RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2024-12-17 17:05:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

global: implement setuser_match_path

Browse Source 
Allow the --setuser and --setgroup to be conditional on the
specified user/group matching the ownership of a given path.
This allows the ceph daemons to switch to user ceph for newly
deployed instances or stay as root depending on the ownership of
the data directory.

Signed-off-by: Sage Weil <sage@redhat.com>
Reviewed-by: Boris Ranto <branto@redhat.com>
This commit is contained in:
Sage Weil 2015-08-06 11:57:48 -04:00
parent 09db67fdb5
commit 28fdac32e7
2 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/common/config_opts.h
View File

@ -31,6 +31,7 @@ OPTION(crushtool, OPT_STR, "crushtool") // crushtool utility path
OPTION(daemonize, OPT_BOOL, false) // default changed by common_preinit()
OPTION(setuser, OPT_STR, "") // uid or user name
OPTION(setgroup, OPT_STR, "") // gid or group name
OPTION(setuser_match_path, OPT_STR, "") // make setuser/group conditional on this patch matching ownership
OPTION(pid_file, OPT_STR, "") // default changed by common_preinit()
OPTION(chdir, OPT_STR, "/")
OPTION(max_open_files, OPT_LONGLONG, 0)

26
src/global/global_init.cc
View File

@ -169,6 +169,32 @@ void global_init(std::vector < const char * > *alt_def_args,
gid = g->gr_gid;
}
}
if ((uid || gid) &&
g_conf->setuser_match_path.length()) {
struct stat st;
int r = ::stat(g_conf->setuser_match_path.c_str(), &st);
if (r < 0) {
r = -errno;
cerr << "unable to stat setuser_match_path "
<< g_conf->setuser_match_path
<< ": " << cpp_strerror(r) << std::endl;
exit(1);
}
if ((uid && uid != st.st_uid) ||
(gid && gid != st.st_gid)) {
cerr << "WARNING: will not setuid/gid: " << g_conf->setuser_match_path
<< " owned by " << st.st_uid << ":" << st.st_gid
<< " and not requested " << uid << ":" << gid
<< std::endl;
uid = 0;
gid = 0;
} else {
dout(10) << "setuser_match_path "
<< g_conf->setuser_match_path << " owned by "
<< st.st_uid << ":" << st.st_gid << ", doing setuid/gid"
<< dendl;
}
}
if (setgid(gid) != 0) {
int r = errno;
cerr << "unable to setgid " << gid << ": " << cpp_strerror(r)