From: Zhi Zhang Date: Fri, 10 Jan 2020 02:48:03 +0000 (+0800) Subject: client: disallow changing fuse_default_permissions option at runtime X-Git-Tag: v14.2.8~59^2 X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=0213b7e7a142c6b3d4ee8db3d551bcdd41b94bb8;p=ceph.git client: disallow changing fuse_default_permissions option at runtime If fuse_default_permissions is false when initializing fuse, then ceph-fuse will use its own permission check. If changig this option to true at runtime, there will be no permission check at both fuse side and ceph-fuse side. Fixes: https://tracker.ceph.com/issues/43362 Signed-off-by: Zhi Zhang (cherry picked from commit dea4ffefd2646199b383fcb18c944e6c217d3f11) --- diff --git a/src/client/Client.cc b/src/client/Client.cc index 8a89d086ed0..b6118b638e3 100644 --- a/src/client/Client.cc +++ b/src/client/Client.cc @@ -278,6 +278,8 @@ Client::Client(Messenger *m, MonClient *mc, Objecter *objecter_) user_id = cct->_conf->client_mount_uid; group_id = cct->_conf->client_mount_gid; + fuse_default_permissions = cct->_conf.get_val( + "fuse_default_permissions"); if (cct->_conf->client_acl_type == "posix_acl") acl_type = POSIX_ACL; @@ -10654,8 +10656,6 @@ int Client::ll_lookup(Inode *parent, const char *name, struct stat *attr, return -ENOTCONN; int r = 0; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { if (strcmp(name, ".") && strcmp(name, "..")) { r = may_lookup(parent, perms); @@ -10751,8 +10751,6 @@ int Client::ll_lookupx(Inode *parent, const char *name, Inode **out, return -ENOTCONN; int r = 0; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { r = may_lookup(parent, perms); if (r < 0) @@ -11023,8 +11021,6 @@ int Client::_ll_setattrx(Inode *in, struct ceph_statx *stx, int mask, tout(cct) << stx->stx_btime << std::endl; tout(cct) << mask << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int res = may_setattr(in, stx, mask, perms); if (res < 0) @@ -11350,8 +11346,6 @@ int Client::ll_getxattr(Inode *in, const char *name, void *value, tout(cct) << vino.ino.val << std::endl; tout(cct) << name << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = xattr_permission(in, name, MAY_READ, perms); if (r < 0) @@ -11629,8 +11623,6 @@ int Client::ll_setxattr(Inode *in, const char *name, const void *value, tout(cct) << vino.ino.val << std::endl; tout(cct) << name << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = xattr_permission(in, name, MAY_WRITE, perms); if (r < 0) @@ -11695,8 +11687,6 @@ int Client::ll_removexattr(Inode *in, const char *name, const UserPerm& perms) tout(cct) << vino.ino.val << std::endl; tout(cct) << name << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = xattr_permission(in, name, MAY_WRITE, perms); if (r < 0) @@ -12067,8 +12057,6 @@ int Client::ll_mknod(Inode *parent, const char *name, mode_t mode, tout(cct) << mode << std::endl; tout(cct) << rdev << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_create(parent, perms); if (r < 0) @@ -12108,8 +12096,6 @@ int Client::ll_mknodx(Inode *parent, const char *name, mode_t mode, tout(cct) << mode << std::endl; tout(cct) << rdev << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_create(parent, perms); if (r < 0) @@ -12297,8 +12283,6 @@ int Client::ll_mkdir(Inode *parent, const char *name, mode_t mode, tout(cct) << name << std::endl; tout(cct) << mode << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_create(parent, perm); if (r < 0) @@ -12335,8 +12319,6 @@ int Client::ll_mkdirx(Inode *parent, const char *name, mode_t mode, Inode **out, tout(cct) << name << std::endl; tout(cct) << mode << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_create(parent, perms); if (r < 0) @@ -12422,8 +12404,6 @@ int Client::ll_symlink(Inode *parent, const char *name, const char *value, tout(cct) << name << std::endl; tout(cct) << value << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_create(parent, perms); if (r < 0) @@ -12461,8 +12441,6 @@ int Client::ll_symlinkx(Inode *parent, const char *name, const char *value, tout(cct) << name << std::endl; tout(cct) << value << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_create(parent, perms); if (r < 0) @@ -12546,8 +12524,6 @@ int Client::ll_unlink(Inode *in, const char *name, const UserPerm& perm) tout(cct) << vino.ino.val << std::endl; tout(cct) << name << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_delete(in, name, perm); if (r < 0) @@ -12623,8 +12599,6 @@ int Client::ll_rmdir(Inode *in, const char *name, const UserPerm& perms) tout(cct) << vino.ino.val << std::endl; tout(cct) << name << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_delete(in, name, perms); if (r < 0) @@ -12760,8 +12734,6 @@ int Client::ll_rename(Inode *parent, const char *name, Inode *newparent, tout(cct) << vnewparent.ino.val << std::endl; tout(cct) << newname << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_delete(parent, name, perm); if (r < 0) @@ -12839,8 +12811,6 @@ int Client::ll_link(Inode *in, Inode *newparent, const char *newname, InodeRef target; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { if (S_ISDIR(in->mode)) return -EPERM; @@ -12970,8 +12940,6 @@ int Client::ll_opendir(Inode *in, int flags, dir_result_t** dirpp, tout(cct) << "ll_opendir" << std::endl; tout(cct) << vino.ino.val << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_open(in, flags, perms); if (r < 0) @@ -13030,8 +12998,6 @@ int Client::ll_open(Inode *in, int flags, Fh **fhp, const UserPerm& perms) tout(cct) << ceph_flags_sys2wire(flags) << std::endl; int r; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { r = may_open(in, flags, perms); if (r < 0) @@ -13075,8 +13041,6 @@ int Client::_ll_create(Inode *parent, const char *name, mode_t mode, return -EEXIST; if (r == -ENOENT && (flags & O_CREAT)) { - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { r = may_create(parent, perms); if (r < 0) @@ -13095,8 +13059,6 @@ int Client::_ll_create(Inode *parent, const char *name, mode_t mode, ldout(cct, 20) << "_ll_create created = " << created << dendl; if (!created) { - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { r = may_open(in->get(), flags, perms); if (r < 0) { diff --git a/src/client/Client.h b/src/client/Client.h index 5c7e0238bb6..c2218a250cc 100644 --- a/src/client/Client.h +++ b/src/client/Client.h @@ -755,6 +755,7 @@ public: std::unique_ptr logger; std::unique_ptr mdsmap; + bool fuse_default_permissions; protected: /* Flags for check_caps() */ diff --git a/src/client/fuse_ll.cc b/src/client/fuse_ll.cc index 63b993bebc7..60ea1904a4d 100644 --- a/src/client/fuse_ll.cc +++ b/src/client/fuse_ll.cc @@ -956,9 +956,7 @@ static void do_init(void *data, fuse_conn_info *conn) Client *client = cfuse->client; #if !defined(__APPLE__) - auto fuse_default_permissions = client->cct->_conf.get_val( - "fuse_default_permissions"); - if (!fuse_default_permissions && client->ll_handle_umask()) { + if (!client->fuse_default_permissions && client->ll_handle_umask()) { // apply umask in userspace if posix acl is enabled if(conn->capable & FUSE_CAP_DONT_MASK) conn->want |= FUSE_CAP_DONT_MASK; diff --git a/src/common/options.cc b/src/common/options.cc index 2bee6e90fd6..b0215229e00 100644 --- a/src/common/options.cc +++ b/src/common/options.cc @@ -8303,7 +8303,8 @@ std::vector