summaryrefslogtreecommitdiffstats
path: root/src/mds/MDSAuthCaps.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* mds/Server: disallow clients that have root_squashRamana Raja2023-09-111-0/+9
| | | | | | | | | | | | | | | | | ... MDS auth caps but don't have CEPHFS_FEATURE_MDS_AUTH_CAPS_CHECK feature bit (i.e., can't check the auth caps sent back to it by the MDS) from establishing a session. Do this in Server::handle_client_session(), and Server::handle_client_reconnect(), where old clients try to reconnect to MDS servers after an upgrade. If the client doesn't have the ability to authorize session access based on the MDS auth caps send back to it by the MDS, then the client may buffer changes locally during open and setattr operations when it's not supposed to, e.g., when enforcing root_squash MDS auth caps. Fixes: https://tracker.ceph.com/issues/56067 Signed-off-by: Ramana Raja <rraja@redhat.com>
* mds: send the cap_auths to clients when openning the sessionsXiubo Li2023-09-111-0/+8
| | | | | Fixes: https://tracker.ceph.com/issues/57154 Signed-off-by: Xiubo Li <xiubli@redhat.com>
* mds: add MDSCapAuth supportXiubo Li2023-09-111-0/+35
| | | | | | | Need to add writeable/readable members and send them back to clients. Fixes: https://tracker.ceph.com/issues/57154 Signed-off-by: Xiubo Li <xiubli@redhat.com>
* mds: encode/decode the MDSCapMatchXiubo Li2023-09-111-0/+22
| | | | | | | Will send this to clients. Fixes: https://tracker.ceph.com/issues/57154 Signed-off-by: Xiubo Li <xiubli@redhat.com>
* mds: add assign operator support for MDSCapMatchXiubo Li2023-09-111-1/+10
| | | | | Fixes: https://tracker.ceph.com/issues/57154 Signed-off-by: Xiubo Li <xiubli@redhat.com>
* AuthMonitor: allow "fs authorize" to update capsRishabh Dave2023-07-301-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When "fs authorize" subcommand is executed for the second time with different caps, the subcommand exits with error. Modify the behaviour so that the caps passed every subsequent time is incorporated in to the caps that are already present in the entity's keyring. Behaviour before this commit - $ ./bin/ceph fs authorize a client.x1 / rw [client.x1] key = AQBirqxg5KHeFxAAgOm6lHMYych6OTI+y1HJKw== $ ./bin/ceph fs authorize b client.x1 / rw Error EINVAL: client.x1 already has fs capabilities that differ from those supplied. To generate a new auth key for client.x1, first remove client.x1 from configuration files, execute 'ceph auth rm client.x1', then execute this command again. $ ./bin/ceph auth get client.x1 [client.x1] key = AQBirqxg5KHeFxAAgOm6lHMYych6OTI+y1HJKw== caps mds = "allow rw fsname=a" caps mon = "allow r fsname=a" caps osd = "allow rw tag cephfs data=a" exported keyring for client.x1 After this commit - $ ./bin/ceph fs authorize a client.x1 / rw [client.x1] key = AQDvrqxgU3I3FBAAJWwF6ZtcOVeHH8TA8CwWmQ== $ ./bin/ceph fs authorize b client.x1 / rw updated caps for client.x1 $ ./bin/ceph auth get client.x1 [client.x1] key = AQDvrqxgU3I3FBAAJWwF6ZtcOVeHH8TA8CwWmQ== caps mds = "allow rw fsname=a, allow rw fsname=b" caps mon = "allow r fsname=a, allow r fsname=b" caps osd = "allow rw tag cephfs data=a, allow rw tag cephfs data=b" exported keyring for client.x1 Fixes: https://tracker.ceph.com/issues/47264 Signed-off-by: Rishabh Dave <ridave@redhat.com> MDSAuthCaps: bug fixes Signed-off-by: Rishabh Dave <ridave@redhat.com>
* mds: allow all types of MDS capsRishabh Dave2023-07-141-23/+11
| | | | | | | | | | | | | | | | | | MDS caps can contain 5 components: name of a CephFS, a path inside CephFS, a flag for enabling root squashing mechanism, a UID and list of GIDs. These 5 components result in 31 combinations, so there can be 31 types of MDS caps. Out of these, the current main branch only allows 11 combinations. This restriction is strange and inappropriate. Ideally, all combinations should be allowed. This strange restriction must've been created unintentionally by previous developers while adding FS name and root squash to MDS caps. A TODO for a allowing a subset of these combination was also left in codebase: https://github.com/ceph/ceph/blob/reef/src/mds/MDSAuthCaps.cc#L69 Fixes: https://tracker.ceph.com/issues/59388 Signed-off-by: Rishabh Dave <ridave@redhat.com>
* mds: use variable g_ceph_context directly in MDSAuthCapsRishabh Dave2023-06-161-4/+2
| | | | | | | Variable g_ceph_context is global, therefore use it directly instead of passing it as a parameter to method. Signed-off-by: Rishabh Dave <ridave@redhat.com>
* mds: Add full caps to avoid osd full checkKotresh HR2021-05-191-1/+11
| | | | | Fixes: https://tracker.ceph.com/issues/50532 Signed-off-by: Kotresh HR <khiremat@redhat.com>
* mds: use narrower ostream header instead of sstreamPatrick Donnelly2021-01-111-1/+1
| | | | Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
* mds: add root_squash mode in MDS auth capsRamana Raja2020-09-251-0/+7
| | | | | | | | | | | | | | | | | | | | Implement a root_squash mode in MDS auth caps to deny operations for clients with uid=0 or gid=0 that need write access. It's mainly to prevent operations such as accidental `sudo rm -rf /path`. The root squash mode can be enforced in one of the following ways in the MDS caps, 'allow rw root_squash' (across file systems) or 'allow rw fsname=a root_squash' (on a file system) or 'allow rw fsname=a path=/vol/group/subvol00 root_squash' (on a file system path) Fixes: https://tracker.ceph.com/issues/42451 Signed-off-by: Ramana Raja <rraja@redhat.com>
* cephfs: add auth caps based on fs namesDouglas Fuller2020-09-101-4/+38
| | | | | | | | | | | | | | | | | | Add new auth caps to restrict access to clients based on fsnames. To specify this, for example: mds 'allow rw fsname=cephfs1' This will restrict client access to fs name "cephfs1" only. Messages to active MDS assigned to any other FSMap will be dropped. Standby MDS not associated with an FSMap will accept messages from clients. To allow multiple file systems, create MDS cap as follows - mds 'allow rw fsname=cephfs1, allow rw fsname=cephfs2' Fixes: http://tracker.ceph.com/issues/15070 Signed-off-by: Douglas Fuller <dfuller@redhat.com> Signed-off-by: Rishabh Dave <ridave@redhat.com>
* mds: Build target 'common' without using namespace in headersAdam C. Emerson2020-03-071-2/+2
| | | | | | | | Part of a changeset to allow building all of 'common' without relying on 'using namespace std' or 'using namespace ceph' at toplevel in headers. Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
* crimson:common add TOPNSPC namespace for ceph and crimsonChunmei Liu2020-02-281-2/+1
| | | | | | | | | | some code coexist in crimson seastar environment and posix environment, so add namespace to avoid same function conflict, for example add namespace for CephContext, since the new namespace for classic ceph-osd, need modify all files declare use CephContext by including "common_fwd.h" which defined the namespace for each environment. Signed-off-by: Chunmei Liu <chunmei.liu@intel.com>
* mds: Reorganize class members in MDSAuthCaps headerVarsha Rao2019-10-301-21/+18
| | | | | Fixes: https://tracker.ceph.com/issues/42311 Signed-off-by: Varsha Rao <varao@redhat.com>
* mds: move session setup to ms_handle_acceptPatrick Donnelly2019-01-311-7/+11
| | | | | | | | | | | | Session setup in ms_handle_authentication is (historically) racy where multiple connections from the same client can come in before one is finally accepted. A session should only be created after ms_handle_accept. The MDS did some backflips before this commit to ensure this. Moreover, with the msgr2 changes, it is even more necessary since the address nonce is not set until before ms_handle_accept is called. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
* mds/MDSAuthCaps: parse and enforce network restrictionSage Weil2018-08-131-2/+16
| | | | Signed-off-by: Sage Weil <sage@redhat.com>
* mds/MDSAuthCaps: pass addr to is_capableSage Weil2018-08-131-1/+2
| | | | Signed-off-by: Sage Weil <sage@redhat.com>
* mds: add MAY_SNAPSHOT in MDSAuthCapsYan, Zheng2018-06-191-20/+41
| | | | | | | | For controlling whether a client is allowed to create or delete snapshots Fixes: http://tracker.ceph.com/issues/24284 Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
* src: Added const references to various function parametersWilson E. Alvarez2018-04-061-2/+2
| | | | | | | Added const references to various function parameters in order to avoid copying data unnecessarily and enhancing performance Signed-off-by: Wilson E. Alvarez <wilson.e.alvarez1@gmail.com>
* mds: convert to allocator agnostic string_viewPatrick Donnelly2018-02-071-7/+9
| | | | | | This is necessary to allow many interfaces to take mempool allocated strings. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
* mds: extend 'p' auth cap to cover all vxattr stuffJohn Spray2017-03-081-7/+7
| | | | | Fixes: http://tracker.ceph.com/issues/19075 Signed-off-by: John Spray <john.spray@redhat.com>
* mds: pass full gid list to MDSAuthCap checks, when presentGreg Farnum2016-09-221-3/+4
| | | | Signed-off-by: Greg Farnum <gfarnum@redhat.com>
* make ctors with one argument explicitDanny Al-Gaaf2016-01-291-3/+3
| | | | | | | Use explicit keyword for constructors with one argument to prevent implicit usage as conversion functions. Signed-off-by: Danny Al-Gaaf <danny.al-gaaf@bisect.de>
* mds: add docstring for MDSAuthCaps::path_capableJohn Spray2016-01-051-0/+6
| | | | Signed-off-by: John Spray <john.spray@redhat.com>
* mds: add MDSAuthCaps.maybe_capable(path)John Spray2016-01-051-0/+3
| | | | | | | | | To allow us to query whether a client is potentially capable of accessing a particular path, ignoring uids/gids (used to validate the client's claims about its mounted root) Signed-off-by: John Spray <john.spray@redhat.com>
* mds: add MAY_SET_POOL in MDSAuthCapsJohn Spray2015-11-131-3/+13
| | | | | | | For controlling whether a client is allowed to modify the pool field in file/dir layouts. Signed-off-by: John Spray <john.spray@redhat.com>
* mds: drop MAY_CREATESage Weil2015-10-011-1/+0
| | | | | | | | The check is a no-op. We already verify the uid/gid combo is valid and that the dir is writeable with MAY_WRITE. The new file is always set to the caller uid:gid. Signed-off-by: Sage Weil <sage@redhat.com>
* mds/MDSAuthCap: verify the caller_gid is validSage Weil2015-10-011-1/+5
| | | | | | Verify both the caller uid and gid are a match for the given rule. Signed-off-by: Sage Weil <sage@redhat.com>
* mds: fix chown/chgrp check and testsSage Weil2015-10-011-1/+2
| | | | Signed-off-by: Sage Weil <sage@redhat.com>
* mds/Server: add chown and chgrp check access to setattrNishtha Rai2015-10-011-1/+3
|
* MDSAuthCaps: validate create accessNishtha Rai2015-10-011-1/+2
| | | | Signed-off-by: Nishtha Rai <nishtha3rai@gmail.com>
* mds/MDSAuthCaps: fix allow_allSage Weil2015-10-011-1/+1
| | | | | | Empty path is '', not '/'. Signed-off-by: Sage Weil <sage@redhat.com>
* mds/MDSAuthCaps: add cct for debug contextSage Weil2015-10-011-3/+11
| | | | | signed-off-by: Nishtha Rai <nishtha3rai@gmail.com> Signed-off-by: Sage Weil <sage@redhat.com>
* mds/MDSAuthCaps: normalize path, drop useless constant.Sage Weil2015-10-011-8/+13
| | | | | | | Use an empty string for no path--this is more efficient. This generalizes to losing any leading '/' character. Signed-off-by: Sage Weil <sage@redhat.com>
* mds/MDSAuthCaps: pass down inode uid.gid and modeSage Weil2015-10-011-1/+3
| | | | | | We will need this to evaluate the unix permissions. Signed-off-by: Sage Weil <sage@redhat.com>
* mds/MDSAuthCap: fix uid and gid typesSage Weil2015-10-011-7/+8
| | | | | | | int64_t for uid, so we can do a negative "none" value. gid_t (uint32_t) for gid. Signed-off-by: Sage Weil <sage@redhat.com>
* mds/MDSAuthCaps: cosmeticSage Weil2015-10-011-4/+2
| | | | Signed-off-by: Sage Weil <sage@redhat.com>
* mds/MDSAuthCaps: use bitmask for is_capable()Sage Weil2015-10-011-3/+8
| | | | Signed-off-by: Sage Weil <sage@redhat.com>
* mds/MDSAuthCap: fix path matchSage Weil2015-10-011-6/+1
| | | | Signed-off-by: Sage Weil <sage@redhat.com>
* mds/MDSAuthCaps: move allows() into MDSCapSpecSage Weil2015-10-011-0/+9
| | | | | | Also, fix this so that 'any' implies that we can read or write. Signed-off-by: Sage Weil <sage@redhat.com>
* mds/MDSAuthCaps: parse optional gid listSage Weil2015-10-011-4/+8
| | | | Signed-off-by: Sage Weil <sage@redhat.com>
* mds/MDSAuthCaps: whitespaceSage Weil2015-10-011-15/+23
| | | | Signed-off-by: Sage Weil <sage@redhat.com>
* mds: MDSAuthCaps: init "read" param in default constructorGreg Farnum2014-10-091-1/+1
| | | | | | | CID 1244228: Uninitialized scalar field (UNINIT_CTOR) /mds/MDSAuthCaps.h: 29 in MDSCapSpec::MDSCapSpec()() Signed-off-by: Greg Farnum <greg@inktank.com>
* mds: fix MDSAuthCap when cephx is disabledJohn Spray2014-10-081-0/+1
| | | | Signed-off-by: John Spray <john.spray@redhat.com>
* mds: introduce MDS auth capsJohn Spray2014-10-081-0/+86
Signed-off-by: John Spray <john.spray@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-20 07:50:27 +0100