auth: check caps before allowing osdmap, mdsmap subscription

diff --git a/src/mon/Monitor.cc b/src/mon/Monitor.cc
index 8f9790dab89dbe7cfd756ec820bd575f91f71c24..29f9f8414c93bdddbc97edd5563ebd9e9dd3fd73 100644 (file)
--- a/src/mon/Monitor.cc
+++ b/src/mon/Monitor.cc
@@ -699,20 +699,23 @@ void Monitor::handle_subscribe(MMonSubscribe *m)
 
   s->until = g_clock.now();
   s->until += g_conf.mon_subscribe_interval;
-
   for (map<nstring,ceph_mon_subscribe_item>::iterator p = m->what.begin();
        p != m->what.end();
        p++) {
     if (!p->second.onetime)
       reply = true;
     session_map.add_update_sub(s, p->first, p->second.have, p->second.onetime);
-
-    if (p->first == "mdsmap")
-      mdsmon()->check_sub(s->sub_map["mdsmap"]);
-    else if (p->first == "osdmap")
-      osdmon()->check_sub(s->sub_map["osdmap"]);
-    else if (p->first == "monmap")
+    if (p->first == "mdsmap") {
+      if ((int)s->caps.get_caps(PAXOS_MDSMAP) & (MON_CAP_R)) {
+        mdsmon()->check_sub(s->sub_map["mdsmap"]);
+      }
+    } else if (p->first == "osdmap") {
+      if ((int)s->caps.get_caps(PAXOS_OSDMAP) & (MON_CAP_R)) {
+        osdmon()->check_sub(s->sub_map["osdmap"]);
+      }
+    } else if (p->first == "monmap") {
       check_sub(s->sub_map["monmap"]);
+    }
   }
 
   // ???