From dea4ffefd2646199b383fcb18c944e6c217d3f11 Mon Sep 17 00:00:00 2001 From: Zhi Zhang Date: Fri, 10 Jan 2020 10:48:03 +0800 Subject: [PATCH] client: disallow changing fuse_default_permissions option at runtime If fuse_default_permissions is false when initializing fuse, then ceph-fuse will use its own permission check. If changig this option to true at runtime, there will be no permission check at both fuse side and ceph-fuse side. Fixes: https://tracker.ceph.com/issues/43362 Signed-off-by: Zhi Zhang --- src/client/Client.cc | 42 ++---------------------------------------- src/client/Client.h | 1 + src/client/fuse_ll.cc | 4 +--- src/common/options.cc | 3 ++- 4 files changed, 6 insertions(+), 44 deletions(-) diff --git a/src/client/Client.cc b/src/client/Client.cc index bbc67f9d62647..d5b41f00d52e6 100644 --- a/src/client/Client.cc +++ b/src/client/Client.cc @@ -278,6 +278,8 @@ Client::Client(Messenger *m, MonClient *mc, Objecter *objecter_) user_id = cct->_conf->client_mount_uid; group_id = cct->_conf->client_mount_gid; + fuse_default_permissions = cct->_conf.get_val( + "fuse_default_permissions"); if (cct->_conf->client_acl_type == "posix_acl") acl_type = POSIX_ACL; @@ -10670,8 +10672,6 @@ int Client::ll_lookup(Inode *parent, const char *name, struct stat *attr, return -ENOTCONN; int r = 0; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { if (strcmp(name, ".") && strcmp(name, "..")) { r = may_lookup(parent, perms); @@ -10767,8 +10767,6 @@ int Client::ll_lookupx(Inode *parent, const char *name, Inode **out, return -ENOTCONN; int r = 0; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { r = may_lookup(parent, perms); if (r < 0) @@ -11039,8 +11037,6 @@ int Client::_ll_setattrx(Inode *in, struct ceph_statx *stx, int mask, tout(cct) << stx->stx_btime << std::endl; tout(cct) << mask << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int res = may_setattr(in, stx, mask, perms); if (res < 0) @@ -11366,8 +11362,6 @@ int Client::ll_getxattr(Inode *in, const char *name, void *value, tout(cct) << vino.ino.val << std::endl; tout(cct) << name << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = xattr_permission(in, name, MAY_READ, perms); if (r < 0) @@ -11622,8 +11616,6 @@ int Client::ll_setxattr(Inode *in, const char *name, const void *value, tout(cct) << vino.ino.val << std::endl; tout(cct) << name << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = xattr_permission(in, name, MAY_WRITE, perms); if (r < 0) @@ -11688,8 +11680,6 @@ int Client::ll_removexattr(Inode *in, const char *name, const UserPerm& perms) tout(cct) << vino.ino.val << std::endl; tout(cct) << name << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = xattr_permission(in, name, MAY_WRITE, perms); if (r < 0) @@ -12050,8 +12040,6 @@ int Client::ll_mknod(Inode *parent, const char *name, mode_t mode, tout(cct) << mode << std::endl; tout(cct) << rdev << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_create(parent, perms); if (r < 0) @@ -12091,8 +12079,6 @@ int Client::ll_mknodx(Inode *parent, const char *name, mode_t mode, tout(cct) << mode << std::endl; tout(cct) << rdev << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_create(parent, perms); if (r < 0) @@ -12280,8 +12266,6 @@ int Client::ll_mkdir(Inode *parent, const char *name, mode_t mode, tout(cct) << name << std::endl; tout(cct) << mode << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_create(parent, perm); if (r < 0) @@ -12318,8 +12302,6 @@ int Client::ll_mkdirx(Inode *parent, const char *name, mode_t mode, Inode **out, tout(cct) << name << std::endl; tout(cct) << mode << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_create(parent, perms); if (r < 0) @@ -12405,8 +12387,6 @@ int Client::ll_symlink(Inode *parent, const char *name, const char *value, tout(cct) << name << std::endl; tout(cct) << value << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_create(parent, perms); if (r < 0) @@ -12444,8 +12424,6 @@ int Client::ll_symlinkx(Inode *parent, const char *name, const char *value, tout(cct) << name << std::endl; tout(cct) << value << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_create(parent, perms); if (r < 0) @@ -12529,8 +12507,6 @@ int Client::ll_unlink(Inode *in, const char *name, const UserPerm& perm) tout(cct) << vino.ino.val << std::endl; tout(cct) << name << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_delete(in, name, perm); if (r < 0) @@ -12606,8 +12582,6 @@ int Client::ll_rmdir(Inode *in, const char *name, const UserPerm& perms) tout(cct) << vino.ino.val << std::endl; tout(cct) << name << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_delete(in, name, perms); if (r < 0) @@ -12792,8 +12766,6 @@ int Client::ll_rename(Inode *parent, const char *name, Inode *newparent, tout(cct) << vnewparent.ino.val << std::endl; tout(cct) << newname << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_delete(parent, name, perm); if (r < 0) @@ -12871,8 +12843,6 @@ int Client::ll_link(Inode *in, Inode *newparent, const char *newname, InodeRef target; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { if (S_ISDIR(in->mode)) return -EPERM; @@ -13002,8 +12972,6 @@ int Client::ll_opendir(Inode *in, int flags, dir_result_t** dirpp, tout(cct) << "ll_opendir" << std::endl; tout(cct) << vino.ino.val << std::endl; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { int r = may_open(in, flags, perms); if (r < 0) @@ -13062,8 +13030,6 @@ int Client::ll_open(Inode *in, int flags, Fh **fhp, const UserPerm& perms) tout(cct) << ceph_flags_sys2wire(flags) << std::endl; int r; - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { r = may_open(in, flags, perms); if (r < 0) @@ -13107,8 +13073,6 @@ int Client::_ll_create(Inode *parent, const char *name, mode_t mode, return -EEXIST; if (r == -ENOENT && (flags & O_CREAT)) { - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { r = may_create(parent, perms); if (r < 0) @@ -13127,8 +13091,6 @@ int Client::_ll_create(Inode *parent, const char *name, mode_t mode, ldout(cct, 20) << "_ll_create created = " << created << dendl; if (!created) { - auto fuse_default_permissions = cct->_conf.get_val( - "fuse_default_permissions"); if (!fuse_default_permissions) { r = may_open(in->get(), flags, perms); if (r < 0) { diff --git a/src/client/Client.h b/src/client/Client.h index a88abb5d86e84..b84f6e8d51e6a 100644 --- a/src/client/Client.h +++ b/src/client/Client.h @@ -757,6 +757,7 @@ public: std::unique_ptr logger; std::unique_ptr mdsmap; + bool fuse_default_permissions; protected: /* Flags for check_caps() */ diff --git a/src/client/fuse_ll.cc b/src/client/fuse_ll.cc index 547ce8611b5f5..e21f27930e115 100644 --- a/src/client/fuse_ll.cc +++ b/src/client/fuse_ll.cc @@ -956,9 +956,7 @@ static void do_init(void *data, fuse_conn_info *conn) Client *client = cfuse->client; #if !defined(__APPLE__) - auto fuse_default_permissions = client->cct->_conf.get_val( - "fuse_default_permissions"); - if (!fuse_default_permissions && client->ll_handle_umask()) { + if (!client->fuse_default_permissions && client->ll_handle_umask()) { // apply umask in userspace if posix acl is enabled if(conn->capable & FUSE_CAP_DONT_MASK) conn->want |= FUSE_CAP_DONT_MASK; diff --git a/src/common/options.cc b/src/common/options.cc index c87ad5888fc6f..5682b35571aab 100644 --- a/src/common/options.cc +++ b/src/common/options.cc @@ -8260,7 +8260,8 @@ std::vector