Re: CephFS Path Restriction, can still read all files

Burkhard Linke <Burkhard.Linke@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> · Wed, 11 Jan 2017 11:30:19 +0100



    Hi,

    
    On 01/11/2017 11:02 AM, Boris
      Mattijssen wrote:

    
      Hi
          all,
        

        I'm trying to use path restriction on CephFS, running a
          Ceph Jewel (ceph version 10.2.5) cluster. 
        For this I'm using
          the command specified in the official docs (http://docs.ceph.com/docs/jewel/cephfs/client-auth/):
        
          ceph auth get-or-create client.boris
            mon 'allow r' mds 'allow r, allow rw path=/boris' osd 'allow
            rw pool=cephfs_data'
        
        
        When I mount the fs
          with boris user and
          the generated secret I can still see all files in the fs (not
          just the files in /boris).
        l am restricted to
          write to anything but /boris, so the problem is that I can
          still read anything outside of /boris. 
        

        Can someone please
          clarify what's going on?
      
    
    As far as I understand the mds caps, mds 'allow r' allows read-only
    access to all files; 'allow rw path=/boris' restricts write access
    to the given path. So your observations reflect the given
    permissions.

    
    You can configure ceph-fuse and kcephfs to use a given directory as
    'root' directory of the mount point (e.g. ceph-fuse -r /boris). But
    I'm not sure whether 

    
    - you need access to the root directory to mount with -r option

    - you can restrict the read-only access to the root directory
    without sub directories 

      (e.g. 'allow r path=/, allow rw path=/boris' to allow mounting a
    sub directory only)

    
    Unfortunately the -r option is a client side option, so you have to
    trust your clients.

    
    Regards,

    Burkhard

  
_______________________________________________
ceph-users mailing list
ceph-users@xxxxxxxxxxxxxx
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com