auth: keyring without mon entity type should return -EACCES

            test:
                         see test.sh:test_mon_caps
                         before modify:
                         when we first exec ../qa/workunits/cephtool/test.sh -t mon_caps --asok-does-not-need-root , it stuck.
                         after modify:
                         exec again, return Permission denied.

Signed-off-by: Xiaowei Chen <chen.xiaowei@h3c.com>

diff --git a/qa/workunits/cephtool/test.sh b/qa/workunits/cephtool/test.sh
index 1ba1efee73583cbf7d9a38b94b45ad1adf1b1ef6..efbbcdfd7d94f540b0ea21efeb557073f60fd2cc 100755 (executable)
--- a/qa/workunits/cephtool/test.sh
+++ b/qa/workunits/cephtool/test.sh
@@ -574,6 +574,27 @@ function test_auth_profiles()
   rm -f client.xx.keyring client.xx.keyring.2
 }
 
+function test_mon_caps()
+{
+  ./ceph-authtool --create-keyring $TMPDIR/ceph.client.bug.keyring
+  chmod +r  $TMPDIR/ceph.client.bug.keyring
+  ./ceph-authtool  $TMPDIR/ceph.client.bug.keyring -n client.bug --gen-key
+  ./ceph auth add client.bug -i  $TMPDIR/ceph.client.bug.keyring
+
+  ./rados lspools --keyring $TMPDIR/ceph.client.bug.keyring -n client.bug >& $TMPFILE || true
+  check_response "Permission denied"
+
+  rm -rf $TMPDIR/ceph.client.bug.keyring
+  ./ceph auth del client.bug
+  ./ceph-authtool --create-keyring $TMPDIR/ceph.client.bug.keyring
+  chmod +r  $TMPDIR/ceph.client.bug.keyring
+  ./ceph-authtool  $TMPDIR/ceph.client.bug.keyring -n client.bug --gen-key
+  ./ceph-authtool -n client.bug --cap mon '' $TMPDIR/ceph.client.bug.keyring
+  ./ceph auth add client.bug -i  $TMPDIR/ceph.client.bug.keyring
+  ./rados lspools --keyring $TMPDIR/ceph.client.bug.keyring -n client.bug >& $TMPFILE || true
+  check_response "Permission denied"  
+}
+
 function test_mon_misc()
 {
   # with and without verbosity
@@ -1720,7 +1741,7 @@ MON_TESTS+=" mon_tell"
 MON_TESTS+=" mon_crushmap_validation"
 MON_TESTS+=" mon_ping"
 MON_TESTS+=" mon_deprecated_commands"
-
+MON_TESTS+=" mon_caps"
 OSD_TESTS+=" osd_bench"
 OSD_TESTS+=" tiering_agent"
 

diff --git a/src/auth/cephx/CephxServiceHandler.cc b/src/auth/cephx/CephxServiceHandler.cc
index c5d91d98bcac067ea759af0414d31c259d49b106..e315d3da4742adcaf3b7e2396bc06db275a305fa 100644 (file)
--- a/src/auth/cephx/CephxServiceHandler.cc
+++ b/src/auth/cephx/CephxServiceHandler.cc
@@ -139,6 +139,13 @@ int CephxServiceHandler::handle_request(bufferlist::iterator& indata, bufferlist
 
       if (!key_server->get_service_caps(entity_name, CEPH_ENTITY_TYPE_MON, caps)) {
         ldout(cct, 0) << " could not get mon caps for " << entity_name << dendl;
+        ret = -EACCES;
+      } else {
+        char *caps_str = caps.caps.c_str();
+        if (!caps_str || !caps_str[0]) {
+          ldout(cct,0) << "mon caps null for " << entity_name << dendl;
+          ret = -EACCES;
+        }
       }
     }
     break;

diff --git a/src/ceph.in b/src/ceph.in
index c6c7c498511b7bea645a7e0aefc0e1907aa028b2..6f16046fdf8890bdad4b50093cf87b869aec7567 100755 (executable)
--- a/src/ceph.in
+++ b/src/ceph.in
@@ -710,6 +710,10 @@ def main():
     except KeyboardInterrupt:
         print >> sys.stderr, 'Cluster connection aborted'
         return 1
+    except rados.PermissionDeniedError as e:
+        print >> sys.stderr, 'Error connecting to cluster: {0}'.\
+            format(e.__class__.__name__)
+        return errno.EACCES
     except Exception as e:
         print >> sys.stderr, 'Error connecting to cluster: {0}'.\
             format(e.__class__.__name__)

diff --git a/src/pybind/rados.py b/src/pybind/rados.py
index ccada723c3660838fa15b551cc20338026debb90..9500ccdf54b72daffb0c74d2aee0959a47dd430c 100644 (file)
--- a/src/pybind/rados.py
+++ b/src/pybind/rados.py
@@ -41,6 +41,9 @@ class PermissionError(Error):
     """ `PermissionError` class, derived from `Error` """
     pass
 
+class PermissionDeniedError(Error):
+    """ deal with EACCES related. """
+    pass
 
 class ObjectNotFound(Error):
     """ `ObjectNotFound` class, derived from `Error` """
@@ -122,7 +125,8 @@ def make_ex(ret, msg):
         errno.EBUSY     : ObjectBusy,
         errno.ENODATA   : NoData,
         errno.EINTR     : InterruptedOrTimeoutError,
-        errno.ETIMEDOUT : TimedOut
+        errno.ETIMEDOUT : TimedOut,
+        errno.EACCES    : PermissionDeniedError
         }
     ret = abs(ret)
     if ret in errors: