From 8ef14fcca715a33be8c611a37628c90d7fafca43 Mon Sep 17 00:00:00 2001 From: Joao Eduardo Luis Date: Wed, 11 Feb 2015 23:36:01 +0000 Subject: [PATCH] mon: MonCap: take EntityName instead when expanding profiles entity_name_t is tightly coupled to the messenger, while EntityName is tied to auth. When expanding profiles we want to tie the profile expansion to the entity that was authenticated. Otherwise we may incur in weird behavior such as having caps validation failing because a given client messenger inst does not match the auth entity it used. e.g., running ceph --name osd.0 config-key exists foo daemon-private/osd.X/foo has entity_name_t 'client.12345' and EntityName 'osd.0'. Using entity_name_t during profile expansion would not allow the client access to daemon-private/osd.X/foo (client.12345 != osd.X). Fixes: #10844 Backport: firefly,giant Signed-off-by: Joao Eduardo Luis (cherry picked from commit 87544f68b88fb3dd17c519de3119a9ad9ab21dfb) --- src/mon/MonCap.cc | 6 +++--- src/mon/MonCap.h | 8 ++++---- src/mon/Monitor.cc | 2 +- src/mon/Session.h | 2 +- src/test/mon/moncap.cc | 5 +++-- 5 files changed, 12 insertions(+), 11 deletions(-) diff --git a/src/mon/MonCap.cc b/src/mon/MonCap.cc index e8d3f7e8bb3fb..78b21f47bead5 100644 --- a/src/mon/MonCap.cc +++ b/src/mon/MonCap.cc @@ -114,7 +114,7 @@ BOOST_FUSION_ADAPT_STRUCT(StringConstraint, // -void MonCapGrant::expand_profile(entity_name_t name) const +void MonCapGrant::expand_profile(EntityName name) const { // only generate this list once if (!profile_grants.empty()) @@ -177,7 +177,7 @@ void MonCapGrant::expand_profile(entity_name_t name) const } mon_rwxa_t MonCapGrant::get_allowed(CephContext *cct, - entity_name_t name, + EntityName name, const std::string& s, const std::string& c, const map& c_args) const { @@ -243,7 +243,7 @@ void MonCap::set_allow_all() } bool MonCap::is_capable(CephContext *cct, - entity_name_t name, + EntityName name, const string& service, const string& command, const map& command_args, bool op_may_read, bool op_may_write, bool op_may_exec) const diff --git a/src/mon/MonCap.h b/src/mon/MonCap.h index 3e4eda8ed2891..7dba641e703cb 100644 --- a/src/mon/MonCap.h +++ b/src/mon/MonCap.h @@ -8,7 +8,7 @@ using std::ostream; #include "include/types.h" -#include "msg/msg_types.h" +#include "common/entity_name.h" class CephContext; @@ -76,7 +76,7 @@ struct MonCapGrant { // needed by expand_profile() (via is_match()) and cached here. mutable list profile_grants; - void expand_profile(entity_name_t name) const; + void expand_profile(EntityName name) const; MonCapGrant() : allow(0) {} MonCapGrant(mon_rwxa_t a) : allow(a) {} @@ -97,7 +97,7 @@ struct MonCapGrant { * @return bits we allow */ mon_rwxa_t get_allowed(CephContext *cct, - entity_name_t name, + EntityName name, const std::string& service, const std::string& command, const map& command_args) const; @@ -143,7 +143,7 @@ struct MonCap { * @return true if the operation is allowed, false otherwise */ bool is_capable(CephContext *cct, - entity_name_t name, + EntityName name, const string& service, const string& command, const map& command_args, bool op_may_read, bool op_may_write, bool op_may_exec) const; diff --git a/src/mon/Monitor.cc b/src/mon/Monitor.cc index ee4bd039b1017..49e473ae466f1 100644 --- a/src/mon/Monitor.cc +++ b/src/mon/Monitor.cc @@ -2126,7 +2126,7 @@ bool Monitor::_allowed_command(MonSession *s, string &module, string &prefix, bool cmd_w = (this_cmd->req_perms.find('w') != string::npos); bool cmd_x = (this_cmd->req_perms.find('x') != string::npos); - bool capable = s->caps.is_capable(g_ceph_context, s->inst.name, + bool capable = s->caps.is_capable(g_ceph_context, s->entity_name, module, prefix, param_str_map, cmd_r, cmd_w, cmd_x); diff --git a/src/mon/Session.h b/src/mon/Session.h index 6aedac9e982dc..cd31af4b20d7b 100644 --- a/src/mon/Session.h +++ b/src/mon/Session.h @@ -76,7 +76,7 @@ struct MonSession : public RefCountedObject { bool is_capable(string service, int mask) { map args; return caps.is_capable(g_ceph_context, - inst.name, + entity_name, service, "", args, mask & MON_CAP_R, mask & MON_CAP_W, mask & MON_CAP_X); } diff --git a/src/test/mon/moncap.cc b/src/test/mon/moncap.cc index d381319fd9f49..f9a0b5c06e785 100644 --- a/src/test/mon/moncap.cc +++ b/src/test/mon/moncap.cc @@ -177,7 +177,7 @@ TEST(MonCap, AllowAll) { ASSERT_TRUE(cap.parse("allow *", NULL)); ASSERT_TRUE(cap.is_allow_all()); - ASSERT_TRUE(cap.is_capable(NULL, entity_name_t::CLIENT(0), + ASSERT_TRUE(cap.is_capable(NULL, EntityName(), "foo", "asdf", map(), true, true, true)); MonCap cap2; @@ -191,7 +191,8 @@ TEST(MonCap, ProfileOSD) { bool r = cap.parse("allow profile osd", NULL); ASSERT_TRUE(r); - entity_name_t name = entity_name_t::OSD(123); + EntityName name; + name.from_str("osd.123"); map ca; ASSERT_TRUE(cap.is_capable(NULL, name, "osd", "", ca, true, false, false)); -- 2.39.5