1196948Strasz#!/bin/sh 2196948Strasz# $FreeBSD$ 3196948Strasz 4196948Straszdesc="NFSv4 granular permissions checking - DELETE and DELETE_CHILD" 5196948Strasz 6196948Straszdir=`dirname $0` 7196948Strasz. ${dir}/../misc.sh 8196948Strasz 9210984Spjd[ "${os}:${fs}" = "FreeBSD:ZFS" ] || quick_exit 10210984Spjd 11196948Straszecho "1..65" 12196948Strasz 13196948Straszn0=`namegen` 14196948Straszn1=`namegen` 15196948Straszn2=`namegen` 16196948Straszn3=`namegen` 17196948Strasz 18196948Straszexpect 0 mkdir ${n2} 0755 19196948Straszexpect 0 mkdir ${n3} 0777 20196948Straszcdir=`pwd` 21196948Straszcd ${n2} 22196948Strasz 23196948Strasz# Unlink allowed on writable directory. 24196948Straszexpect 0 create ${n0} 0644 25196948Straszexpect EACCES -u 65534 -g 65534 unlink ${n0} 26196948Straszexpect 0 prependacl . user:65534:write_data::allow 27196948Straszexpect 0 -u 65534 -g 65534 unlink ${n0} 28196948Strasz 29196948Strasz# Moving file elsewhere allowed on writable directory. 30196948Straszexpect 0 create ${n0} 0644 31196948Straszexpect 0 prependacl . user:65534:write_data::deny 32196948Straszexpect EACCES -u 65534 -g 65534 rename ${n0} ../${n3}/${n0} 33196948Straszexpect 0 prependacl . user:65534:write_data::allow 34196948Straszexpect 0 -u 65534 -g 65534 rename ${n0} ../${n3}/${n0} 35196948Strasz 36196948Strasz# Moving file from elsewhere allowed on writable directory. 37196948Straszexpect 0 -u 65534 -g 65534 rename ../${n3}/${n0} ${n0} 38196948Straszexpect 0 -u 65534 -g 65534 unlink ${n0} 39196948Strasz 40196948Strasz# Moving file from elsewhere overwriting local file allowed 41196948Strasz# on writable directory. 42196948Straszexpect 0 create ${n0} 0644 43196948Straszexpect 0 create ../${n3}/${n0} 0644 44196948Straszexpect 0 prependacl . user:65534:write_data::deny 45196948Straszexpect EACCES -u 65534 -g 65534 rename ../${n3}/${n0} ${n0} 46196948Straszexpect 0 prependacl . user:65534:write_data::allow 47196948Straszexpect 0 -u 65534 -g 65534 rename ../${n3}/${n0} ${n0} 48196948Straszexpect 0 -u 65534 -g 65534 unlink ${n0} 49196948Strasz 50196948Strasz# Denied DELETE changes nothing wrt removing. 51196948Straszexpect 0 create ${n0} 0644 52196948Straszexpect 0 prependacl ${n0} user:65534:delete::deny 53196948Straszexpect 0 -u 65534 -g 65534 unlink ${n0} 54196948Strasz 55196948Strasz# Denied DELETE changes nothing wrt moving elsewhere or from elsewhere. 56196948Straszexpect 0 create ${n0} 0644 57196948Straszexpect 0 -u 65534 -g 65534 rename ${n0} ../${n3}/${n0} 58196948Straszexpect 0 -u 65534 -g 65534 rename ../${n3}/${n0} ${n0} 59196948Straszexpect 0 -u 65534 -g 65534 unlink ${n0} 60196948Strasz 61196948Strasz# DELETE_CHILD denies unlink on writable directory. 62196948Straszexpect 0 create ${n0} 0644 63196948Straszexpect 0 prependacl . user:65534:delete_child::deny 64196948Straszexpect EPERM -u 65534 -g 65534 unlink ${n0} 65196948Straszexpect 0 unlink ${n0} 66196948Strasz 67196948Strasz# DELETE_CHILD denies moving file elsewhere. 68196948Straszexpect 0 create ${n0} 0644 69196948Straszexpect EPERM -u 65534 -g 65534 rename ${n0} ../${n3}/${n0} 70196948Straszexpect 0 rename ${n0} ../${n3}/${n0} 71196948Strasz 72196948Strasz# DELETE_CHILD does not deny moving file from elsewhere 73196948Strasz# to a writable directory. 74196948Straszexpect 0 -u 65534 -g 65534 rename ../${n3}/${n0} ${n0} 75196948Strasz 76196948Strasz# DELETE_CHILD denies moving file from elsewhere 77196948Strasz# to a writable directory overwriting local file. 78196948Straszexpect 0 create ../${n3}/${n0} 0644 79196948Straszexpect EPERM -u 65534 -g 65534 rename ../${n3}/${n0} ${n0} 80196948Strasz 81196948Strasz# DELETE allowed on file allows for unlinking, no matter 82196948Strasz# what permissions on containing directory are. 83196948Straszexpect 0 prependacl ${n0} user:65534:delete::allow 84196948Straszexpect 0 -u 65534 -g 65534 unlink ${n0} 85196948Strasz 86196948Strasz# Same for moving the file elsewhere. 87196948Straszexpect 0 create ${n0} 0644 88196948Straszexpect 0 prependacl ${n0} user:65534:delete::allow 89196948Straszexpect 0 -u 65534 -g 65534 rename ${n0} ../${n3}/${n0} 90196948Strasz 91196948Strasz# Same for moving the file from elsewhere into a writable 92196948Strasz# directory with DELETE_CHILD denied. 93196948Straszexpect 0 -u 65534 -g 65534 rename ../${n3}/${n0} ${n0} 94196948Straszexpect 0 unlink ${n0} 95196948Strasz 96196948Strasz# DELETE does not allow for overwriting a file in a unwritable 97196948Strasz# directory with DELETE_CHILD denied. 98196948Straszexpect 0 create ${n0} 0644 99196948Straszexpect 0 create ../${n3}/${n0} 0644 100196948Straszexpect 0 prependacl . user:65534:write_data::deny 101196948Straszexpect 0 prependacl . user:65534:delete_child::deny 102196948Straszexpect EPERM -u 65534 -g 65534 rename ../${n3}/${n0} ${n0} 103196948Straszexpect 0 prependacl ${n0} user:65534:delete::allow 104196948Straszexpect EACCES -u 65534 -g 65534 rename ../${n3}/${n0} ${n0} 105196948Strasz 106196948Strasz# But it allows for plain deletion. 107196948Straszexpect 0 -u 65534 -g 65534 unlink ${n0} 108196948Strasz 109196948Strasz# DELETE_CHILD allowed on unwritable directory. 110196948Straszexpect 0 create ${n0} 0644 111196948Straszexpect 0 prependacl . user:65534:delete_child::allow 112196948Straszexpect 0 -u 65534 -g 65534 unlink ${n0} 113196948Strasz 114196948Strasz# Moving things elsewhere is allowed. 115196948Straszexpect 0 create ${n0} 0644 116196948Straszexpect 0 -u 65534 -g 65534 rename ${n0} ../${n3}/${n0} 117196948Strasz 118196948Strasz# Moving things back is not. 119196948Straszexpect EACCES -u 65534 -g 65534 rename ../${n3}/${n0} ${n0} 120196948Strasz 121196948Strasz# Even if we're overwriting. 122196948Straszexpect 0 create ${n0} 0644 123196948Straszexpect EACCES -u 65534 -g 65534 rename ../${n3}/${n0} ${n0} 124196948Strasz 125196948Strasz# Even if we have DELETE on the existing file. 126196948Straszexpect 0 prependacl ${n0} user:65534:delete::allow 127196948Straszexpect EACCES -u 65534 -g 65534 rename ../${n3}/${n0} ${n0} 128196948Strasz 129196948Strasz# Denied DELETE changes nothing wrt removing. 130196948Straszexpect 0 prependacl ${n0} user:65534:delete::deny 131196948Straszexpect 0 -u 65534 -g 65534 unlink ${n0} 132196948Strasz 133196948Straszcd ${cdir} 134196948Straszexpect 0 rmdir ${n2} 135