On Fri, Jun 2, 2023 at 3:30 AM Xiubo Li <xiubli@xxxxxxxxxx> wrote:
>
>
> On 5/24/23 23:33, Alexander Mikhalitsyn wrote:
> > From: Christian Brauner <christian.brauner@xxxxxxxxxx>
> >
> > Enable __ceph_setattr() to handle idmapped mounts. This is just a matter
> > of passing down the mount's idmapping.
> >
> > Cc: Jeff Layton <jlayton@xxxxxxxxxx>
> > Cc: Ilya Dryomov <idryomov@xxxxxxxxx>
> > Cc: ceph-devel@xxxxxxxxxxxxxxx
> > Signed-off-by: Christian Brauner <christian.brauner@xxxxxxxxxx>
> > Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@xxxxxxxxxxxxx>
> > ---
> > fs/ceph/inode.c | 11 +++++++++--
> > 1 file changed, 9 insertions(+), 2 deletions(-)
> >
> > diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
> > index 37e1cbfc7c89..f1f934439be0 100644
> > --- a/fs/ceph/inode.c
> > +++ b/fs/ceph/inode.c
> > @@ -2050,6 +2050,13 @@ int __ceph_setattr(struct inode *inode, struct iattr *attr)
> >
> > dout("setattr %p issued %s\n", inode, ceph_cap_string(issued));
> >
> > + /*
> > + * The attr->ia_{g,u}id members contain the target {g,u}id we're
> > + * sending over the wire. The mount idmapping only matters when we
> > + * create new filesystem objects based on the caller's mapped
> > + * fs{g,u}id.
> > + */
> > + req->r_mnt_idmap = &nop_mnt_idmap;
>
> For example with an idmapping 1000:0 and in the /mnt/idmapped_ceph/.
>
> This means the "__ceph_setattr()" will always use UID 0 to set the
> caller_uid, right ? If it is then the client auth checking for the
Yes, if you have a mapping like b:1000:0:1 (the last number is a
length of a mapping). It means even more,
the only user from which you can create something on the filesystem
will be UID = 0,
because all other UIDs/GIDs are not mapped and you'll instantly get
-EOVERFLOW from the kernel.
> setattr requests in cephfs MDS will succeed, since the UID 0 is root.
> But if you use a different idmapping, such as 1000:2000, it will fail.
If you have a mapping b:1000:2000:1 then the only valid UID/GID from
which you can create something
on an idmapped mount will be UID/GID = 2000:2000 (and this will be
mapped to 1000:1000 and sent over the wire,
because we performing an idmapping procedure for requests those are
creating inodes).
So, even root with UID = 0 will not be able to create a file on such a
mount and get -EOVERFLOW.
>
> So here IMO we should set it to 'idmap' too ?
Good question. I can't see any obvious issue with setting an actual
idmapping here.
It will be interesting to know Christian's opinion about this.
Kind regards,
Alex
>
> Thanks
>
> - Xiubo
>
> > if (ia_valid & ATTR_UID) {
> > dout("setattr %p uid %d -> %d\n", inode,
> > from_kuid(&init_user_ns, inode->i_uid),
> > @@ -2240,7 +2247,7 @@ int ceph_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
> > if (ceph_inode_is_shutdown(inode))
> > return -ESTALE;
> >
> > - err = setattr_prepare(&nop_mnt_idmap, dentry, attr);
> > + err = setattr_prepare(idmap, dentry, attr);
> > if (err != 0)
> > return err;
> >
> > @@ -2255,7 +2262,7 @@ int ceph_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
> > err = __ceph_setattr(inode, attr);
> >
> > if (err >= 0 && (attr->ia_valid & ATTR_MODE))
> > - err = posix_acl_chmod(&nop_mnt_idmap, dentry, attr->ia_mode);
> > + err = posix_acl_chmod(idmap, dentry, attr->ia_mode);
> >
> > return err;
> > }
>
