mds: add root_squash mode in MDS auth caps#36457
Conversation
|
This PR is based on the multiple FS auth ID PR that's not been merged. Following is the only commit |
batrick
left a comment
There was a problem hiding this comment.
Looks about right. I don't think it's possible to restrict MAY_READ without changes to the client so this should be fine.
|
This PR is based on the multiple FS auth ID PR that's not been merged. Following is the only commit |
a4f120b to
a808f16
Compare
batrick
left a comment
There was a problem hiding this comment.
This looks very good. We just need tests for fs authorize with root_squash. Please add them to test_admin.py. You already have tests for checking the capability so I think you can skip validating the caps work with a mount.
... methods in LocalRemote class. These methods are called in some of the recently added cephfs tests. They were implemented in teuthology's Remote class, but not in vstart_runner's LocalRemote class. Hence some cephfs tests couldn't be run locally using vstart_runner without this change. Signed-off-by: Ramana Raja <rraja@redhat.com>
Implement a root_squash mode in MDS auth caps to deny operations for
clients with uid=0 or gid=0 that need write access. It's mainly to
prevent operations such as accidental `sudo rm -rf /path`.
The root squash mode can be enforced in one of the following ways in
the MDS caps,
'allow rw root_squash'
(across file systems)
or
'allow rw fsname=a root_squash'
(on a file system)
or
'allow rw fsname=a path=/vol/group/subvol00 root_squash'
(on a file system path)
Fixes: https://tracker.ceph.com/issues/42451
Signed-off-by: Ramana Raja <rraja@redhat.com>
Done. |
... in test_admin.TestSubCmdFsAuthorize.setup_for_multiple_paths(). Signed-off-by: Ramana Raja <rraja@redhat.com>
|
jenkins test make check |
|
jenkins test make check |
|
@batrick do you want me to test this in teuthology? |
|
@ajarr I encourage testing your own PR for the specific tests you're adding. I'll do broader QA testing in the next few days. |
|
tests for changes in TestMDSAuthCaps.cc tests for changes in test_admin |
Tests passed. |
|
https://pulpito.ceph.com/?branch=wip-pdonnell-testing-20201007.214100 failures unrelated. |
Uh oh!
There was an error while loading. Please reload this page.