Re: [PATCH] fs/ceph/super: add mount options "snapdir{mode,uid,gid}"

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 25/10/2022 15:22, Max Kellermann wrote:
On Tue, Oct 25, 2022 at 3:36 AM Xiubo Li <xiubli@xxxxxxxxxx> wrote:
Currently cephx permission has already supported the 's' permission,
which means you can do the snapshot create/remove. And for a privileged
or specific mounts you can give them the 's' permission and then only
they can do the snapshot create/remove. And all the others won't.
But that's a client permission, not a user permission.

I repeat: the problem is that snapshots should only be
accessible/discoverable/creatable by certain users (UIDs/GIDs) on the
client machine, independent of their permission on the parent
directory.

Hi Max,

Yeah, the cephx permission could cover this totally and there is no need to worry about the user id mapping issue.

You can allow the mount with specific client ids, "client.privileged" for example, could create/remove the snapshots:

[client.privileged]
    key = AQA19uZUqIwkHxAAFuUwvq0eJD4S173oFRxe0g==
    caps mds = "allow rws /"
    caps mon = "allow *"
    caps osd = "allow *"

[client.global]
    key = xE21RuZTqIuiHxFFAuEwv4TjJD3R176BFOi4Fj==
    caps mds = "allow rw /"
    caps mon = "allow *"
    caps osd = "allow *"

Then specify the client ids when mounting:

$ sudo ./bin/mount.ceph privileged@.a=/ /mnt/privileged/mountpoint

$ sudo ./bin/mount.ceph global@.a=/ /mnt/global/mountpoint

Just to make sure only certain users, who have permission to create/remove snapshots, could access to the "/mnt/privileged/" directory.

I didn't read the openshift code, but when I was debugging the bugs and from the logs I saw it acting similarly to this.

My patch decouples parent directory permissions from snapdir
permissions, and it's a simple and elegant solution to my problem.

Yeah, I'm aware of the differences between these two approaches exactly. This should be a common feature not only in kernel client. We also need to implement this in cephfs user space client. If the above cephx permission approach could work very well everywhere, I am afraid this couldn't go to ceph in user space.

And then use the container or something else to make the specific users
could access to them.
Sorry, I don't get it at all. What is "the container or something" and
how does it enable me to prevent specific users from accessing
snapdirs in their home directories?

Please see my above example. If that still won't work well, please send one mail in ceph-user to discuss this further, probably we can get more feedbacks from there.

Thanks!

- Xiubo




[Index of Archives]     [CEPH Users]     [Ceph Large]     [Ceph Dev]     [Information on CEPH]     [Linux BTRFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux