Bug 1441521

Summary: ACL tests are failing in pynfs test suite
Product: [Red Hat Storage] Red Hat Gluster Storage Reporter: Arthy Loganathan <aloganat>
Component: nfs-ganeshaAssignee: Soumya Koduri <skoduri>
Status: CLOSED ERRATA QA Contact: Manisha Saini <msaini>
Severity: high Docs Contact:
Priority: unspecified    
Version: rhgs-3.3CC: dang, ffilz, jthottan, mbenjamin, rhinduja, rhs-bugs, skoduri, storage-qa-internal
Target Milestone: ---Keywords: Regression
Target Release: RHGS 3.3.0   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: nfs-ganesha-2.4.4-6 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-09-21 04:47:57 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1417151    

Description Arthy Loganathan 2017-04-12 07:36:20 UTC
Description of problem:
ACL tests are failing in pynfs test suite with the error,
OP_SETATTR should return NFS4_OK, instead got
           NFS4ERR_NOTSUPP
However, the tests are passing in RHGS3.2 packages.

Version-Release number of selected component (if applicable):
glusterfs-ganesha-3.8.4-22.el7rhgs.x86_64
nfs-ganesha-gluster-2.4.4-2.el7.x86_64
nfs-ganesha-2.4.4-2.el7.x86_64


How reproducible:
Always

Steps to Reproduce:

1. Create ganesha cluster and create volume.
2. Enable ACL in volume export config file.
    [root@dhcp ~]# cat /var/run/gluster/shared_storage/nfs-ganesha/exports/export.testvol1.conf
# WARNING : Using Gluster CLI will overwrite manual
# changes made to this file. To avoid it, edit the
# file and run ganesha-ha.sh --refresh-config.
EXPORT{
      Export_Id = 2;
      Path = "/testvol1";
      FSAL {
           name = GLUSTER;
           hostname="localhost";
          volume="testvol1";
           }
      Access_type = RW;
      Disable_ACL = false;
      Squash="No_root_squash";
      Pseudo="/testvol1";
      Protocols = "3", "4" ;
      Transports = "UDP","TCP";
      SecType = "sys";
     }

3. Run refresh config.
    /usr/libexec/ganesha/ganesha-ha.sh --refresh-config /var/run/gluster/shared_storage/nfs-ganesha testvol1
4. Execute pynfs test suite.
   cd /root/pynfs/nfs4.0 && ./testserver.py 10.70.44.92:/testvol1 -v --outfile ~/pynfs.run --maketree --showomit --rundep all

Actual results:
ACL tests are failing in pynfs test suite

Expected results:
When acl is enabled for the volume, ACL5 and ACL10 tests should pass.

Additional info:


[root@dhcp37-164 nfs4.0]# cd /root/pynfs/nfs4.0 && ./testserver.py 10.70.44.92:/testvol1 -v --outfile ~/pynfs.run --maketree --showomit --rundep ACL10
LOOKFILE st_lookup.testFile                                       : RUNNING
LOOKFILE st_lookup.testFile                                       : PASS
ACL0     st_acl.testACLsupport                                    : RUNNING
ACL0     st_acl.testACLsupport                                    : PASS
ACL10    st_acl.testLargeACL                                      : RUNNING
ACL10    st_acl.testLargeACL                                      : FAILURE
           OP_SETATTR should return NFS4_OK, instead got
           NFS4ERR_NOTSUPP
**************************************************
ACL0     st_acl.testACLsupport                                    : PASS
ACL10    st_acl.testLargeACL                                      : FAILURE
           OP_SETATTR should return NFS4_OK, instead got
           NFS4ERR_NOTSUPP
LOOKFILE st_lookup.testFile                                       : PASS
**************************************************
Command line asked for 3 of 668 tests
Of those: 0 Skipped, 1 Failed, 0 Warned, 2 Passed
[root@dhcp37-164 nfs4.0]# 
[root@dhcp37-164 nfs4.0]# cd /root/pynfs/nfs4.0 && ./testserver.py 10.70.44.92:/testvol1 -v --outfile ~/pynfs.run --maketree --showomit --rundep ACL5
LOOKFILE st_lookup.testFile                                       : RUNNING
LOOKFILE st_lookup.testFile                                       : PASS
ACL0     st_acl.testACLsupport                                    : RUNNING
ACL0     st_acl.testACLsupport                                    : PASS
ACL5     st_acl.testACL                                           : RUNNING
ACL5     st_acl.testACL                                           : FAILURE
           OP_SETATTR should return NFS4_OK, instead got
           NFS4ERR_NOTSUPP
**************************************************
ACL0     st_acl.testACLsupport                                    : PASS
ACL5     st_acl.testACL                                           : FAILURE
           OP_SETATTR should return NFS4_OK, instead got
           NFS4ERR_NOTSUPP
LOOKFILE st_lookup.testFile                                       : PASS
**************************************************
Command line asked for 3 of 668 tests
Of those: 0 Skipped, 1 Failed, 0 Warned, 2 Passed

Comment 2 Arthy Loganathan 2017-04-12 07:41:15 UTC
packet trace, sosreports and ganesha logs are at,
http://rhsqe-repo.lab.eng.blr.redhat.com/sosreports/1441521/

Comment 3 Soumya Koduri 2017-04-12 12:23:36 UTC
Below is the RCA done :

ACL doesn't get enabled using refresh-config feature but get enabled using gluster vol stop/start.

That means either refresh-config (which is changed to use UpdateExport dbus signal) is not functioning appropriately.

When I tried changing another Export option like "Acces_Type" it works fine. So the issue seem to be only with Disable_ACL option for now.

When debugged further, looks like UpdateExport updates all the export options in memory dynamically but doesn't update the options stored in each FSAL layer.

For eg., in FSAL_GLUSTER, while creating an export entry, we check if ACL is enabled from op_ctx->export and store it in FSAL structure "glfsexport->acl_enabled" option. But the same structure variable doesn't get updated while updating export permissions using dbus signal. 

I can make changes in FSAL_GLUSTER to always read from op_ctx->export to determine if any feature like ACLs/pNFS enabled or not. But other alternative approach is that we can have a FSAL specific API (like update_fsal_export_options - no op by default), which we can be invoked as part of update_export_param() and FSAL can choose to update its local variables or other processing it may wish to do. Not sure what is the preferable approach. Other FSALs may also have similar issue. Will check in upstream.

Comment 7 Soumya Koduri 2017-04-13 12:00:59 UTC
Patch posted upstream - https://review.gerrithub.io/356999

Comment 10 Manisha Saini 2017-05-10 09:52:05 UTC
Verified this Bug on nfs-ganesha-2.4.4-6.el7rhgs.x86_64

After enabling ACL in volume export block,ACL5 and ACL10 test case passed with the fix

ACL5     st_acl.testACL                                           : RUNNING
ACL5     st_acl.testACL                                           : PASS
ACL10    st_acl.testLargeACL                                      : RUNNING
ACL10    st_acl.testLargeACL                                      : PASS


Hence moving this bug to verified state.

Comment 12 errata-xmlrpc 2017-09-21 04:47:57 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:2779