From 3dbbb7e52c5e55fd5a2db0292c4e8cc3213463ed Mon Sep 17 00:00:00 2001 From: Ilya Dryomov Date: Sat, 27 May 2023 12:28:40 +0200 Subject: [PATCH] osd/OSDCap: allow rbd.metadata_list method under rbd-read-only profile This was missed in commit acc447d5de7b ("osd/OSDCap: rbd profile permits use of rbd.metadata_list cls method") which adjusted only "profile rbd" OSD cap. Listing image metadata is an essential part of opening the image and "profile rbd-read-only" OSD cap must allow it too. While at it, constrain the existing grant for rbd profile from "any object in the pool" to just "rbd_info object in the global namespace of the pool" as this is where pool-level image metadata actually lives. Fixes: https://tracker.ceph.com/issues/61382 Signed-off-by: Ilya Dryomov (cherry picked from commit b580cdad8d42b4e54fd9e4ef9def13d091f719e9) --- src/osd/OSDCap.cc | 6 +++++- src/test/osd/osdcap.cc | 43 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+), 1 deletion(-) diff --git a/src/osd/OSDCap.cc b/src/osd/OSDCap.cc index f847e80e337..1a5348ed651 100644 --- a/src/osd/OSDCap.cc +++ b/src/osd/OSDCap.cc @@ -339,7 +339,8 @@ void OSDCapGrant::expand_profile() OSDCapSpec(osd_rwxa_t(OSD_CAP_CLS_R))); profile_grants.emplace_back(OSDCapMatch(string(), "rbd_mirroring"), OSDCapSpec(osd_rwxa_t(OSD_CAP_CLS_R))); - profile_grants.emplace_back(OSDCapMatch(profile.pool_namespace.pool_name), + profile_grants.emplace_back(OSDCapMatch(profile.pool_namespace.pool_name, + "", "rbd_info"), OSDCapSpec("rbd", "metadata_list")); profile_grants.emplace_back(OSDCapMatch(profile.pool_namespace), OSDCapSpec(osd_rwxa_t(OSD_CAP_R | @@ -348,6 +349,9 @@ void OSDCapGrant::expand_profile() } if (profile.name == "rbd-read-only") { // RBD read-only grant + profile_grants.emplace_back(OSDCapMatch(profile.pool_namespace.pool_name, + "", "rbd_info"), + OSDCapSpec("rbd", "metadata_list")); profile_grants.emplace_back(OSDCapMatch(profile.pool_namespace), OSDCapSpec(osd_rwxa_t(OSD_CAP_R | OSD_CAP_CLS_R))); diff --git a/src/test/osd/osdcap.cc b/src/test/osd/osdcap.cc index f8e29aa3766..4d961a4267c 100644 --- a/src/test/osd/osdcap.cc +++ b/src/test/osd/osdcap.cc @@ -1338,6 +1338,49 @@ TEST(OSDCap, AllowProfile) { {{"rbd", "child_detach", true, true, true}}, addr)); ASSERT_FALSE(cap.is_capable("abc", "", {}, "rbd_header.ABC", false, false, {{"rbd", "other function", true, true, true}}, addr)); + + cap.grants.clear(); + ASSERT_TRUE(cap.parse("profile rbd pool pool1 namespace ns1", nullptr)); + ASSERT_TRUE(cap.is_capable("pool1", "", {}, "rbd_info", false, false, + {{"rbd", "metadata_list", true, false, true}}, + addr)); + ASSERT_TRUE(cap.is_capable("pool1", "ns1", {}, "rbd_info", false, false, + {{"rbd", "metadata_list", true, false, true}}, + addr)); + ASSERT_FALSE(cap.is_capable("pool1", "ns2", {}, "rbd_info", false, false, + {{"rbd", "metadata_list", true, false, true}}, + addr)); + ASSERT_FALSE(cap.is_capable("pool2", "", {}, "rbd_info", false, false, + {{"rbd", "metadata_list", true, false, true}}, + addr)); + ASSERT_FALSE(cap.is_capable("pool1", "", {}, "asdf", false, false, + {{"rbd", "metadata_list", true, false, true}}, + addr)); + ASSERT_FALSE(cap.is_capable("pool1", "", {}, "rbd_info", false, false, + {{"rbd", "other_method", true, false, true}}, + addr)); + + cap.grants.clear(); + ASSERT_TRUE(cap.parse("profile rbd-read-only pool pool1 namespace ns1", + nullptr)); + ASSERT_TRUE(cap.is_capable("pool1", "", {}, "rbd_info", false, false, + {{"rbd", "metadata_list", true, false, true}}, + addr)); + ASSERT_TRUE(cap.is_capable("pool1", "ns1", {}, "rbd_info", false, false, + {{"rbd", "metadata_list", true, false, true}}, + addr)); + ASSERT_FALSE(cap.is_capable("pool1", "ns2", {}, "rbd_info", false, false, + {{"rbd", "metadata_list", true, false, true}}, + addr)); + ASSERT_FALSE(cap.is_capable("pool2", "", {}, "rbd_info", false, false, + {{"rbd", "metadata_list", true, false, true}}, + addr)); + ASSERT_FALSE(cap.is_capable("pool1", "", {}, "asdf", false, false, + {{"rbd", "metadata_list", true, false, true}}, + addr)); + ASSERT_FALSE(cap.is_capable("pool1", "", {}, "rbd_info", false, false, + {{"rbd", "other_method", true, false, true}}, + addr)); } TEST(OSDCap, network) { -- 2.39.5