auth: update documentation on caps

diff --git a/man/cauthtool.8 b/man/cauthtool.8
index 7e624b408441c2238bab06f2810a983beaa58427..7415a1bc3f14a16d4edb5c2e11eb0518a4b5744f 100644 (file)
--- a/man/cauthtool.8
+++ b/man/cauthtool.8
@@ -39,10 +39,10 @@ will set the capabilities associated with a given key.
 .SH CAPS FILE FORMAT
 The caps file format consists of zero or more key/value pairs.  The key is the name of the Ceph
 subsystem (osd, mds, mon).  The value is a comma separated list of allow, deny clauses with a permission
-specifier containing one or more of \fIrwx\fP, for read, write, and execute permission.  For
+specifier containing one or more of \fIrwx\fP, for read, write, and execute permission.  If you want to declare the key an administrator (with full privileges on everything), use the shorthand 'subsystem = "allow *"'. For
 example,
 .IP
-osd = "allow rwx [pool foo]"  # can read, write, and execute objects
+osd = "allow rwx [pool foo] [auid bar]"  # can read, write, and execute objects
 .IP
 mds = "allow"      # can access mds server
 .IP
@@ -57,6 +57,8 @@ A client mounting the file system with minimal permissions would need caps like
 mds = "allow"
 .IP
 osd = "allow rw pool data"
+.IP
+mon = "allow r"
 .PP
 .SH EXAMPLE
 To create a new keyring containing a key for \fIclient.foo\fP:

diff --git a/src/mon/MonCaps.h b/src/mon/MonCaps.h
index ddd83b45f1fdd2ad414089182170f666a103244d..c7fdad28abf2bb30f3782884402df57d767cf368 100644 (file)
--- a/src/mon/MonCaps.h
+++ b/src/mon/MonCaps.h
@@ -10,6 +10,13 @@
  * License version 2.1, as published by the Free Software 
  * Foundation.  See file COPYING.
  * 
+ * MonCaps: Hold the capabilities associated with a single authenticated 
+ * user key. These are specified by text strings of the form
+ * "allow r" (which allows reading of the cluster state)
+ * "allow rwx auid foo[,bar,baz]" (which allows full access to listed auids)
+ * "allow rw service_name" (which allows reading and writing to the named
+ *                          service type)
+ * "allow *" (which allows full access to EVERYTHING)
  */
 
 #ifndef __MONCAPS_H

diff --git a/src/osd/OSDCaps.h b/src/osd/OSDCaps.h
index 922ffc4c5be9dbebb21ab8828a6aba47e69a6984..e4d73bcdab566abb0fc06c171470910095b97de7 100644 (file)
--- a/src/osd/OSDCaps.h
+++ b/src/osd/OSDCaps.h
@@ -10,6 +10,12 @@
  * License version 2.1, as published by the Free Software 
  * Foundation.  See file COPYING.
  * 
+ * OSDCaps: Hold the capabilities associated with a single authenticated 
+ * user key. These are specified by text strings of the form
+ * "allow r" (which allows reading anything on the OSD)
+ * "allow rwx auid foo[,bar,baz]" (which allows full access to listed auids)
+ *  "allow rwx pool foo[,bar,baz]" (which allows full access to listed pools)
+ * "allow *" (which allows full access to EVERYTHING)
  */
 
 #ifndef __CEPH_OSDCAPS_H