Will send this to clients.

Fixes: https://tracker.ceph.com/issues/57154
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit 53caf31)

Need to add writeable/readable members and send them back to clients.

Fixes: https://tracker.ceph.com/issues/57154
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit 6e4a644)

It will include the uid/gids and path in each cap_auth.

Fixes: https://tracker.ceph.com/issues/57154
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit 213a27a)

Fixes: https://tracker.ceph.com/issues/57154
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit c1cbb9a)

Conflicts:
	src/mds/MDSAuthCaps.h: missed dependency commit 23f1fdb
	("AuthMonitor: allow "fs authorize" to update caps")

Fixes: https://tracker.ceph.com/issues/57154
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit 27f73a9)

Fixes: https://tracker.ceph.com/issues/57154
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit 429aafb)

Will use this to get the path string to do the mds auth check. It
may fail when the there is no any dentry in local cache, which could
be caused by just unlinking the last dentry while the inode keeps
opening and then try to change the mode.

Fixes: https://tracker.ceph.com/issues/57154
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit fd7aaab)

Fixes: https://tracker.ceph.com/issues/57154
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit 01a9398)

Conflicts:
	src/client/Client.cc: conflict with commit 997b917
	("client: always refresh mds feature bits on session open")

If couldn't get the absolute path string we need to force it to
do the sync setattr.

Fixes: https://tracker.ceph.com/issues/57154
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit c1bf8d8)

This feature bit could be used to distinguish old and new clients.

Fixes: https://tracker.ceph.com/issues/57154
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit b2046fc)

Since the setattr will check the cephx mds auth access before
buffering the changes, so it makes no sense any more to let the
cap update to check the access in MDS again.

Fixes: https://tracker.ceph.com/issues/57154
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit f474203)

Conflicts:
	src/client/Client.cc: missed dependency commit a8d0158
	("Client/Inode: wait_for_caps fixups")

Before opening the file locally we need to check the cephx access.

Fixes: https://tracker.ceph.com/issues/57154
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit ce21659)

as it's too late. Session access authorization already happens
before new caps are issued.

Fixes: https://tracker.ceph.com/issues/56067
Signed-off-by: Ramana Raja <rraja@redhat.com>
(cherry picked from commit 96305b5)

... MDS auth caps but don't have CEPHFS_FEATURE_MDS_AUTH_CAPS_CHECK
feature bit (i.e., can't check the auth caps sent back to it by the
MDS) from establishing a session. Do this in
Server::handle_client_session(), and Server::handle_client_reconnect(),
where old clients try to reconnect to MDS servers after an upgrade.

If the client doesn't have the ability to authorize session access
based on the MDS auth caps send back to it by the MDS, then the
client may buffer changes locally during open and setattr operations
when it's not supposed to, e.g., when enforcing root_squash MDS auth
caps.

Fixes: https://tracker.ceph.com/issues/56067
Signed-off-by: Ramana Raja <rraja@redhat.com>
(cherry picked from commit e64931b)

The test.cc will be included in ceph_test_libcephfs, no need to
include it to access.

Fixes: https://tracker.ceph.com/issues/57154
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit 77ac100)

Fixes: https://tracker.ceph.com/issues/57154
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit 4af6a3f)

…6067

A kernel CephFS client with MDS root_squash caps is able to write to a
file as non-root user. However, the data written is lost after clearing
the kernel client cache, or re-mounting the client. This issue is not
observed with a FUSE CephFS client.

Signed-off-by: Ramana Raja <rraja@redhat.com>
(cherry picked from commit c8bae07)

kclient doesn't have CEPHFS_FEATURE_MDS_AUTH_CAPS required to
enforce root_squash. Run root_squash tests only for FUSE client.

Signed-off-by: Ramana Raja <rraja@redhat.com>
(cherry picked from commit a040446)

The mountpoint's root ino# possibly not be the full CephFS
filesystem root, it's just the mountpoint of this particular client.
Just prepend the mountpoint path to the full path.

Introduced-by: c1bf8d8 client: check the cephx mds auth access for setattr
Introduced-by: ce21659 client: check the cephx mds auth access for open
Fixes: ceph#48027 (comment)
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit e46dc20)

Just in case we cannot link all the way to our mount point we will
force to do sync requests instead and let the MDS do the auth access
check.

Introduced-by: fd7aaab client: add make_path_string() helpers support
Fixes: ceph#48027 (comment)
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit c7bc452)

Fixes: https://tracker.ceph.com/issues/63364
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit 188aed9)

Update the oldest_client_tid via the session renew caps msg to
make sure that the MDSs won't pile up the completed request list
in a very large size.

Fixes: https://tracker.ceph.com/issues/63364
Signed-off-by: Xiubo Li <xiubli@redhat.com>
(cherry picked from commit 0cff6d5)