entity_name_t is tightly coupled to the messenger, while EntityName is
tied to auth. When expanding profiles we want to tie the profile
expansion to the entity that was authenticated. Otherwise we may incur
in weird behavior such as having caps validation failing because a given
client messenger inst does not match the auth entity it used.
e.g., running
ceph --name osd.0 config-key exists foo daemon-private/osd.X/foo
has entity_name_t 'client.12345' and EntityName 'osd.0'. Using
entity_name_t during profile expansion would not allow the client access
to daemon-private/osd.X/foo (client.12345 != osd.X).
Fixes: #10844
Backport: firefly,giant
Signed-off-by: Joao Eduardo Luis <joao@redhat.com>
(cherry picked from commit
87544f68b88fb3dd17c519de3119a9ad9ab21dfb)
// </magic>
-void MonCapGrant::expand_profile(entity_name_t name) const
+void MonCapGrant::expand_profile(EntityName name) const
{
// only generate this list once
if (!profile_grants.empty())
}
mon_rwxa_t MonCapGrant::get_allowed(CephContext *cct,
- entity_name_t name,
+ EntityName name,
const std::string& s, const std::string& c,
const map<string,string>& c_args) const
{
}
bool MonCap::is_capable(CephContext *cct,
- entity_name_t name,
+ EntityName name,
const string& service,
const string& command, const map<string,string>& command_args,
bool op_may_read, bool op_may_write, bool op_may_exec) const
using std::ostream;
#include "include/types.h"
-#include "msg/msg_types.h"
+#include "common/entity_name.h"
class CephContext;
// needed by expand_profile() (via is_match()) and cached here.
mutable list<MonCapGrant> profile_grants;
- void expand_profile(entity_name_t name) const;
+ void expand_profile(EntityName name) const;
MonCapGrant() : allow(0) {}
MonCapGrant(mon_rwxa_t a) : allow(a) {}
* @return bits we allow
*/
mon_rwxa_t get_allowed(CephContext *cct,
- entity_name_t name,
+ EntityName name,
const std::string& service,
const std::string& command,
const map<string,string>& command_args) const;
* @return true if the operation is allowed, false otherwise
*/
bool is_capable(CephContext *cct,
- entity_name_t name,
+ EntityName name,
const string& service,
const string& command, const map<string,string>& command_args,
bool op_may_read, bool op_may_write, bool op_may_exec) const;
bool cmd_w = (this_cmd->req_perms.find('w') != string::npos);
bool cmd_x = (this_cmd->req_perms.find('x') != string::npos);
- bool capable = s->caps.is_capable(g_ceph_context, s->inst.name,
+ bool capable = s->caps.is_capable(g_ceph_context, s->entity_name,
module, prefix, param_str_map,
cmd_r, cmd_w, cmd_x);
bool is_capable(string service, int mask) {
map<string,string> args;
return caps.is_capable(g_ceph_context,
- inst.name,
+ entity_name,
service, "", args,
mask & MON_CAP_R, mask & MON_CAP_W, mask & MON_CAP_X);
}
ASSERT_TRUE(cap.parse("allow *", NULL));
ASSERT_TRUE(cap.is_allow_all());
- ASSERT_TRUE(cap.is_capable(NULL, entity_name_t::CLIENT(0),
+ ASSERT_TRUE(cap.is_capable(NULL, EntityName(),
"foo", "asdf", map<string,string>(), true, true, true));
MonCap cap2;
bool r = cap.parse("allow profile osd", NULL);
ASSERT_TRUE(r);
- entity_name_t name = entity_name_t::OSD(123);
+ EntityName name;
+ name.from_str("osd.123");
map<string,string> ca;
ASSERT_TRUE(cap.is_capable(NULL, name, "osd", "", ca, true, false, false));