Add `zfs allow` and `zfs unallow` support

ZFS allows for specific permissions to be delegated to normal users
with the `zfs allow` and `zfs unallow` commands.  In addition, non-
privileged users should be able to run all of the following commands:

  * zpool [list | iostat | status | get]
  * zfs [list | get]

Historically this functionality was not available on Linux.  In order
to add it the secpolicy_* functions needed to be implemented and mapped
to the equivalent Linux capability.  Only then could the permissions on
the `/dev/zfs` be relaxed and the internal ZFS permission checks used.

Even with this change some limitations remain.  Under Linux only the
root user is allowed to modify the namespace (unless it's a private
namespace).  This means the mount, mountpoint, canmount, unmount,
and remount delegations cannot be supported with the existing code.  It
may be possible to add this functionality in the future.

This functionality was validated with the cli_user and delegation test
cases from the ZFS Test Suite.  These tests exhaustively verify each
of the supported permissions which can be delegated and ensures only
an authorized user can perform it.

Two minor bug fixes were required for test-running.py.  First, the
Timer() object cannot be safely created in a `try:` block when there
is an unconditional `finally` block which references it.  Second,
when running as a normal user also check for scripts using the
both the .ksh and .sh suffixes.

Finally, existing users who are simulating delegations by setting
group permissions on the /dev/zfs device should revert that
customization when updating to a version with this change.

Signed-off-by: Brian Behlendorf <[email protected]>
Signed-off-by: Tony Hutter <[email protected]>
Closes #362 
Closes #434 
Closes #4100
Closes #4394 
Closes #4410 
Closes #4487 

2 files changed, 11 insertions, 11 deletions

diff --git a/scripts/common.sh.in b/scripts/common.sh.in
index 27ba88fae..9727363d5 100644
--- a/scripts/common.sh.in
+++ b/scripts/common.sh.in
@@ -148,17 +148,6 @@ populate() {
 }
 
 init() {
-	# Disable the udev rule 90-zfs.rules to prevent the zfs module
-	# stack from being loaded due to the detection of a zfs device.
-	# This is important because the test scripts require full control
-	# over when and how the modules are loaded/unloaded.  A trap is
-	# set to ensure the udev rule is correctly replaced on exit.
-	local RULE=${udevruledir}/90-zfs.rules
-	if test -e  ${RULE}; then
-		trap "mv ${RULE}.disabled ${RULE}" INT TERM EXIT
-		mv ${RULE} ${RULE}.disabled
-	fi
-
 	# Create a random directory tree of files and sub-directories to
 	# to act as a copy source for the various regression tests.
 	SRC_DIR=`mktemp -d -p /var/tmp/ zfs.src.XXXXXXXX`
diff --git a/scripts/zconfig.sh b/scripts/zconfig.sh
index 1908dc1d6..c2b97c2c5 100755
--- a/scripts/zconfig.sh
+++ b/scripts/zconfig.sh
@@ -63,6 +63,17 @@ fi
 # Initialize the test suite
 init
 
+# Disable the udev rule 90-zfs.rules to prevent the zfs module
+# stack from being loaded due to the detection of a zfs device.
+# This is important because this test scripts require full control
+# over when and how the modules are loaded/unloaded.  A trap is
+# set to ensure the udev rule is correctly replaced on exit.
+RULE=${udevruledir}/90-zfs.rules
+if test -e  ${RULE}; then
+	trap "mv ${RULE}.disabled ${RULE}" INT TERM EXIT
+	mv ${RULE} ${RULE}.disabled
+fi
+
 # Perform pre-cleanup is requested
 if [ ${CLEANUP} ]; then
 	${ZFS_SH} -u