On Fri, Jun 9, 2023 at 3:57 AM Xiubo Li <xiubli@xxxxxxxxxx> wrote: > > > On 6/8/23 23:42, Alexander Mikhalitsyn wrote: > > Dear friends, > > > > This patchset was originally developed by Christian Brauner but I'll continue > > to push it forward. Christian allowed me to do that :) > > > > This feature is already actively used/tested with LXD/LXC project. > > > > Git tree (based on https://github.com/ceph/ceph-client.git master): Hi Xiubo! > > Could you rebase these patches to 'testing' branch ? Will do in -v6. > > And you still have missed several places, for example the following cases: > > > 1 269 fs/ceph/addr.c <<ceph_netfs_issue_op_inline>> > req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_GETATTR, > mode); + > 2 389 fs/ceph/dir.c <<ceph_readdir>> > req = ceph_mdsc_create_request(mdsc, op, USE_AUTH_MDS); + > 3 789 fs/ceph/dir.c <<ceph_lookup>> > req = ceph_mdsc_create_request(mdsc, op, USE_ANY_MDS); We don't have an idmapping passed to lookup from the VFS layer. As I mentioned before, it's just impossible now. I've checked all places with ceph_mdsc_create_request and passed idmapping everywhere if possible (in v6, that I will send soon). > ... > > > For this requests you also need to set the real idmap. Thanks, Alex > > > Thanks > > - Xiubo > > > > > v5: https://github.com/mihalicyn/linux/commits/fs.idmapped.ceph.v5 > > current: https://github.com/mihalicyn/linux/tree/fs.idmapped.ceph > > > > In the version 3 I've changed only two commits: > > - fs: export mnt_idmap_get/mnt_idmap_put > > - ceph: allow idmapped setattr inode op > > and added a new one: > > - ceph: pass idmap to __ceph_setattr > > > > In the version 4 I've reworked the ("ceph: stash idmapping in mdsc request") > > commit. Now we take idmap refcounter just in place where req->r_mnt_idmap > > is filled. It's more safer approach and prevents possible refcounter underflow > > on error paths where __register_request wasn't called but ceph_mdsc_release_request is > > called. > > > > Changelog for version 5: > > - a few commits were squashed into one (as suggested by Xiubo Li) > > - started passing an idmapping everywhere (if possible), so a caller > > UID/GID-s will be mapped almost everywhere (as suggested by Xiubo Li) > > > > I can confirm that this version passes xfstests. > > > > Links to previous versions: > > v1: https://lore.kernel.org/all/20220104140414.155198-1-brauner@xxxxxxxxxx/ > > v2: https://lore.kernel.org/lkml/20230524153316.476973-1-aleksandr.mikhalitsyn@xxxxxxxxxxxxx/ > > tree: https://github.com/mihalicyn/linux/commits/fs.idmapped.ceph.v2 > > v3: https://lore.kernel.org/lkml/20230607152038.469739-1-aleksandr.mikhalitsyn@xxxxxxxxxxxxx/#t > > v4: https://lore.kernel.org/lkml/20230607180958.645115-1-aleksandr.mikhalitsyn@xxxxxxxxxxxxx/#t > > tree: https://github.com/mihalicyn/linux/commits/fs.idmapped.ceph.v4 > > > > Kind regards, > > Alex > > > > Original description from Christian: > > ======================================================================== > > This patch series enables cephfs to support idmapped mounts, i.e. the > > ability to alter ownership information on a per-mount basis. > > > > Container managers such as LXD support sharaing data via cephfs between > > the host and unprivileged containers and between unprivileged containers. > > They may all use different idmappings. Idmapped mounts can be used to > > create mounts with the idmapping used for the container (or a different > > one specific to the use-case). > > > > There are in fact more use-cases such as remapping ownership for > > mountpoints on the host itself to grant or restrict access to different > > users or to make it possible to enforce that programs running as root > > will write with a non-zero {g,u}id to disk. > > > > The patch series is simple overall and few changes are needed to cephfs. > > There is one cephfs specific issue that I would like to discuss and > > solve which I explain in detail in: > > > > [PATCH 02/12] ceph: handle idmapped mounts in create_request_message() > > > > It has to do with how to handle mds serves which have id-based access > > restrictions configured. I would ask you to please take a look at the > > explanation in the aforementioned patch. > > > > The patch series passes the vfs and idmapped mount testsuite as part of > > xfstests. To run it you will need a config like: > > > > [ceph] > > export FSTYP=ceph > > export TEST_DIR=/mnt/test > > export TEST_DEV=10.103.182.10:6789:/ > > export TEST_FS_MOUNT_OPTS="-o name=admin,secret=$password > > > > and then simply call > > > > sudo ./check -g idmapped > > > > ======================================================================== > > > > Alexander Mikhalitsyn (5): > > fs: export mnt_idmap_get/mnt_idmap_put > > ceph: pass idmap to __ceph_setattr > > ceph: pass idmap to ceph_do_getattr > > ceph: pass idmap to __ceph_setxattr > > ceph: pass idmap to ceph_open/ioctl_set_layout > > > > Christian Brauner (9): > > ceph: stash idmapping in mdsc request > > ceph: handle idmapped mounts in create_request_message() > > ceph: pass an idmapping to mknod/symlink/mkdir/rename > > ceph: allow idmapped getattr inode op > > ceph: allow idmapped permission inode op > > ceph: allow idmapped setattr inode op > > ceph/acl: allow idmapped set_acl inode op > > ceph/file: allow idmapped atomic_open inode op > > ceph: allow idmapped mounts > > > > fs/ceph/acl.c | 8 ++++---- > > fs/ceph/addr.c | 3 ++- > > fs/ceph/caps.c | 3 ++- > > fs/ceph/dir.c | 4 ++++ > > fs/ceph/export.c | 2 +- > > fs/ceph/file.c | 21 ++++++++++++++----- > > fs/ceph/inode.c | 38 +++++++++++++++++++++-------------- > > fs/ceph/ioctl.c | 9 +++++++-- > > fs/ceph/mds_client.c | 27 +++++++++++++++++++++---- > > fs/ceph/mds_client.h | 1 + > > fs/ceph/quota.c | 2 +- > > fs/ceph/super.c | 6 +++--- > > fs/ceph/super.h | 14 ++++++++----- > > fs/ceph/xattr.c | 18 +++++++++-------- > > fs/mnt_idmapping.c | 2 ++ > > include/linux/mnt_idmapping.h | 3 +++ > > 16 files changed, 111 insertions(+), 50 deletions(-) > > >
