Expect fchflags(2) to fail with EOPNOTSUPP on NFS.

Even if we have CAP_FCHFLAGS, fchflags(2) fails on NFS. This is normal
and expected, so don't fail the test because of it.

Note that, whether or not we are on NFS, fchflags(2) should always fail
with ENOTCAPABLE if we are using a capability that does not have the
CAP_FCHFLAGS right.

Approved by: re (kib), mentor (rwatson)
Sponsored by: Google Inc

1 files changed, 11 insertions, 2 deletions

diff --git a/tools/regression/security/cap_test/cap_test_capabilities.c b/tools/regression/security/cap_test/cap_test_capabilities.c
index 444bcbd..818698d 100644
--- a/tools/regression/security/cap_test/cap_test_capabilities.c
+++ b/tools/regression/security/cap_test/cap_test_capabilities.c
@@ -44,6 +44,7 @@ __FBSDID("$FreeBSD$");
 #include <fcntl.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <unistd.h>
 
 #include "cap_test.h"
@@ -102,9 +103,13 @@ try_file_ops(int fd, cap_rights_t rights)
 	off_t off;
 	void *p;
 	char ch;
-	int ret;
+	int ret, is_nfs;
 	int success = PASSED;
 
+	REQUIRE(fstatfs(fd, &sf));
+	is_nfs = (strncmp("nfs", sf.f_fstypename, sizeof(sf.f_fstypename))
+	    == 0);
+
 	REQUIRE(fd_cap = cap_new(fd, rights));
 	REQUIRE(fd_capcap = cap_new(fd_cap, rights));
 	CHECK(fd_capcap != fd_cap);
@@ -126,8 +131,12 @@ try_file_ops(int fd, cap_rights_t rights)
 	off = lseek(fd_cap, 0, SEEK_SET);
 	CHECK_RESULT(lseek, CAP_SEEK, off >= 0);
 
+	/*
+	 * Note: this is not expected to work over NFS.
+	 */
 	ret = fchflags(fd_cap, UF_NODUMP);
-	CHECK_RESULT(fchflags, CAP_FCHFLAGS, ret == 0);
+	CHECK_RESULT(fchflags, CAP_FCHFLAGS,
+	    (ret == 0) || (is_nfs && (errno == EOPNOTSUPP)));
 
 	ret = fstat(fd_cap, &sb);
 	CHECK_RESULT(fstat, CAP_FSTAT, ret == 0);