cephadm: restrict mds caps to cephfs pools

Fixes: https://tracker.ceph.com/issues/46081
Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
(cherry picked from commit 1ef958085d1fa86f3c79ba25b0e20be2e6fc5dd5)

diff --git a/src/pybind/mgr/cephadm/services/cephadmservice.py b/src/pybind/mgr/cephadm/services/cephadmservice.py
index c5ff300be50334b729106056d28414f6c188dcbb..d66b3df83eaf903dc7e388e36a9b8426cc3ac5d4 100644 (file)
--- a/src/pybind/mgr/cephadm/services/cephadmservice.py
+++ b/src/pybind/mgr/cephadm/services/cephadmservice.py
@@ -188,7 +188,7 @@ class MdsService(CephadmService):
             'prefix': 'auth get-or-create',
             'entity': 'mds.' + mds_id,
             'caps': ['mon', 'profile mds',
-                     'osd', 'allow rwx',
+                     'osd', 'allow rw tag cephfs *=*',
                      'mds', 'allow'],
         })
         return self.mgr._create_daemon('mds', mds_id, host, keyring=keyring)