Skip to content

Commit 775caa7

Browse files
janekmijanekmi
committed
DAOS-18268 dlck: warn when running not as root or a daos_server...
... group member Signed-off-by: Jan Michalski <jan-marian.michalski@hpe.com>
1 parent 1b59c41 commit 775caa7

File tree

3 files changed

+111
-41
lines changed

3 files changed

+111
-41
lines changed

‎src/include/daos/common.h‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -937,13 +937,17 @@ enum {
937937
#define DAOS_MEM_FAIL_CHECKPOINT (DAOS_FAIL_UNIT_TEST_GROUP_LOC | 0x102)
938938

939939
/** DLCK fault injection */
940-
#define DLCK_FAULT_GETPWUID (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x100)
941-
#define DLCK_FAULT_CREATE_LOG_DIR (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x101)
942-
#define DLCK_FAULT_CREATE_POOL_DIR (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x102)
943-
#define DLCK_FAULT_ENGINE_START (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x103)
944-
#define DLCK_FAULT_ENGINE_EXEC (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x104)
945-
#define DLCK_FAULT_ENGINE_JOIN (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x105)
946-
#define DLCK_FAULT_ENGINE_STOP (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x106)
940+
#define DLCK_MOCK_ROOT (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x100)
941+
#define DLCK_FAULT_GETGRNAM (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x101)
942+
#define DLCK_MOCK_NO_DAOS_SERVER_GROUP (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x102)
943+
#define DLCK_FAULT_GETGROUPS (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x103)
944+
#define DLCK_MOCK_NOT_IN_DAOS_SERVER_GROUP (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x104)
945+
#define DLCK_FAULT_CREATE_LOG_DIR (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x105)
946+
#define DLCK_FAULT_CREATE_POOL_DIR (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x106)
947+
#define DLCK_FAULT_ENGINE_START (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x107)
948+
#define DLCK_FAULT_ENGINE_EXEC (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x108)
949+
#define DLCK_FAULT_ENGINE_JOIN (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x109)
950+
#define DLCK_FAULT_ENGINE_STOP (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x10a)
947951

948952
/** Pool open fault injection */
949953
#define DAOS_FAULT_POOL_NVME_HEALTH (DAOS_FAIL_SYS_TEST_GROUP_LOC | 0x200)

‎src/utils/dlck/dlck_main.c‎

Lines changed: 89 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* (C) Copyright 2025 Hewlett Packard Enterprise Development LP
2+
* (C) Copyright 2025-2026 Hewlett Packard Enterprise Development LP
33
*
44
* SPDX-License-Identifier: BSD-2-Clause-Patent
55
*/
@@ -8,7 +8,7 @@
88
#include <stdlib.h>
99
#include <stdio.h>
1010
#include <sys/types.h>
11-
#include <pwd.h>
11+
#include <grp.h>
1212
#include <abt.h>
1313

1414
#include <daos_errno.h>
@@ -22,47 +22,110 @@
2222
#include "dlck_cmds.h"
2323

2424
#define EFFECTIVE_USER_STR "Effective user: "
25+
#define USER_BELONGS_TO_GRP_FMT "User %sbelong%s to group: %s (gid=%" PRIuMAX ")\n"
2526
#define UNEXPECTED_USER_WARNING_MSG \
26-
"WARNING: It is recommended to run this program as root or user '" DAOS_DEFAULT_SYS_NAME \
27-
"'.\n" \
28-
"These accounts are expected to have the necessary privileges.\n" \
29-
"Running under other users may cause the program to stop due to insufficient " \
27+
"\nWARNING: It is recommended to run this program as root or as a user who belongs to " \
28+
"the '" DAOS_DEFAULT_SYS_NAME "' group.\n" \
29+
"Running it under any other account may cause the program to stop due to insufficient " \
3030
"privileges.\n\n"
3131

32-
static void
33-
check_user(struct checker *ck)
32+
static bool
33+
user_is_root(struct checker *ck)
3434
{
35-
uid_t euid = geteuid();
36-
struct passwd *pw = NULL;
37-
int ret;
35+
uid_t euid = geteuid();
36+
37+
if (DAOS_FAIL_CHECK(DLCK_MOCK_ROOT)) { /** fault injection */
38+
/** it does not have ANY effect on the actual privileges of the user */
39+
euid = 0;
40+
}
3841

39-
/** The root user is not always named "root" but its uid is always 0. */
4042
if (euid == 0) {
41-
/** the root user have all the privileges */
43+
/** The root user is not always named "root" but its uid is always 0. */
4244
CK_PRINT(ck, EFFECTIVE_USER_STR "root\n");
43-
return;
45+
return true;
4446
}
4547

46-
if (DAOS_FAIL_CHECK(DLCK_FAULT_GETPWUID)) { /** fault injection */
48+
CK_PRINTF(ck, EFFECTIVE_USER_STR "uid=%" PRIuMAX "\n", (uintmax_t)euid);
49+
return false;
50+
}
51+
52+
#define MAX_GROUPS 128
53+
54+
static bool
55+
user_belongs_to_group(const char *group_name, struct checker *ck)
56+
{
57+
struct group *group = NULL;
58+
gid_t group_id;
59+
gid_t groups[MAX_GROUPS];
60+
int rc;
61+
62+
/** get GID of the requested group */
63+
if (DAOS_FAIL_CHECK(DLCK_FAULT_GETGRNAM)) { /** fault injection */
4764
errno = daos_fail_value_get();
65+
} else if (DAOS_FAIL_CHECK(DLCK_MOCK_NO_DAOS_SERVER_GROUP)) { /** fault injection */
66+
errno = 0;
4867
} else {
49-
pw = getpwuid(euid);
68+
errno = 0;
69+
group = getgrnam(group_name);
70+
}
71+
if (group == NULL) {
72+
if (errno != 0) {
73+
rc = daos_errno2der(errno);
74+
CK_PRINTFL_RC(ck, rc, "getgrnam(%s) failed", group_name);
75+
} else {
76+
CK_PRINTF(ck, "The %s group does not exist.\n", group_name);
77+
}
78+
return false;
5079
}
51-
if (pw == NULL || pw->pw_name == NULL) {
52-
ret = d_errno2der(errno);
53-
CK_PRINTFL_RC(ck, ret, "Cannot get the name of a user for uid=%" PRIuMAX,
54-
(uintmax_t)euid);
55-
CK_PRINT(ck, UNEXPECTED_USER_WARNING_MSG);
80+
group_id = group->gr_gid;
81+
82+
/** check primary group */
83+
if (getgid() == group_id) {
84+
CK_PRINTF(ck, USER_BELONGS_TO_GRP_FMT, "", "s", group_name, (uintmax_t)group_id);
85+
return true;
86+
}
87+
88+
/** get supplementary groups */
89+
if (DAOS_FAIL_CHECK(DLCK_FAULT_GETGROUPS)) { /** fault injection */
90+
rc = -1;
91+
errno = daos_fail_value_get();
92+
} else {
93+
rc = getgroups(MAX_GROUPS, groups);
94+
}
95+
if (rc < 0) {
96+
rc = daos_errno2der(errno);
97+
CK_PRINTFL_RC(ck, rc, "getgroups() failed", group_name);
98+
return false;
99+
}
100+
101+
/** check supplementary groups */
102+
if (!DAOS_FAIL_CHECK(DLCK_MOCK_NOT_IN_DAOS_SERVER_GROUP)) { /** fault injection */
103+
for (int i = 0; i < rc; i++) {
104+
if (groups[i] == group_id) {
105+
CK_PRINTF(ck, USER_BELONGS_TO_GRP_FMT, "", "s", group_name,
106+
(uintmax_t)group_id);
107+
return true;
108+
}
109+
}
110+
}
111+
112+
CK_PRINTF(ck, USER_BELONGS_TO_GRP_FMT, "DOES NOT ", "", group_name, (uintmax_t)group_id);
113+
114+
return false;
115+
}
116+
117+
static void
118+
check_user_privileges(struct checker *ck)
119+
{
120+
if (user_is_root(ck)) {
121+
/** the root user is assumed to have all required privileges */
56122
return;
57123
}
58124

59-
if (strncmp(pw->pw_name, DAOS_DEFAULT_SYS_NAME, DAOS_SYS_NAME_MAX) == 0) {
60-
/** the daos_server user ought to have all the necessary privileges */
61-
CK_PRINT(ck, EFFECTIVE_USER_STR DAOS_DEFAULT_SYS_NAME "\n");
125+
if (user_belongs_to_group(DAOS_DEFAULT_SYS_NAME, ck)) {
62126
return;
63127
}
64128

65-
CK_PRINTF(ck, EFFECTIVE_USER_STR "%s (uid=%" PRIuMAX ")\n", pw->pw_name, (uintmax_t)euid);
66129
CK_PRINT(ck, UNEXPECTED_USER_WARNING_MSG);
67130
}
68131

@@ -103,7 +166,7 @@ main(int argc, char *argv[])
103166
goto err_abt_fini;
104167
}
105168

106-
check_user(&ctrl.checker);
169+
check_user_privileges(&ctrl.checker);
107170

108171
rc = dlck_cmd_check(&ctrl);
109172
if (rc != DER_SUCCESS) {

‎src/utils/dlck/tests/fault_injection_dlck.yaml‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,16 @@
11
# Uncomment a fault you would like to trigger
2-
# yamllint disable rule:comments-indentation
32
fault_config:
4-
# - id: 131328 # DLCK_FAULT_GETPWUID
5-
# - id: 131329 # DLCK_FAULT_CREATE_LOG_DIR
6-
# - id: 131330 # DLCK_FAULT_CREATE_POOL_DIR
7-
# - id: 131331 # DLCK_FAULT_ENGINE_START
8-
# - id: 131332 # DLCK_FAULT_ENGINE_EXEC
9-
# - id: 131333 # DLCK_FAULT_ENGINE_JOIN
10-
# - id: 131334 # DLCK_FAULT_ENGINE_STOP
3+
# - id: 131328 # DLCK_MOCK_ROOT
4+
# - id: 131329 # DLCK_FAULT_GETGRNAM
5+
# - id: 131330 # DLCK_MOCK_NO_DAOS_SERVER_GROUP
6+
# - id: 131331 # DLCK_FAULT_GETGROUPS
7+
# - id: 131332 # DLCK_MOCK_NOT_IN_DAOS_SERVER_GROUP
8+
# - id: 131333 # DLCK_FAULT_CREATE_LOG_DIR
9+
# - id: 131334 # DLCK_FAULT_CREATE_POOL_DIR
10+
# - id: 131335 # DLCK_FAULT_ENGINE_START
11+
# - id: 131336 # DLCK_FAULT_ENGINE_EXEC
12+
# - id: 131337 # DLCK_FAULT_ENGINE_JOIN
13+
# - id: 131338 # DLCK_FAULT_ENGINE_STOP
1114
# - id: 131584 # DAOS_FAULT_POOL_NVME_HEALTH
1215
# interval: 2 # skip sys_db
1316
# - id: 131585 # DAOS_FAULT_POOL_OPEN_BIO

0 commit comments

Comments
 (0)