Skip to content

mds: add root_squash mode in MDS auth caps#36457

Merged
batrick merged 3 commits intoceph:masterfrom
ajarr:wip-42451
Oct 8, 2020
Merged

mds: add root_squash mode in MDS auth caps#36457
batrick merged 3 commits intoceph:masterfrom
ajarr:wip-42451

Conversation

@ajarr
Copy link
Contributor

@ajarr ajarr commented Aug 4, 2020

Implement a root_squash mode in MDS auth caps to deny operations for
clients with uid=0 or gid=0 that need write access. It's mainly to
prevent operations such as accidental `sudo rm -rf /path`.

The root squash mode can be enforced in one of the following ways in
the MDS caps,
  'allow rw root_squash'
  (across file systems)
          or
  'allow rw fsname=a root_squash'
  (on a file system)
          or
  'allow rw fsname=a path=/vol/group/subvol00 root_squash'
  (on a file system path)

Fixes: https://tracker.ceph.com/issues/42451
Signed-off-by: Ramana Raja <rraja@redhat.com>

@ajarr ajarr changed the title mds: add root_squash mode in MDS auth caps [DNM] mds: add root_squash mode in MDS auth caps Aug 4, 2020
@ajarr
Copy link
Contributor Author

ajarr commented Aug 4, 2020

This PR is based on the multiple FS auth ID PR that's not been merged. Following is the only commit
1f5d61a
that enables root_squash, the other commits are part of the multiple FS auth ID PR.

@ajarr ajarr marked this pull request as draft August 4, 2020 17:37
@ajarr ajarr requested a review from batrick August 4, 2020 17:38
@jtlayton jtlayton self-requested a review August 4, 2020 19:31
Copy link
Member

@batrick batrick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks about right. I don't think it's possible to restrict MAY_READ without changes to the client so this should be fine.

@ajarr
Copy link
Contributor Author

ajarr commented Aug 17, 2020

This PR is based on the multiple FS auth ID PR that's not been merged. Following is the only commit
1a96b64
that enables root_squash, the other commits are part of the multiple FS auth ID PR.

@ajarr ajarr changed the title [DNM] mds: add root_squash mode in MDS auth caps mds: add root_squash mode in MDS auth caps Aug 17, 2020
@ajarr ajarr marked this pull request as ready for review August 17, 2020 13:28
@ajarr ajarr force-pushed the wip-42451 branch 2 times, most recently from a4f120b to a808f16 Compare August 19, 2020 08:40
@ajarr ajarr requested a review from batrick September 17, 2020 12:26
Copy link
Member

@batrick batrick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks very good. We just need tests for fs authorize with root_squash. Please add them to test_admin.py. You already have tests for checking the capability so I think you can skip validating the caps work with a mount.

... methods in LocalRemote class. These methods are called in some of
the recently added cephfs tests. They were implemented in teuthology's
Remote class, but not in vstart_runner's LocalRemote class. Hence some
cephfs tests couldn't be run locally using vstart_runner without this
change.

Signed-off-by: Ramana Raja <rraja@redhat.com>
Implement a root_squash mode in MDS auth caps to deny operations for
clients with uid=0 or gid=0 that need write access. It's mainly to
prevent operations such as accidental `sudo rm -rf /path`.

The root squash mode can be enforced in one of the following ways in
the MDS caps,
  'allow rw root_squash'
  (across file systems)
          or
  'allow rw fsname=a root_squash'
  (on a file system)
          or
  'allow rw fsname=a path=/vol/group/subvol00 root_squash'
  (on a file system path)

Fixes: https://tracker.ceph.com/issues/42451
Signed-off-by: Ramana Raja <rraja@redhat.com>
@ajarr
Copy link
Contributor Author

ajarr commented Sep 25, 2020

This looks very good. We just need tests for fs authorize with root_squash. Please add them to test_admin.py. You already have tests for checking the capability so I think you can skip validating the caps work with a mount.

Done.

@ajarr ajarr requested a review from batrick September 25, 2020 10:21
@ajarr ajarr removed their assignment Sep 25, 2020
... in test_admin.TestSubCmdFsAuthorize.setup_for_multiple_paths().

Signed-off-by: Ramana Raja <rraja@redhat.com>
@batrick
Copy link
Member

batrick commented Sep 25, 2020

jenkins test make check

@batrick batrick removed their assignment Sep 25, 2020
@ajarr
Copy link
Contributor Author

ajarr commented Sep 25, 2020

jenkins test make check

@ajarr
Copy link
Contributor Author

ajarr commented Oct 5, 2020

@batrick do you want me to test this in teuthology?

@batrick
Copy link
Member

batrick commented Oct 5, 2020

@ajarr I encourage testing your own PR for the specific tests you're adding. I'll do broader QA testing in the next few days.

@ajarr
Copy link
Contributor Author

ajarr commented Oct 6, 2020

@ajarr
Copy link
Contributor Author

ajarr commented Oct 6, 2020

@batrick
Copy link
Member

batrick commented Oct 8, 2020

@batrick batrick merged commit 5c9f77c into ceph:master Oct 8, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants