cephfs: disallow removing root_squash via "fs authorize" cmd

Removing root_squasn from MDS auth caps through "fs authorize" command
should not be allowed as this command it not allowed to/meant for
removing caps.

Fixes: https://tracker.ceph.com/issues/65808
Signed-off-by: Rishabh Dave <ridave@redhat.com>
(cherry picked from commit c6e2c97c6e9cbf1e37c53d5d490d65091205928c)

Conflict:

- qa/tasks/cephfs/test_admin.py
  Test test_idem_unaffected_root_squash (which was fixed by this commit)
  was disabled on the main branch since it was buggy. But that wasn't
  the case with squid branch.

diff --git a/src/mds/MDSAuthCaps.cc b/src/mds/MDSAuthCaps.cc
index 5e4bd995175c263c5ded004a2d2594b3592ebe49..0cde876143a8ba486e2bf69d7f28cc2d97cda1b2 100644 (file)
--- a/src/mds/MDSAuthCaps.cc
+++ b/src/mds/MDSAuthCaps.cc
@@ -410,7 +410,11 @@ bool MDSAuthCaps::merge_one_cap_grant(MDSCapGrant ng)
       // fsname and path match but value of root_squash is different. update
       // its value.
       if (g.match.root_squash != ng.match.root_squash) {
-       g.match.root_squash = ng.match.root_squash;
+       // "fs authorize" command is not allowed to deduct caps. so, we can add
+       // but not remove root_squash from MDS auth caps.
+       if (g.match.root_squash == false) {
+         g.match.root_squash = ng.match.root_squash;
+       }
       }
 
       // Since fsname and path matched and either perm/spec or root_squash