Implement a root_squash mode in MDS auth caps to deny operations for
clients with uid=0 or gid=0 that need write access. It's mainly to
prevent operations such as accidental `sudo rm -rf /path`.
The root squash mode can be enforced in one of the following ways in
the MDS caps,
'allow rw root_squash'
(across file systems)
or
'allow rw fsname=a root_squash'
(on a file system)
or
'allow rw fsname=a path=/vol/group/subvol00 root_squash'
(on a file system path)
Fixes: https://tracker.ceph.com/issues/42451
Signed-off-by: Ramana Raja <rraja@redhat.com>
This overrides what the CephContext believes to be the current quorum of
monitors (retrieved from other instances of the MonClient), introduced
by [1]. Tests need to be able to target a specific monitor for
exercising forwarding and other things.
[1] 731e2db9fb
Fixes: https://tracker.ceph.com/issues/47180
Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
Allow passing path along with fs names and capspec while creating an MDS
cap. The new syntax looks as follows -
allow rw fsname=<fsname> path=<path>
To provide caps for multiple file systems, pass the same phrase multiple
times separated by commas -
allow rw fsname=<fsname1> path=<path1>, allow rw fsname=<fsname2>
path=<path2>, ...
This commit also makes sure that the old syntax 'allow rw path=<path>'
is supported for backwards compatibility. The old syntax would imply
'allow rw fsname=* path=<path>' and would grant read-write permission for
all FSs containing the path <path>.
Signed-off-by: Rishabh Dave <ridave@redhat.com>
Add a 'fsname' clause to mon auth caps to restrict a client's view
of the FSMap. Example:
mon 'allow rw fsname=cephfs2'
This would restrict the client's view of the FSMap to the MDSMap for
cephfs2. Any MDS allocated to a different filesystem will be invisible.
Global standby daemons are always visible. To allow multiple CephFSs,
add multiple caps:
mon 'allow rw fsname=cephfs2, allow rw fsname=cephfs2'
Fixes: http://tracker.ceph.com/issues/15070
Signed-off-by: Douglas Fuller <dfuller@redhat.com>
Signed-off-by: Rishabh Dave <ridave@redhat.com>
Remove date-oriented trim/list functionality from MDLOG, DataLog, and
Sync-Error-Log.
Don't provide start/end markers. Support only a start marker for list
and an end marker for trim.
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
Allow only [A-Za-z0-9-_.] characters for FS, volume, subvolume and
subvolume group names and add test for the same.
Signed-off-by: Rishabh Dave <ridave@redhat.com>
the service offered by https://www.diskprophet.com is not accessible
anymore. before we have a replacement of it, let's drop
mgr-diskprediction-cloud. and remove its packaging.
Signed-off-by: Kefu Chai <kchai@redhat.com>
alpine build recipe is stale and does not work with the latest Ceph,
also the APKBUILD for Ceph can be found at alphine's aports repo, see
https://gitlab.alpinelinux.org/alpine/aports/-/tree/master/community/ceph.
so instead keeping a stale version, let's drop it.
Signed-off-by: Kefu Chai <kchai@redhat.com>
This change adds new scrubber.req_scrub to track user
requested scrubs, deep_scrub or repair.
Fixes: https://tracker.ceph.com/issues/46275
Signed-off-by: David Zafman <dzafman@redhat.com>
By setting this configuration option an OSD will compact it's
store's OMAP on start.
This way admin's can trigger an offline compaction by setting this
configuration value to 'true' and then restarting the OSD.
This is easier than using tools like 'ceph-kvstore-tool' with requires
more manual work on the CLI and might be more difficult for users.
Signed-off-by: Wido den Hollander <wido@42on.com>
Include test case
Configurable by setting mon_osd_warn_num_repaired (default 10)
Ignore new health warning with random eio injection test
Fixes: https://tracker.ceph.com/issues/41564
Signed-off-by: David Zafman <dzafman@redhat.com>
CVEs fixed before the first stable Pacific release need not be mentioned
explicitly in the release notes.
Signed-off-by: Nathan Cutler <ncutler@suse.com>
The RGW "default number of bucket index shards for new buckets was raised from
1 to 11" release note was added to PendingReleaseNotes by
1ec77ec7ba but it did not find its way into the
official v15.2.0 release notes until now.
Signed-off-by: Nathan Cutler <ncutler@suse.com>
The RGW BlockPublicAccess release note was added to PendingReleaseNotes
by df384ea95f but it did not find its way
into the official v15.2.0 release notes until now.
Signed-off-by: Nathan Cutler <ncutler@suse.com>
The RGW bucket granularity release note was added to PendingReleaseNotes
by 50f13fd54b but it never found its way
into the official v15.2.0 release notes.
Signed-off-by: Nathan Cutler <ncutler@suse.com>
The "enforce mds_join_fs cluster affinity" release note was
added to PendingReleaseNotes by 3fac3b1236
but it never made its way into the official v15.2.0 release notes.
Signed-off-by: Nathan Cutler <ncutler@suse.com>
The release note about osd_calc_pg_upmaps_max_stddev removal
was added to PendingReleaseNotes by
65d03bae8b but never found its
way into the official v15.2.0 release notes.
Signed-off-by: Nathan Cutler <ncutler@suse.com>
The release note about bucket notifications being encapsulated in a JSON
array was added to PendingReleaseNotes by
19832a0dae but it never found its way into
the actual v15.2.0 release notes.
Signed-off-by: Nathan Cutler <ncutler@suse.com>
The release note about OSDs self-classifying themselves as "nvme" in
certain rare cases was added to PendingReleaseNotes by
1d0fd5603e but it never found its way into
the official v15.2.0 release notes.
Signed-off-by: Nathan Cutler <ncutler@suse.com>
The release note about restoring the original behavior of the rados
tool's "-o" option was added to PendingReleaseNotes by
d2b806070d but it never found its way into
the official v15.2.0 release notes.
Signed-off-by: Nathan Cutler <ncutler@suse.com>
This note was added to PendingReleaseNotes by
0efa73f029 but never found its way into
the official v15.2.0 release notes.
Signed-off-by: Nathan Cutler <ncutler@suse.com>
Adds option `mon_allow_pool_size_one` which will be disabled by default
to ensure pools are not configured without replicas.
If the user still wants to use pool size 1, they will have to change the
value of `mon_allow_pool_size_one` to true and then have to pass flag
`--yes-i-really-mean-it` to cli command:
Example:
`ceph osd pool test set size 1 --yes-i-really-mean-it`
Fixes: https://tracker.ceph.com/issues/44025
Signed-off-by: Deepika Upadhyay <dupadhya@redhat.com>
use APIs instead of apis to be consistent throughout.
fixes: https://tracker.ceph.com/issues/44374
Signed-off-by: Deepika Upadhyay <dupadhya@redhat.com>
