43 lines
2.6 KiB
Bash
43 lines
2.6 KiB
Bash
as() { local u=$1; shift; runuser -u "$u" -- "$@"; }
|
|
# getfacl lines, with "#effective:" only where the mask limits an entry.
|
|
acl() { getfacl -cp "$1" 2>/dev/null | tr '\t' ' '; }
|
|
# Every ACL under a directory, in name order: getfacl -R lists files in
|
|
# directory order, which on XFS differs between a tree and its copy.
|
|
acl_tree() { (cd "$1" && find . -print0 | LC_ALL=C sort -z | xargs -0 getfacl 2>/dev/null); }
|
|
|
|
# Task 2 is tried with a new file from eve (umask 077) and one from dana
|
|
# (umask 022), removed again at once.
|
|
t2_eve='' t2_dana=''
|
|
f=/srv/project/le-lab-check-eve
|
|
if as eve bash -c "umask 077; echo x >$f" 2>/dev/null; then
|
|
as dana test -w "$f" && t2_eve=yes
|
|
fi
|
|
rm -f "$f"
|
|
f=/srv/project/le-lab-check-dana
|
|
if as dana bash -c "umask 022; echo x >$f" 2>/dev/null; then
|
|
as eve test -w "$f" && t2_dana=yes
|
|
fi
|
|
rm -f "$f"
|
|
|
|
task 1 "alice can read and write /srv/reports and its files"
|
|
need "alice isn't in group finance" '! id -nG alice | grep -qw finance'
|
|
need "/srv/reports and its files still belong to group finance" '[ "$(stat -c %G /srv/reports /srv/reports/q3-summary.txt /srv/reports/budget-2027.txt | sort -u)" = finance ]'
|
|
need "getfacl /srv/reports shows user:alice:rwx, not limited by the mask" 'acl /srv/reports | grep -qx "user:alice:rwx"'
|
|
need "getfacl shows user:alice:rw- on q3-summary.txt, not limited by the mask" 'acl /srv/reports/q3-summary.txt | grep -qx "user:alice:rw-"'
|
|
need "getfacl shows user:alice:rw- on budget-2027.txt, not limited by the mask" 'acl /srv/reports/budget-2027.txt | grep -qx "user:alice:rw-"'
|
|
need "alice can edit the reports" 'as alice test -r /srv/reports/q3-summary.txt -a -w /srv/reports/q3-summary.txt -a -w /srv/reports/budget-2027.txt'
|
|
|
|
task 2 "New files in /srv/project writable by devs, whatever the umask"
|
|
need "a file eve creates with umask 077 is writable by dana" '[ "$t2_eve" = yes ]'
|
|
need "a file dana creates with umask 022 is writable by eve" '[ "$t2_dana" = yes ]'
|
|
|
|
task 3 "plan.txt: the cause in /root/lab-answers/3, alice can write again"
|
|
need "/root/lab-answers/3 names the ACL entry that limits alice" 'answer 3 | grep -qw mask'
|
|
need "alice's entry is still there, user:alice:rw- with no #effective limit" 'acl /srv/shared/plan.txt | grep -qx "user:alice:rw-"'
|
|
need "alice can write to plan.txt" 'as alice test -w /srv/shared/plan.txt'
|
|
|
|
task 4 "/srv/project copied to /backup/project with its ACLs"
|
|
need "/backup/project exists" '[ -d /backup/project ]'
|
|
need "the files are the same" 'diff -r /srv/project /backup/project'
|
|
need "getfacl shows the same ACLs, owners and groups in both" 'diff <(acl_tree /srv/project) <(acl_tree /backup/project)'
|