From 61c06200fe59996bba2bb65fc402207bc10fd459 Mon Sep 17 00:00:00 2001 From: Jason Dillaman Date: Wed, 20 Jun 2018 21:30:47 -0400 Subject: [PATCH] mon/OSDMonitor: enforce caps for all remaining pool ops Signed-off-by: Jason Dillaman --- src/mon/OSDMonitor.cc | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) diff --git a/src/mon/OSDMonitor.cc b/src/mon/OSDMonitor.cc index c3a68763331..be4ee37fb1c 100644 --- a/src/mon/OSDMonitor.cc +++ b/src/mon/OSDMonitor.cc @@ -11812,6 +11812,13 @@ bool OSDMonitor::enforce_pool_op_caps(MonOpRequestRef op) } break; default: + if (!session->is_capable("osd", MON_CAP_W)) { + dout(0) << "got pool op from entity with insufficient privileges. " + << "message: " << *m << std::endl + << "caps: " << session->caps << dendl; + _pool_op_reply(op, -EPERM, osdmap.get_epoch()); + return true; + } break; } @@ -11910,19 +11917,6 @@ bool OSDMonitor::preprocess_pool_op_create(MonOpRequestRef op) { op->mark_osdmon_event(__func__); MPoolOp *m = static_cast(op->get_req()); - MonSession *session = m->get_session(); - if (!session) { - _pool_op_reply(op, -EPERM, osdmap.get_epoch()); - return true; - } - if (!session->is_capable("osd", MON_CAP_W)) { - dout(5) << "attempt to create new pool without sufficient auid privileges!" - << "message: " << *m << std::endl - << "caps: " << session->caps << dendl; - _pool_op_reply(op, -EPERM, osdmap.get_epoch()); - return true; - } - int64_t pool = osdmap.lookup_pg_pool_name(m->name.c_str()); if (pool >= 0) { _pool_op_reply(op, 0, osdmap.get_epoch()); -- 2.47.3