From bccc8ceb471c441ec04d7eb2c353630f8c5ce843 Mon Sep 17 00:00:00 2001 From: Patrick Donnelly Date: Wed, 1 May 2024 21:08:57 -0400 Subject: [PATCH] qa: test for root_squash with multiple caps Where the client has root_squash for one cap but not for another. The fs without root_squash should not necessarily reject the client. Signed-off-by: Patrick Donnelly --- qa/tasks/cephfs/test_admin.py | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/qa/tasks/cephfs/test_admin.py b/qa/tasks/cephfs/test_admin.py index f3d2e65bd6e2a..d80c1c72ace69 100644 --- a/qa/tasks/cephfs/test_admin.py +++ b/qa/tasks/cephfs/test_admin.py @@ -1478,6 +1478,40 @@ class TestFsAuthorize(CephFSTestCase): self.captester2.conduct_neg_test_for_chown_caps() self.captester2.conduct_neg_test_for_truncate_caps() + def test_multifs_rootsquash_nofeature(self): + """ + That having root_squash on one fs doesn't prevent access to others. + """ + + if not isinstance(self.mount_a, FuseMount): + self.skipTest("only FUSE client has CEPHFS_FEATURE_MDS_AUTH_CAPS " + "needed to enforce root_squash MDS caps") + + self.fs1 = self.fs + self.fs2 = self.mds_cluster.newfs('testcephfs2') + + self.mount_a.umount_wait() + + # Authorize client to fs1 + FS_AUTH_CAPS = (('/', 'rw'),) + self.fs1.authorize(self.client_id, FS_AUTH_CAPS) + + FS_AUTH_CAPS = (('/', 'rw', 'root_squash'),) + keyring = self.fs2.authorize(self.client_id, FS_AUTH_CAPS) + + CEPHFS_FEATURE_MDS_AUTH_CAPS_CHECK = 21 + # all but CEPHFS_FEATURE_MDS_AUTH_CAPS_CHECK + features = ",".join([str(i) for i in range(CEPHFS_FEATURE_MDS_AUTH_CAPS_CHECK)]) + mntargs = [f"--client_debug_inject_features={features}"] + + # should succeed + keyring_path = self.mount_a.client_remote.mktemp(data=keyring) + self.mount_a.remount(client_id=self.client_id, client_keyring_path=keyring_path, mntargs=mntargs, cephfs_name=self.fs1.name) + + captester = CapTester(self.mount_a, '/') + captester.conduct_pos_test_for_read_caps() + captester.conduct_pos_test_for_open_caps() + def test_single_path_rootsquash_issue_56067(self): """ That a FS client using root squash MDS caps allows non-root user to write data -- 2.39.5