freebsd-nq/scripts
Brian Behlendorf f74b821a66 Add zfs allow and zfs unallow support
ZFS allows for specific permissions to be delegated to normal users
with the `zfs allow` and `zfs unallow` commands.  In addition, non-
privileged users should be able to run all of the following commands:

  * zpool [list | iostat | status | get]
  * zfs [list | get]

Historically this functionality was not available on Linux.  In order
to add it the secpolicy_* functions needed to be implemented and mapped
to the equivalent Linux capability.  Only then could the permissions on
the `/dev/zfs` be relaxed and the internal ZFS permission checks used.

Even with this change some limitations remain.  Under Linux only the
root user is allowed to modify the namespace (unless it's a private
namespace).  This means the mount, mountpoint, canmount, unmount,
and remount delegations cannot be supported with the existing code.  It
may be possible to add this functionality in the future.

This functionality was validated with the cli_user and delegation test
cases from the ZFS Test Suite.  These tests exhaustively verify each
of the supported permissions which can be delegated and ensures only
an authorized user can perform it.

Two minor bug fixes were required for test-running.py.  First, the
Timer() object cannot be safely created in a `try:` block when there
is an unconditional `finally` block which references it.  Second,
when running as a normal user also check for scripts using the
both the .ksh and .sh suffixes.

Finally, existing users who are simulating delegations by setting
group permissions on the /dev/zfs device should revert that
customization when updating to a version with this change.

Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Tony Hutter <hutter2@llnl.gov>
Closes #362 
Closes #434 
Closes #4100
Closes #4394 
Closes #4410 
Closes #4487
2016-06-07 09:16:52 -07:00
..
zfs-images@3331601f6d Add zimport.sh compatibility test script 2014-02-21 12:10:31 -08:00
zpios-profile Replace libexecdir with datadir 2013-03-06 15:46:40 -08:00
zpios-test Replace libexecdir with datadir 2013-03-06 15:46:40 -08:00
zpool-config zpool-create.sh: allow features to be disabled 2014-07-25 11:58:31 -07:00
.gitignore Remove autotools products 2012-08-27 11:47:44 -07:00
common.sh.in Add zfs allow and zfs unallow support 2016-06-07 09:16:52 -07:00
cstyle.pl Fix cstyle.pl warnings 2016-06-03 09:08:14 -07:00
dkms.mkconf Fix source_tree variable in dkms build 2014-10-13 10:38:41 -07:00
dkms.postbuild Install header during post-build rather than post-install. 2014-10-09 12:03:50 -07:00
kmodtool Set LANG to a reasonable default (C) 2014-06-10 16:46:21 -07:00
Makefile.am Add zfs-helpers.sh script 2016-05-10 11:28:54 -07:00
smb.sh Implemented sharing datasets via SMB using libshare 2012-12-03 09:42:15 -08:00
zconfig.sh Add zfs allow and zfs unallow support 2016-06-07 09:16:52 -07:00
zfs2zol-patch.sed Add script to fix file names in upstream patches 2013-10-29 10:30:43 -07:00
zfs-helpers.sh Add zfs-helpers.sh script 2016-05-10 11:28:54 -07:00
zfs-tests.sh Make zfs test easier to run in local install 2016-04-12 10:50:01 -07:00
zfs.sh Swap DTRACE_PROBE* with Linux tracepoints 2014-11-17 11:13:55 -08:00
ziltest.sh Use truncate instead of fallocate in ziltest.sh 2015-07-13 11:02:59 -07:00
zimport.sh zimport.sh: Add configure/make option support 2015-11-16 16:10:07 -08:00
zloop.sh zloop.sh requires bash 2016-03-25 14:27:46 -07:00
zpios-sanity.sh Disable 90-zfs.rules for test suite 2011-10-11 14:45:37 -07:00
zpios-survey.sh Retire zio_bulk_flags 2015-02-10 16:08:49 -08:00
zpios.sh build: resolve orthographic and other grammatical errors 2013-04-02 10:44:52 -07:00
zpool-create.sh zpool-create.sh: allow features to be disabled 2014-07-25 11:58:31 -07:00