCH_MNT/file1"
+  Size: 0            Filetype: Regular File
+  Mode: (0644/-rw-r--r--)         Uid: (0)  Gid: (0)
+
+*** Remounting ***
+
+From init_user_ns
+  File: "$SCRATCH_MNT/file1"
+  Size: 0            Filetype: Regular File
+  Mode: (0644/-rw-r--r--)         Uid: (qa_user)  Gid: (qa_user)
+From user_ns
+  File: "$SCRATCH_MNT/file1"
+  Size: 0            Filetype: Regular File
+  Mode: (0644/-rw-r--r--)         Uid: (0)  Gid: (0)
tests/generic/group +1 -0
index bd443c1..5c2b4d7 100644
@@ -115,3 +115,4 @@
 310 auto
 311 auto metadata log
 312 auto quick prealloc enospc
+313 auto metadata quick
Signature · 6 lines
1.8.1.4

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs
Reviewed-by on v1 2/3
#8 lore raw

Re: [PATCH 2/3] xfstests 313: user namespace uid/gids in an inode

In reply to Dwight Engen

Thanks for splitting the original patch Dwight, this patch has been committed.

--Rich

commit 531a2473ce411fdc0af07d7ef86b2aaadf239b39

Author: Dwight Engen <[email protected]>
Date:   Thu Jun 27 16:03:34 2013 +0000

xfstests generic/317: user namespace uid/gids in an inode

[rjohnston: renumbered test to 317]

Signed-off-by Dwight Engen <[email protected]>
Reviewed-by <[email protected]>
Signed-off-by <[email protected]>

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs

author
#9 lore raw

PATCH 3/3 xfstests 314: user namespace uid/gids in an ACL

In reply to Dave Chinner
Signed-off-by Dwight Engen <[email protected]>
---
 common/attr           |  14 +++++++
 tests/generic/314     | 102 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/generic/314.out |  51 +++++++++++++++++++++++++
 tests/generic/group   |   1 +
 4 files changed, 168 insertions(+)
 create mode 100644 tests/generic/314
 create mode 100644 tests/generic/314.out
common/attr +14 -0
index e5070bf..4a3ac9e 100644
@@ -54,6 +54,20 @@ _acl_filter_id()
        -e "s/ $acl3 / id3 /"
 }
 
+_getfacl_filter_id()
+{
+    sed \
+       -e "s/user:$acl1/user:id1/" \
+       -e "s/user:$acl2/user:id2/" \
+       -e "s/user:$acl3/user:id3/" \
+       -e "s/group:$acl1/group:id1/" \
+       -e "s/group:$acl2/group:id2/" \
+       -e "s/group:$acl3/group:id3/" \
+       -e "s/: $acl1/: id1/" \
+       -e "s/: $acl2/: id2/" \
+       -e "s/: $acl3/: id3/"
+}
+
 # filtered ls
 #
 _acl_ls()
tests/generic/314 new file +102 -0

102 lines not on this page · raw message

tests/generic/314.out new file +51 -0

51 lines not on this page · raw message

tests/generic/group +1 -0
index 5c2b4d7..ead1cb1 100644
@@ -116,3 +116,4 @@
 311 auto metadata log
 312 auto quick prealloc enospc
 313 auto metadata quick
+314 acl attr auto quick
Signature · 6 lines
1.8.1.4

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs
#10 lore raw

Re: [PATCH 3/3] xfstests 314: user namespace uid/gids in an ACL

Quoted 13 lines · Dwight Engen
Signed-off-by Dwight Engen <[email protected]>
tests/generic/314 new file +11 -0
+#! /bin/bash
+# FS QA Test No. 314
+#
+# Check get/set ACLs to/from disk with a user namespace. A new file
+# will be created and ACLs set on it from both inside a userns and
+# from init_user_ns. We check that the ACL is is correct from both
+# inside the userns and also from init_user_ns. We will then unmount
+# and remount the file system and check the ACL from both inside the
+# userns and from init_user_ns to show that the correct uid/gid in
+# the ACL was flushed and brought back from disk.
+#

...

tests/generic/314 line 70

Quoted 5 lines
tests/generic/314 new file +5 -0
+
+_print_getfacls()
+{
+    echo "From init_user_ns"
+    getfacl -n $file 2>/dev/null | _getfacl_filter_id | sed -e "s!$SCRATCH_MNT!\$SCRATCH_MNT!"

I think you need to loose the last sed command and use the getfacl flag --absolute-names and pipe it to _filter_scratch like this:

getfacl --absolute-names -n $file 2>/dev/null | _filter_scratch | _getfacl_filter_id

tests/generic/314 line 73

Quoted 3 lines
tests/generic/314 new file +3 -0
+
+    echo "From user_ns"
+    $nsexec -U -M "0 $acl1 1000" -G "0 $acl2 1000" getfacl -n $file  2>/dev/null | _getfacl_filter_id | sed -e "s!$SCRATCH_MNT!\$SCRATCH_MNT!"

Same as above.
...
Also need to update 314.out

I tested with these changes as test 316 but not sure if the new output is correct.

--Rich

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs

author
#11 lore raw

Re: [PATCH 3/3] xfstests 314: user namespace uid/gids in an ACL

Quoted 27 lines · On Mon, 19 Aug 2013 09:11:09 -0500 Rich Johnston <[email protected]> wrote:
Quoted 13 lines · Dwight Engen
Signed-off-by Dwight Engen <[email protected]>
tests/generic/314 new file +7 -0
+#! /bin/bash
+# FS QA Test No. 314
+#
+# Check get/set ACLs to/from disk with a user namespace. A new file
+# will be created and ACLs set on it from both inside a userns and
+# from init_user_ns. We check that the ACL is is correct from both
+# inside the userns and also from init_user_ns. We will then

unmount +# and remount the file system and check the ACL from both inside the +# userns and from init_user_ns to show that the correct uid/gid in +# the ACL was flushed and brought back from disk. +#

...

Quoted 6 lines
tests/generic/314 new file +5 -0
+
+_print_getfacls()
+{
+    echo "From init_user_ns"
+    getfacl -n $file 2>/dev/null | _getfacl_filter_id | sed -e

"s!$SCRATCH_MNT!\$SCRATCH_MNT!"

I think you need to loose the last sed command and use the getfacl flag --absolute-names and pipe it to _filter_scratch like this:

Quoted 2 lines

getfacl --absolute-names -n $file 2>/dev/null | _filter_scratch | _getfacl_filter_id

Yep good catch, the scratch mount point was making it into the .out file.

Quoted 11 lines
Quoted 5 lines
tests/generic/314 new file +3 -0
+
+    echo "From user_ns"
+    $nsexec -U -M "0 $acl1 1000" -G "0 $acl2 1000" getfacl -n

$file 2>/dev/null | _getfacl_filter_id | sed -e
"s!$SCRATCH_MNT!\$SCRATCH_MNT!"

Same as above.
...
Also need to update 314.out

I tested with these changes as test 316 but not sure if the new output is correct.

Yes it looks correct with these changes, updated patch to follow.

Quoted 1 line

--Rich

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs

author
#12 lore raw

PATCH v2 1/1 xfstests generic/318: user namespace uid/gids in an ACL

In reply to Rich Johnston
Signed-off-by Dwight Engen <[email protected]>

---
v2 Fixed to use --absolute-names and _filter_scratch to get reproducible
pathnames in the .out file, renumbered to 318 and rebased onto 531a2473.

 common/attr           |  14 +++++++
 tests/generic/318     | 102 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/generic/318.out |  51 +++++++++++++++++++++++++
 tests/generic/group   |   1 +
 4 files changed, 168 insertions(+)
 create mode 100755 tests/generic/318
 create mode 100644 tests/generic/318.out
common/attr +14 -0
index e5070bf..4a3ac9e 100644
@@ -54,6 +54,20 @@ _acl_filter_id()
        -e "s/ $acl3 / id3 /"
 }
 
+_getfacl_filter_id()
+{
+    sed \
+       -e "s/user:$acl1/user:id1/" \
+       -e "s/user:$acl2/user:id2/" \
+       -e "s/user:$acl3/user:id3/" \
+       -e "s/group:$acl1/group:id1/" \
+       -e "s/group:$acl2/group:id2/" \
+       -e "s/group:$acl3/group:id3/" \
+       -e "s/: $acl1/: id1/" \
+       -e "s/: $acl2/: id2/" \
+       -e "s/: $acl3/: id3/"
+}
+
 # filtered ls
 #
 _acl_ls()
tests/generic/318 new file +102 -0

102 lines not on this page · raw message

tests/generic/318.out new file +51 -0

51 lines not on this page · raw message

tests/generic/group +1 -0
index 59baf9e..1aee03c 100644
@@ -120,3 +120,4 @@
 315 auto quick rw prealloc
 316 auto quick
 317 auto metadata quick
+318 acl attr auto quick
Signature · 6 lines
1.8.1.4

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs
Reviewed-by on v2 1/1
#13 lore raw

Re: [PATCH v2] xfstests generic/318: user namespace uid/gids in an ACL

Looks good Dwight, thanks for reworking the patch, it has been committed.

commit 511f9be2595f4d9bc4447335d839227d85969e8a

Author: Dwight Engen <[email protected]>
Date:   Mon Aug 19 17:34:42 2013 +0000

xfstests generic/318: user namespace uid/gids in an ACL

Signed-off-by Dwight Engen <[email protected]>
Reviewed-by Rich Johnston <[email protected]>
Signed-off-by Rich Johnston <[email protected]>

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs