From: Rishabh Dave <ridave@redhat.com>
Date: Thu, 11 Jul 2024 18:28:22 +0000 (+0530)
Subject: cephfs: disallow removing root_squash via "fs authorize" cmd
X-Git-Tag: testing/wip-vshankar-testing-20241106.074359-squid-debug~125^2
X-Git-Url: http://git.apps.os.sepia.ceph.com/?a=commitdiff_plain;h=a8198ace710f7ce0af6219df2674b226f87f4f87;p=ceph-ci.git

cephfs: disallow removing root_squash via "fs authorize" cmd

Removing root_squasn from MDS auth caps through "fs authorize" command
should not be allowed as this command it not allowed to/meant for
removing caps.

Fixes: https://tracker.ceph.com/issues/65808
Signed-off-by: Rishabh Dave <ridave@redhat.com>
(cherry picked from commit c6e2c97c6e9cbf1e37c53d5d490d65091205928c)

Conflict:

- qa/tasks/cephfs/test_admin.py
  Test test_idem_unaffected_root_squash (which was fixed by this commit)
  was disabled on the main branch since it was buggy. But that wasn't
  the case with squid branch.
---

diff --git a/src/mds/MDSAuthCaps.cc b/src/mds/MDSAuthCaps.cc
index 5e4bd995175..0cde876143a 100644
--- a/src/mds/MDSAuthCaps.cc
+++ b/src/mds/MDSAuthCaps.cc
@@ -410,7 +410,11 @@ bool MDSAuthCaps::merge_one_cap_grant(MDSCapGrant ng)
       // fsname and path match but value of root_squash is different. update
       // its value.
       if (g.match.root_squash != ng.match.root_squash) {
-	g.match.root_squash = ng.match.root_squash;
+	// "fs authorize" command is not allowed to deduct caps. so, we can add
+	// but not remove root_squash from MDS auth caps.
+	if (g.match.root_squash == false) {
+	  g.match.root_squash = ng.match.root_squash;
+	}
       }
 
       // Since fsname and path matched and either perm/spec or root_squash