mon/AuthMonitor: add osd w cap for superuser client by batrick · Pull Request #67406 · ceph/ceph

batrick · 2026-02-18T20:29:33Z

Right now only a client with "rw" permissions on an MDS gets "rw" on an OSD.

Reported-by: John Mulligan jmulligan@redhat.com
Fixes: https://tracker.ceph.com/issues/75013

Contribution Guidelines

To sign and title your commits, please refer to Submitting Patches to Ceph.
If you are submitting a fix for a stable branch (e.g. "quincy"), please refer to Submitting Patches to Ceph - Backports for the proper workflow.
When filling out the below checklist, you may click boxes directly in the GitHub web UI. When entering or editing the entire PR message in the GitHub web UI editor, you may also select a checklist item by adding an x between the brackets: [x]. Spaces and capitalization matter when checking off items this way.

Checklist

Tracker (select at least one)
- References tracker ticket
- Very recent bug; references commit where it was introduced
- New feature (ticket optional)
- Doc update (no ticket needed)
- Code cleanup (no ticket needed)
Component impact
- Affects Dashboard, opened tracker ticket
- Affects Orchestrator, opened tracker ticket
- No impact that needs to be tracked
Documentation (select at least one)
- Updates relevant documentation
- No doc update is appropriate
Tests (select at least one)
- Includes unit test(s)
- Includes integration test(s)
- Includes bug reproducer
- No tests

Show available Jenkins commands

jenkins test classic perf Jenkins Job | Jenkins Job Definition
jenkins test crimson perf Jenkins Job | Jenkins Job Definition
jenkins test signed Jenkins Job | Jenkins Job Definition
jenkins test make check Jenkins Job | Jenkins Job Definition
jenkins test make check arm64 Jenkins Job | Jenkins Job Definition
jenkins test submodules Jenkins Job | Jenkins Job Definition
jenkins test dashboard Jenkins Job | Jenkins Job Definition
jenkins test dashboard cephadm Jenkins Job | Jenkins Job Definition
jenkins test api Jenkins Job | Jenkins Job Definition
jenkins test docs ReadTheDocs | Github Workflow Definition
jenkins test ceph-volume all Jenkins Jobs | Jenkins Jobs Definition
jenkins test windows Jenkins Job | Jenkins Job Definition
jenkins test rook e2e Jenkins Job | Jenkins Job Definition

You must only issue one Jenkins command per-comment. Jenkins does not understand
comments with more than one command.

batrick · 2026-02-19T14:07:57Z

jenkins test api

phlogistonjohn · 2026-02-22T16:55:58Z

Hi @batrick
I did a build that includes my branch as well as this PR and ran the smb sub-suite in teuthology. I have some tests that use only the lower level parts of cephadm (as opposed to going through the smb mgr module).

Those tests execute: ceph fs authorize cephfs client.smbdata / rw those tests hit the following error:

ceph.client.admin.keyring --fsid 998b7c2f-1002-11f1-8f98-d404e6e7d460 -- bash -c 'ceph fs authorize cephfs client.smbdata / rw'
2026-02-22T15:26:04.093 INFO:teuthology.orchestra.run.trial017.stderr:Inferring config /var/lib/ceph/998b7c2f-1002-11f1-8f98-d404e6e7d460/mon.a/config
2026-02-22T15:26:04.353 INFO:teuthology.orchestra.run.trial017.stderr:Error EINVAL: osd capability parse failed, stopped at 'w tag cephfs data=cephfs' of 'allow rww tag cephfs data=cephfs'
2026-02-22T15:26:04.487 DEBUG:teuthology.orchestra.run:got remote process result: 22

In case it helps when I merged the commit id of your change was 186f068

batrick · 2026-02-23T00:01:11Z

Hi @batrick I did a build that includes my branch as well as this PR and ran the smb sub-suite in teuthology. I have some tests that use only the lower level parts of cephadm (as opposed to going through the smb mgr module).

Those tests execute: ceph fs authorize cephfs client.smbdata / rw those tests hit the following error:
ceph.client.admin.keyring --fsid 998b7c2f-1002-11f1-8f98-d404e6e7d460 -- bash -c 'ceph fs authorize cephfs client.smbdata / rw'
2026-02-22T15:26:04.093 INFO:teuthology.orchestra.run.trial017.stderr:Inferring config /var/lib/ceph/998b7c2f-1002-11f1-8f98-d404e6e7d460/mon.a/config
2026-02-22T15:26:04.353 INFO:teuthology.orchestra.run.trial017.stderr:Error EINVAL: osd capability parse failed, stopped at 'w tag cephfs data=cephfs' of 'allow rww tag cephfs data=cephfs'
2026-02-22T15:26:04.487 DEBUG:teuthology.orchestra.run:got remote process result: 22
In case it helps when I merged the commit id of your change was 186f068

Apologies, please try again.

batrick · 2026-02-23T14:59:45Z

jenkins test make check arm64

phlogistonjohn

I'm not a C++ expert, so take this review with a grain of salt.
However, I combined this PR with mine and did a teuthology run and it resolved this issues I was seeing.

phlogistonjohn · 2026-02-24T15:49:11Z

jenkins test make check arm64

batrick · 2026-02-25T13:39:52Z

jenkins test make check arm64

phlogistonjohn · 2026-03-03T15:09:31Z

Hi all, I am waiting on having this get merged before I finally merge #64641 - is this just mainly waiting on teuthology? Anything else?

vshankar · 2026-03-04T13:54:03Z

This PR is under test in https://tracker.ceph.com/issues/75334.

vshankar · 2026-03-13T08:21:22Z

Pushed a fix.

avanthakkar · 2026-03-13T09:14:50Z

src/mon/AuthMonitor.cc

 	  err = -EINVAL;
 	  goto done;
 	}
+        if (last == 'r' && c == 'w') {


I think issue was just that * wasn't handled,right? These changes restructures the loop, osd_cap_needs_w boolean, and rw-reset hack are all consequences of starting the loop at index 0 instead of 2. Instead could we just early exit for * and leave the rest untouched?

if (cap == "*") { osd_cap_wanted = "rw"; mds_cap_string += mds_cap_string.empty() ? "" : ", "; mds_cap_string += "allow *"; if (filesystem != "*" && filesystem != "all" && fs != nullptr) mds_cap_string += " fsname=" + string(fs->get_mds_map().get_fs_name()); if (path != "/") mds_cap_string += " path=" + path; if (root_squash) mds_cap_string += " root_squash"; continue; } // rest of existing logic unchanged

Aren't you duplicating the code that way?

I think the code restructure improved readability. Unfortunately, a bug got introduced and its nice that it was caught in testing :)

vshankar · 2026-03-13T07:32:25Z

src/mon/AuthMonitor.cc

+          }
+          osd_cap_wanted += 'w';
+          break;
+        case 'w':


This causes malformed OSD caps to be generated for auth string "/ rw root_squash /dir1 rw".

See: /a/vshankar-2026-03-05_08:10:26-fs-wip-vshankar-testing-20260304.135307-testing-default-trial/87189

OSD caps get generated as "rww" which fails the "fs authorize" command.

vshankar · 2026-03-13T13:15:20Z

src/mon/AuthMonitor.cc

 	  err = -EINVAL;
 	  goto done;
 	}
+        if (last == 'r' && c == 'w') {


Aren't you duplicating the code that way?

@vshankar

Right now only a client with "rw" permissions on an MDS gets "rw" on an OSD. [@vshankar: fixed malformed OSD cap when authorizing multiple paths] Reported-by: John Mulligan <jmulligan@redhat.com> Fixes: https://tracker.ceph.com/issues/75013 Signed-off-by: Patrick Donnelly <pdonnell@ibm.com> Signed-off-by: Venky Shankar <vshankar@redhat.com>

Error string validation is prone to failures when error string changes. errno (retval) validation suffices for tests. Signed-off-by: Venky Shankar <vshankar@redhat.com>

* refs/pull/67406/head: Reviewed-by: John Mulligan <jmulligan@redhat.com> Reviewed-by: Venky Shankar <vshankar@redhat.com>

vshankar · 2026-03-16T04:58:08Z

Fixing and validating a test case change.

vshankar

https://tracker.ceph.com/projects/cephfs/wiki/QA_main_--_2026#wip-vshankar-testing-20260304135307

vshankar · 2026-03-17T09:58:15Z

jenkins test api

github-actions bot added core mon labels Feb 18, 2026

batrick force-pushed the i75013 branch from ac6df7b to 186f068 Compare February 18, 2026 20:32

phlogistonjohn mentioned this pull request Feb 19, 2026

smb: add keybridge support and fscrypt configuration #64641

Open

14 tasks

phlogistonjohn added the wip-phlogistonjohn-testing-1 label Feb 20, 2026

batrick force-pushed the i75013 branch from 186f068 to e7d95a5 Compare February 23, 2026 00:01

phlogistonjohn approved these changes Feb 24, 2026

View reviewed changes

batrick requested review from a team and rishabh-d-dave February 25, 2026 13:40

batrick force-pushed the i75013 branch from e7d95a5 to 1239fbe Compare February 25, 2026 16:02

vshankar approved these changes Feb 26, 2026

View reviewed changes

vshankar added the wip-vshankar-testing label Mar 4, 2026

vshankar force-pushed the i75013 branch from 1239fbe to a56f7b2 Compare March 13, 2026 08:19

avanthakkar reviewed Mar 13, 2026

View reviewed changes

vshankar reviewed Mar 13, 2026

View reviewed changes

batrick and others added 2 commits March 16, 2026 10:21

qa/cephfs: do not validate error string in "fs authorize" tests

d499c7f

Error string validation is prone to failures when error string changes. errno (retval) validation suffices for tests. Signed-off-by: Venky Shankar <vshankar@redhat.com>

vshankar force-pushed the i75013 branch from a56f7b2 to d499c7f Compare March 16, 2026 04:52

github-actions bot added cephfs Ceph File System tests labels Mar 16, 2026

vshankar added a commit to vshankar/ceph that referenced this pull request Mar 16, 2026

Merge PR ceph#67406 into wip-vshankar-testing-20260313.134322

8f5ee89

* refs/pull/67406/head: Reviewed-by: John Mulligan <jmulligan@redhat.com> Reviewed-by: Venky Shankar <vshankar@redhat.com>

vshankar approved these changes Mar 17, 2026

View reviewed changes

vshankar merged commit 713e88e into ceph:main Mar 20, 2026
13 checks passed

vshankar removed the wip-vshankar-testing label Mar 20, 2026

Conversation

batrick commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Contribution Guidelines

Checklist

Uh oh!

batrick commented Feb 19, 2026

Uh oh!

phlogistonjohn commented Feb 22, 2026

Uh oh!

batrick commented Feb 23, 2026

Uh oh!

batrick commented Feb 23, 2026

Uh oh!

phlogistonjohn left a comment

Choose a reason for hiding this comment

Uh oh!

phlogistonjohn commented Feb 24, 2026

Uh oh!

batrick commented Feb 25, 2026

Uh oh!

phlogistonjohn commented Mar 3, 2026

Uh oh!

vshankar commented Mar 4, 2026

Uh oh!

vshankar commented Mar 13, 2026

Uh oh!

avanthakkar Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vshankar Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

vshankar Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

vshankar Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

vshankar Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

vshankar commented Mar 16, 2026

Uh oh!

vshankar left a comment

Choose a reason for hiding this comment

Uh oh!

vshankar commented Mar 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

batrick commented Feb 18, 2026 •

edited

Loading

avanthakkar Mar 13, 2026 •

edited

Loading