From: Avan Thakkar <athakkar@redhat.com>
Date: Wed, 15 Jul 2026 11:11:11 +0000 (+0530)
Subject: mgr/cephadm: scope .smb pool read cap to its own namespace
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=d60e8b8054af136d3b022fc4c1f099504b5ae52f;p=ceph.git

mgr/cephadm: scope .smb pool read cap to its own namespace

Scope the .smb pool read cap to the same namespace already
used by the adjacent cluster-meta rwx cap.

Fixes: https://tracker.ceph.com/issues/78235
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
---

diff --git a/src/pybind/mgr/cephadm/services/smb.py b/src/pybind/mgr/cephadm/services/smb.py
index 15fba27bdda..d2f15c7624f 100644
--- a/src/pybind/mgr/cephadm/services/smb.py
+++ b/src/pybind/mgr/cephadm/services/smb.py
@@ -390,10 +390,12 @@ class SMBService(CephService):
         logger.debug(
             'found smb pool in uri [pool=%r, ns=%r]: %r', pool, ns, uri
         )
-        # enhanced caps for smb pools to be used for ctdb mgmt
+        # enhanced caps for smb pools to be used for ctdb mgmt.
+        # scoped to this cluster's own namespace given cluster id acts as
+        # a namespace so that a cluster's samba containers can't read
+        # other clusters' config/join/user objects sharing the same pool.
         return [
-            # TODO - restrict this read access to the namespace too?
-            f'allow r pool={pool}',
+            f'allow r pool={pool} namespace={ns}',
             # the x perm is needed to lock the cluster meta object
             f'allow rwx pool={pool} namespace={ns} object_prefix cluster.meta.',
         ]
diff --git a/src/pybind/mgr/cephadm/tests/services/test_smb.py b/src/pybind/mgr/cephadm/tests/services/test_smb.py
index f1135771864..c305d35ca13 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_smb.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_smb.py
@@ -237,3 +237,28 @@ def test_smb_get_dependencies(cephadm_module):
         'smb+field:features=domain',
         'smb+field:rgw_creds_uri=rados:mon-config-key:smb/config/foxtrot/config.smb.rgw',
     ]
+
+
+def test_pool_caps_from_uri(cephadm_module):
+    from cephadm.services.smb import SMBService
+
+    smb_service = SMBService(cephadm_module)
+
+    # objects living in the shared .smb pool must be scoped to the
+    # cluster's own namespace.
+    assert smb_service._pool_caps_from_uri(
+        'rados://.smb/foxtrot/config.json'
+    ) == [
+        'allow r pool=.smb namespace=foxtrot',
+        'allow rwx pool=.smb namespace=foxtrot object_prefix cluster.meta.',
+    ]
+
+    # the empty-namespace uri shape that RADOSConfigEntry.uri can produce
+    # (rados://<pool>//<key>) must still scope the read cap consistently
+    # with the existing rwx cap.
+    assert smb_service._pool_caps_from_uri(
+        'rados://.smb//config.smb'
+    ) == [
+        'allow r pool=.smb namespace=',
+        'allow rwx pool=.smb namespace= object_prefix cluster.meta.',
+    ]