ceph_authtool: add mode option

We now have the ability to set the keyring file mode with the help of
'--mode MODE'. The mode needs to be specified in octal using the format:
0600.

Closes: http://tracker.ceph.com/issues/23513
Signed-off-by: Sébastien Han <seb@redhat.com>
(cherry picked from commit b179cd275526613a3838cb52e6f1c35950b6f3a8)

diff --git a/doc/man/8/ceph-authtool.rst b/doc/man/8/ceph-authtool.rst
index 0187d89858fa295e2e3a1d9ef5b5757c4d7a0068..62f3836826914a7e6910174f85b72660d56c2d38 100644 (file)
--- a/doc/man/8/ceph-authtool.rst
+++ b/doc/man/8/ceph-authtool.rst
@@ -21,6 +21,7 @@ Synopsis
   [ -a | --add-key *base64_key* ]
   [ --cap *subsystem* *capability* ]
   [ --caps *capfile* ]
+  [ --mode *mode* ]
 
 
 Description
@@ -87,6 +88,10 @@ Options
 
    will set all of capabilities associated with a given key, for all subsystems
 
+ .. option:: --mode *mode*
+
+    will set the desired file mode to the keyring e.g: 0644, defaults to 0600
+
 
 Capabilities
 ============
@@ -172,9 +177,9 @@ value is the capability string (see above).
 Example
 =======
 
-To create a new keyring containing a key for client.foo::
+To create a new keyring containing a key for client.foo with a 0644 file mode::
 
-        ceph-authtool -C -n client.foo --gen-key keyring
+        ceph-authtool -C -n client.foo --gen-key keyring --mode 0644
 
 To associate some capabilities with the key (namely, the ability to
 mount a Ceph filesystem)::

diff --git a/src/test/cli/ceph-authtool/add-key-segv.t b/src/test/cli/ceph-authtool/add-key-segv.t
index 724deb0b6f37aad6f6ddba86af225f286daf4035..6914593f3367c3fcf7a71a7b48e09d8a5a90737b 100644 (file)
--- a/src/test/cli/ceph-authtool/add-key-segv.t
+++ b/src/test/cli/ceph-authtool/add-key-segv.t
@@ -1,4 +1,4 @@
-  $ ceph-authtool kring --create-keyring
+  $ ceph-authtool kring --create-keyring --mode 0644
   creating kring
 
   $ ceph-authtool kring --add-key 'FAKEBASE64 foo'

diff --git a/src/test/cli/ceph-authtool/add-key.t b/src/test/cli/ceph-authtool/add-key.t
index 2bfcce0b12db3c1d2f28c7db43348d690cc87f93..1ff76b98f9842cd65fd6bfac32f7638f73022579 100644 (file)
--- a/src/test/cli/ceph-authtool/add-key.t
+++ b/src/test/cli/ceph-authtool/add-key.t
@@ -1,4 +1,4 @@
-  $ ceph-authtool kring --create-keyring
+  $ ceph-authtool kring --create-keyring --mode 0644
   creating kring
 
   $ ceph-authtool kring --add-key 'AQAK7yxNeF+nHBAA0SgSdbs8IkJrxroDeJ6SwQ== 18446744073709551615'

diff --git a/src/test/cli/ceph-authtool/cap-bin.t b/src/test/cli/ceph-authtool/cap-bin.t
index 50efa5c9dd7ef837615434314db76ec0ffdfed5d..96b47b65152e1ac8f30045da6789d05003fee14c 100644 (file)
--- a/src/test/cli/ceph-authtool/cap-bin.t
+++ b/src/test/cli/ceph-authtool/cap-bin.t
@@ -1,4 +1,4 @@
-  $ ceph-authtool kring --create-keyring --gen-key
+  $ ceph-authtool kring --create-keyring --gen-key --mode 0644
   creating kring
 
   $ ceph-authtool --cap osd 'allow rx pool=swimming' kring

diff --git a/src/test/cli/ceph-authtool/cap-invalid.t b/src/test/cli/ceph-authtool/cap-invalid.t
index c857e26ab5264d829b8101335c7c3480e72eeebb..c67ea5b6919b0069a5834c4d2129900e28b1c79c 100644 (file)
--- a/src/test/cli/ceph-authtool/cap-invalid.t
+++ b/src/test/cli/ceph-authtool/cap-invalid.t
@@ -1,4 +1,4 @@
-  $ ceph-authtool kring --create-keyring --gen-key
+  $ ceph-authtool kring --create-keyring --gen-key --mode 0644
   creating kring
 
 # TODO is this nice?

diff --git a/src/test/cli/ceph-authtool/cap-overwrite.t b/src/test/cli/ceph-authtool/cap-overwrite.t
index 30788dfd4fd8b7ebde18653cd8fe86dbc0c4e843..ac8c5b071142d915a9c96b386f1f956f222f220b 100644 (file)
--- a/src/test/cli/ceph-authtool/cap-overwrite.t
+++ b/src/test/cli/ceph-authtool/cap-overwrite.t
@@ -1,4 +1,4 @@
-  $ ceph-authtool kring --create-keyring --gen-key
+  $ ceph-authtool kring --create-keyring --gen-key --mode 0644
   creating kring
 
   $ ceph-authtool --cap osd 'allow rx pool=swimming' kring

diff --git a/src/test/cli/ceph-authtool/cap.t b/src/test/cli/ceph-authtool/cap.t
index 9681d2acfeb04453cd9d240f66c77c45f81ad4aa..732834cb14c29e94d1c00ea9765392598e104da9 100644 (file)
--- a/src/test/cli/ceph-authtool/cap.t
+++ b/src/test/cli/ceph-authtool/cap.t
@@ -1,4 +1,4 @@
-  $ ceph-authtool kring --create-keyring --gen-key
+  $ ceph-authtool kring --create-keyring --gen-key --mode 0644
   creating kring
 
   $ ceph-authtool --cap osd 'allow rx pool=swimming' kring

diff --git a/src/test/cli/ceph-authtool/create-gen-list-bin.t b/src/test/cli/ceph-authtool/create-gen-list-bin.t
index bfd2a4322dfc4cc2dae242437c3792d743515efb..1d4925af57c20e5c18113679fc659da05e85cd04 100644 (file)
--- a/src/test/cli/ceph-authtool/create-gen-list-bin.t
+++ b/src/test/cli/ceph-authtool/create-gen-list-bin.t
@@ -1,4 +1,4 @@
-  $ ceph-authtool kring --create-keyring
+  $ ceph-authtool kring --create-keyring --mode 0600
   creating kring
 
   $ ceph-authtool kring --list
@@ -14,4 +14,3 @@
   $ ceph-authtool kring -l
   [client.admin]
   \\tkey = [a-zA-Z0-9+/]+=* \(esc\) (re)
-

diff --git a/src/test/cli/ceph-authtool/create-gen-list.t b/src/test/cli/ceph-authtool/create-gen-list.t
index 00f4ed5e0f6e210cedc9ec1ec9792923b5b97be0..2801b0502753c36af5bac63be854d5d9b885194d 100644 (file)
--- a/src/test/cli/ceph-authtool/create-gen-list.t
+++ b/src/test/cli/ceph-authtool/create-gen-list.t
@@ -1,4 +1,4 @@
-  $ ceph-authtool kring --create-keyring
+  $ ceph-authtool kring --create-keyring --mode 0644
   creating kring
 
   $ ceph-authtool kring --list

diff --git a/src/test/cli/ceph-authtool/help.t b/src/test/cli/ceph-authtool/help.t
index 9a6c88357f7cd1088e306a33fb39e4d41befecf2..a7aa0abaedea3cc36049c4640cb99626d23b7aee 100644 (file)
--- a/src/test/cli/ceph-authtool/help.t
+++ b/src/test/cli/ceph-authtool/help.t
@@ -23,4 +23,6 @@
     --cap SUBSYSTEM CAPABILITY    will set the capability for given subsystem
     --caps CAPSFILE               will set all of capabilities associated with a
                                   given key, for all subsystems
+    --mode MODE                   will set the desired file mode to the keyring
+                                  e.g: '0644', defaults to '0600'
   [1]

diff --git a/src/test/cli/ceph-authtool/manpage.t b/src/test/cli/ceph-authtool/manpage.t
index f84b79457a14eecb9a82d3b9edd0b248b67d4d62..4a6eb11ea6c874f5ba2b49e370b138e90f61212a 100644 (file)
--- a/src/test/cli/ceph-authtool/manpage.t
+++ b/src/test/cli/ceph-authtool/manpage.t
@@ -22,6 +22,8 @@
     --cap SUBSYSTEM CAPABILITY    will set the capability for given subsystem
     --caps CAPSFILE               will set all of capabilities associated with a
                                   given key, for all subsystems
+    --mode MODE                   will set the desired file mode to the keyring
+                                  e.g: '0644', defaults to '0600'
   [1]
 
 # demonstrate that manpage examples fail without config

diff --git a/src/test/cli/ceph-authtool/simple.t b/src/test/cli/ceph-authtool/simple.t
index 35905ad07267dc8a1cb0346808c955332c5a1af0..47c612cf5d60d8cc4fa27a06563f0e7d52f30b7e 100644 (file)
--- a/src/test/cli/ceph-authtool/simple.t
+++ b/src/test/cli/ceph-authtool/simple.t
@@ -22,4 +22,6 @@
     --cap SUBSYSTEM CAPABILITY    will set the capability for given subsystem
     --caps CAPSFILE               will set all of capabilities associated with a
                                   given key, for all subsystems
+    --mode MODE                   will set the desired file mode to the keyring
+                                  e.g: '0644', defaults to '0600'
   [1]

diff --git a/src/tools/ceph_authtool.cc b/src/tools/ceph_authtool.cc
index 5fb8679f7e2b1b4cac5cccc76430adbc9a418ceb..e5cb9335570d95186b4a3ceac76ca00d573f8a0c 100644 (file)
--- a/src/tools/ceph_authtool.cc
+++ b/src/tools/ceph_authtool.cc
@@ -45,7 +45,9 @@ void usage()
        << "  -a BASE64, --add-key BASE64   will add an encoded key to the keyring\n"
        << "  --cap SUBSYSTEM CAPABILITY    will set the capability for given subsystem\n"
        << "  --caps CAPSFILE               will set all of capabilities associated with a\n"
-       << "                                given key, for all subsystems"
+       << "                                given key, for all subsystems\n"
+       << "  --mode MODE                   will set the desired file mode to the keyring\n"
+       << "                                e.g: '0644', defaults to '0600'"
        << std::endl;
   exit(1);
 }
@@ -73,6 +75,7 @@ int main(int argc, const char **argv)
   bool print_key = false;
   bool create_keyring = false;
   bool set_auid = false;
+  int mode = 0600; // keyring file mode
   std::vector<const char*>::iterator i;
 
   /* Handle options unique to ceph-authtool
@@ -115,6 +118,13 @@ int main(int argc, const char **argv)
        exit(1);
       }
       set_auid = true;
+    } else if (ceph_argparse_witharg(args, i, &val, "--mode", (char*)NULL)) {
+      std::string err;
+      mode = strict_strtoll(val.c_str(), 8, &err);
+      if (!err.empty()) {
+        cerr << "Option --mode requires an argument" << std::endl;
+        exit(1);
+      }
     } else if (fn.empty()) {
       fn = *i++;
     } else {
@@ -277,7 +287,7 @@ int main(int argc, const char **argv)
   if (modified) {
     bufferlist bl;
     keyring.encode_plaintext(bl);
-    r = bl.write_file(fn.c_str(), 0600);
+    r = bl.write_file(fn.c_str(), mode);
     if (r < 0) {
       cerr << "could not write " << fn << std::endl;
       exit(1);