cephfs, mon/AuthMonitor, OSD/osdcap: make 'all' a synonym for '*'

Define the string 'all' to be a synonym for the wildcard '*'. This
avoids confusion in the event that some auth caps (typically with
ceph fs authorize) are not quoted and thus '*' is expanded by the shell.

Signed-off-by: Douglas Fuller <dfuller@redhat.com>

diff --git a/doc/cephfs/client-auth.rst b/doc/cephfs/client-auth.rst
index 1bc0576af5399e924a5132c58eca701944bdb976..78dd81fe970d4f5186094fbdd777bb6865250997 100644 (file)
--- a/doc/cephfs/client-auth.rst
+++ b/doc/cephfs/client-auth.rst
@@ -50,6 +50,9 @@ Note that if a client's read access is restricted to a path, they will only
 be able to mount the filesystem when specifying a readable path in the
 mount command (see below).
 
+Supplying ``all`` or ``*`` as the filesystem name will grant access to every
+file system. Note that it is usually necessary to quote ``*`` to protect it from
+the shell.
 
 See `User Management - Add a User to a Keyring`_. for additional details on user management
 

diff --git a/doc/man/8/ceph-authtool.rst b/doc/man/8/ceph-authtool.rst
index 56a0639cc8ba224068410c1d114b78b2e9ed0aae..475b0a21fa5d806a7c689af30e78dfb21484be20 100644 (file)
--- a/doc/man/8/ceph-authtool.rst
+++ b/doc/man/8/ceph-authtool.rst
@@ -151,7 +151,7 @@ The capspec determines what kind of operations the entity can perform::
     x           = can call any class method (same as class-read class-write)
     class-read  = can call class methods that are reads
     class-write = can call class methods that are writes
-    *           = equivalent to rwx, plus the ability to run osd admin commands,
+    * or "all"  = equivalent to rwx, plus the ability to run osd admin commands,
                   i.e. ceph osd tell ...
 
 The match criteria restrict a grant based on the pool being accessed.

diff --git a/doc/rados/operations/user-management.rst b/doc/rados/operations/user-management.rst
index 33b58c02252aff440a71c97eb5453c5e5e113ff0..a976ff2b6af3e12944322621d4fb1c4135c5b710 100644 (file)
--- a/doc/rados/operations/user-management.rst
+++ b/doc/rados/operations/user-management.rst
@@ -222,7 +222,7 @@ Application Tags
 
 Access may be restricted to specific pools as defined by their application
 metadata. The ``*`` wildcard may be used for the ``key`` argument, the
-``value`` argument, or both.
+``value`` argument, or both. ``all`` is a synony for ``*``.
 
 Namespace
 ---------

diff --git a/src/mds/MDSAuthCaps.cc b/src/mds/MDSAuthCaps.cc
index e22e449cd42218a5a1e8946064f5b0cd30abc19f..4ada87cf728a24b2bda4f6b0d9913e1d28744ed6 100644 (file)
--- a/src/mds/MDSAuthCaps.cc
+++ b/src/mds/MDSAuthCaps.cc
@@ -72,6 +72,8 @@ struct MDSCapParser : qi::grammar<Iterator, MDSAuthCaps()>
     capspec = spaces >> (
         lit("*")[_val = MDSCapSpec(true, true, true, true)]
         |
+        lit("all")[_val = MDSCapSpec(true, true, true, true)]
+        |
         (lit("rwp"))[_val = MDSCapSpec(true, true, false, true)]
         |
         (lit("rw"))[_val = MDSCapSpec(true, true, false, false)]

diff --git a/src/mon/AuthMonitor.cc b/src/mon/AuthMonitor.cc
index 9fbc4f089d255de434943728c4cbbe6dd54e6c00..9c60e37944fbdd4add8117a0bdd6379f330ad33e 100644 (file)
--- a/src/mon/AuthMonitor.cc
+++ b/src/mon/AuthMonitor.cc
@@ -1300,7 +1300,7 @@ bool AuthMonitor::prepare_command(MonOpRequestRef op)
       }
     }
 
-    if (filesystem != "*") {
+    if (filesystem != "*" && filesystem != "all") {
       auto fs = mon->mdsmon()->get_fsmap().get_filesystem(filesystem);
       if (!fs) {
        ss << "filesystem " << filesystem << " does not exist.";

diff --git a/src/mon/MonCap.cc b/src/mon/MonCap.cc
index c93644f6811e9f08065d29be961f540e46bdb37c..094a3332248ad2c1ee04b9b6afd67b28f90257aa 100644 (file)
--- a/src/mon/MonCap.cc
+++ b/src/mon/MonCap.cc
@@ -530,6 +530,7 @@ struct MonCapParser : qi::grammar<Iterator, MonCap()>
     // rwxa := * | [r][w][x]
     rwxa =
       (lit("*")[_val = MON_CAP_ANY]) |
+      (lit("all")[_val = MON_CAP_ANY]) |
       ( eps[_val = 0] >>
        ( lit('r')[_val |= MON_CAP_R] ||
          lit('w')[_val |= MON_CAP_W] ||

diff --git a/src/osd/OSDCap.cc b/src/osd/OSDCap.cc
index 95c94ebfef8f69fcf6538e2a3e1fabe0548d71a0..ba5a7eb821aa1f6f0dc75135ce01c0842f935284 100644 (file)
--- a/src/osd/OSDCap.cc
+++ b/src/osd/OSDCap.cc
@@ -398,6 +398,8 @@ struct OSDCapParser : qi::grammar<Iterator, OSDCap()>
 
     spaces = +ascii::space;
 
+    wildcard = (lit('*') | lit("all")) [_val = "*"];
+
     pool_name %= -(spaces >> lit("pool") >> (lit('=') | spaces) >> str);
     nspace %= (spaces >> lit("namespace")
               >> (lit('=') | spaces)
@@ -408,8 +410,8 @@ struct OSDCapParser : qi::grammar<Iterator, OSDCap()>
     object_prefix %= -(spaces >> lit("object_prefix") >> spaces >> str);
     pooltag %= (spaces >> lit("tag")
                >> spaces >> str // application
-               >> spaces >> (str | char_('*')) // key
-               >> -spaces >> lit('=') >> -spaces >> (str | char_('*'))); // value
+               >> spaces >> (wildcard | str) // key
+               >> -spaces >> lit('=') >> -spaces >> (wildcard | str)); // value
 
     match = (
       pooltag                                 [_val = phoenix::construct<OSDCapMatch>(_1)] |
@@ -421,7 +423,7 @@ struct OSDCapParser : qi::grammar<Iterator, OSDCap()>
 
     // rwxa := * | [r][w][x] [class-read] [class-write]
     rwxa =
-      (spaces >> lit("*")[_val = OSD_CAP_ANY]) |
+      (spaces >> wildcard[_val = OSD_CAP_ANY]) |
       ( eps[_val = 0] >>
        (
         spaces >>
@@ -459,6 +461,7 @@ struct OSDCapParser : qi::grammar<Iterator, OSDCap()>
   qi::rule<Iterator, string()> quoted_string, equoted_string;
   qi::rule<Iterator, string()> unquoted_word;
   qi::rule<Iterator, string()> str, estr;
+  qi::rule<Iterator, string()> wildcard;
   qi::rule<Iterator, int()> auid;
   qi::rule<Iterator, string()> class_name;
   qi::rule<Iterator, string()> class_cap;

diff --git a/src/test/osd/osdcap.cc b/src/test/osd/osdcap.cc
index 2d7629d1088de4000f8b28d2bfcb2aedff02e59f..b6a9309420ff542e244d84359bf5230d443f14ab 100644 (file)
--- a/src/test/osd/osdcap.cc
+++ b/src/test/osd/osdcap.cc
@@ -79,6 +79,7 @@ const char *parse_good[] = {
   "allow rwx tag application key =value",
   "allow rwx tag application key= value",
   "allow rwx tag application key  =   value",
+  "allow all tag application all=all",
   0
 };
 
@@ -909,7 +910,11 @@ TEST(OSDCap, OutputParsed)
     {"allow rwx tag application key=value",
      "osdcap[grant(app application key key val value rwx)]"},
     {"allow rwx namespace ns* tag application key=value",
-     "osdcap[grant(namespace ns* app application key key val value rwx)]"}
+     "osdcap[grant(namespace ns* app application key key val value rwx)]"},
+        {"allow all",
+         "osdcap[grant(*)]"},
+        {"allow rwx tag application all=all",
+         "osdcap[grant(app application key * val * rwx)]"}
   };
 
   size_t num_tests = sizeof(test_values) / sizeof(*test_values);