28 lines
2.7 KiB
Bash
28 lines
2.7 KiB
Bash
# The clients /srv/projects is exported to, one per line, with options.
|
|
clients() { exportfs -s 2>/dev/null | awk '$1 == "/srv/projects" { for (i = 2; i <= NF; i++) print $i }'; }
|
|
in_fstab() { findmnt -s -n "$1" >/dev/null || [ -e "/etc/systemd/system/$(systemd-escape -p --suffix=mount "$1")" ]; }
|
|
smb() { timeout 20 ip netns exec lepeer smbclient //10.99.0.1/docs "$@" 2>&1 </dev/null; }
|
|
|
|
task 1 "/srv/projects exported to 10.99.0.1 only, mounted at /mnt/projects at boot"
|
|
need "the NFS server is running and enabled" 'active nfs-server && enabled nfs-server'
|
|
need "/srv/projects is exported" '[ -n "$(clients)" ]'
|
|
need "it's exported read-write" 'clients | grep -Eq "[(,]rw[,)]"'
|
|
need "it's exported to 10.99.0.1 only" '! clients | grep -Evq "^10\.99\.0\.1(/32)?\("'
|
|
need "the export is in /etc/exports or /etc/exports.d" 'grep -Eqs "^[[:space:]]*/srv/projects[[:space:]]" /etc/exports /etc/exports.d/*.exports'
|
|
need "/mnt/projects is an NFS 4 mount of 10.99.0.1:/srv/projects" '[ "$(findmnt -n -o FSTYPE /mnt/projects)" = nfs4 ] && findmnt -n -o SOURCE /mnt/projects | grep -Eq "^10\.99\.0\.1:/srv/projects/*$"'
|
|
need "/mnt/projects is mounted at boot (/etc/fstab)" in_fstab /mnt/projects
|
|
|
|
task 2 "pat can write to the share; root on the client can't"
|
|
need "root is squashed (no no_root_squash)" '[ -n "$(clients)" ] && ! clients | grep -q no_root_squash'
|
|
need "pat can create a file in /mnt/projects" 'f=/mnt/projects/.le-check-$$; runuser -u pat -- touch $f && [ "$(stat -c %U /srv/projects/${f##*/})" = pat ]; r=$?; rm -f /srv/projects/${f##*/}; exit $r'
|
|
need "root can't create a file in /mnt/projects" 'f=/mnt/projects/.le-check-$$; ! timeout 10 touch $f; r=$?; rm -f /srv/projects/${f##*/}; exit $r'
|
|
|
|
task 3 "Samba share docs, writable only by group docs; dana has a Samba password"
|
|
need "testparm -s shows a [docs] section for /srv/samba/docs" 'testparm -s 2>/dev/null | awk "/^\[docs\]/ { f = 1; next } /^\[/ { f = 0 } f && /path = \/srv\/samba\/docs\/?$/ { ok = 1 } END { exit !ok }"'
|
|
need "smbd is running and enabled" 'active smbd && enabled smbd'
|
|
need "dana has a Samba password" 'pdbedit -L 2>/dev/null | grep -q "^dana:"'
|
|
need "from the peer, dana can list the share" 'smb -U dana%Lab-Pass-1 -c ls | grep -q "blocks available"'
|
|
need "from the peer, dana can put a file in the share" 'n=le-check-$$; smb -U dana%Lab-Pass-1 -c "put /etc/hostname $n" >/dev/null; [ -f /srv/samba/docs/$n ]; r=$?; rm -f /srv/samba/docs/$n; exit $r'
|
|
need "from the peer, eli gets NT_STATUS_ACCESS_DENIED" 'smb -U eli%x -c ls | grep -q NT_STATUS_ACCESS_DENIED'
|
|
need "eli can't put a file in the share" 'n=le-check-$$; smb -U eli%x -c "put /etc/hostname $n" >/dev/null; [ ! -e /srv/samba/docs/$n ]; r=$?; rm -f /srv/samba/docs/$n; exit $r'
|