doc/release-notes: note about emperor backport of mon auth fix

Signed-off-by: Sage Weil <sage@inktank.com>

diff --git a/doc/release-notes.rst b/doc/release-notes.rst
index ccf0998d9bc6b086bc002a09e4c03a97b77884c9..a589c1f498d022e08c7580fb4e4bfb6e33fc3e95 100644 (file)
--- a/doc/release-notes.rst
+++ b/doc/release-notes.rst
@@ -1018,6 +1018,24 @@ Notable Changes
 * rgw: support for password (instead of admin token) for keystone authentication (Christophe Courtaut)
 * sysvinit, upstart: prevent both init systems from starting the same daemons (Josh Durgin)
 
+v0.72.3 Emperor (pending release)
+=================================
+
+Upgrading
+---------
+
+* Monitor 'auth' read-only commands now expect the user to have 'rx' caps.
+  This is the same behavior that was present in dumpling, but in emperor
+  and more recent development releases the 'r' cap was sufficient.  Note that
+  this backported security fix will break mon keys that are using the following
+  commands but do not have the 'x' bit in the mon capability::
+
+    ceph auth export
+    ceph auth get
+    ceph auth get-key
+    ceph auth print-key
+    ceph auth list
+
 
 v0.72.2 Emperor
 ===============