| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <8b22fc1e-595a-b729-dd21-2714f22a28a7@redhat.com>
Date: Thu, 8 Jun 2023 11:00:59 +0800
From: Xiubo Li <xiubli@...hat.com>
To: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@...onical.com>
Cc: brauner@...nel.org, stgraber@...ntu.com,
linux-fsdevel@...r.kernel.org, Ilya Dryomov <idryomov@...il.com>,
Jeff Layton <jlayton@...nel.org>, ceph-devel@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4 00/14] ceph: support idmapped mounts
Hi Alexander,
As I mentioned in V2 thread
https://www.spinics.net/lists/kernel/msg4810994.html, we should use the
'idmap' for all the requests below, because MDS will do the
'check_access()' for all the requests by using the caller uid/gid,
please see
https://github.com/ceph/ceph/blob/main/src/mds/Server.cc#L3294-L3310.
Cscope tag: ceph_mdsc_do_request
# line filename / context / line
1 321 fs/ceph/addr.c <<ceph_netfs_issue_op_inline>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
2 443 fs/ceph/dir.c <<ceph_readdir>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
3 838 fs/ceph/dir.c <<ceph_lookup>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
4 933 fs/ceph/dir.c <<ceph_mknod>>
err = ceph_mdsc_do_request(mdsc, dir, req);
5 1045 fs/ceph/dir.c <<ceph_symlink>>
err = ceph_mdsc_do_request(mdsc, dir, req);
6 1120 fs/ceph/dir.c <<ceph_mkdir>>
err = ceph_mdsc_do_request(mdsc, dir, req);
7 1180 fs/ceph/dir.c <<ceph_link>>
err = ceph_mdsc_do_request(mdsc, dir, req);
8 1365 fs/ceph/dir.c <<ceph_unlink>>
err = ceph_mdsc_do_request(mdsc, dir, req);
9 1431 fs/ceph/dir.c <<ceph_rename>>
err = ceph_mdsc_do_request(mdsc, old_dir, req);
10 1927 fs/ceph/dir.c <<ceph_d_revalidate>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
11 154 fs/ceph/export.c <<__lookup_inode>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
12 262 fs/ceph/export.c <<__snapfh_to_dentry>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
13 347 fs/ceph/export.c <<__get_parent>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
14 490 fs/ceph/export.c <<__get_snap_name>>
err = ceph_mdsc_do_request(fsc->mdsc, NULL, req);
15 561 fs/ceph/export.c <<ceph_get_name>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
16 339 fs/ceph/file.c <<ceph_renew_caps>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
17 434 fs/ceph/file.c <<ceph_open>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
18 855 fs/ceph/file.c <<ceph_atomic_open>>
err = ceph_mdsc_do_request(mdsc, (flags & O_CREAT) ? dir :
NULL, req);
19 2715 fs/ceph/inode.c <<__ceph_setattr>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
20 2839 fs/ceph/inode.c <<__ceph_do_getattr>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
21 2883 fs/ceph/inode.c <<ceph_do_getvxattr>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
22 126 fs/ceph/ioctl.c <<ceph_ioctl_set_layout>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
23 171 fs/ceph/ioctl.c <<ceph_ioctl_set_layout_policy>>
err = ceph_mdsc_do_request(mdsc, inode, req);
24 216 fs/ceph/locks.c <<ceph_lock_wait_for_completion>>
err = ceph_mdsc_do_request(mdsc, inode, intr_req);
25 1091 fs/ceph/super.c <<open_root_dentry>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
26 1151 fs/ceph/xattr.c <<ceph_sync_setxattr>>
err = ceph_mdsc_do_request(mdsc, NULL, req);
And also could you squash the similar commit into one ?
Thanks
- Xiubo
On 6/8/23 02:09, Alexander Mikhalitsyn wrote:
> Dear friends,
>
> This patchset was originally developed by Christian Brauner but I'll continue
> to push it forward. Christian allowed me to do that :)
>
> This feature is already actively used/tested with LXD/LXC project.
>
> Git tree (based on https://github.com/ceph/ceph-client.git master):
> https://github.com/mihalicyn/linux/tree/fs.idmapped.ceph
>
> In the version 3 I've changed only two commits:
> - fs: export mnt_idmap_get/mnt_idmap_put
> - ceph: allow idmapped setattr inode op
> and added a new one:
> - ceph: pass idmap to __ceph_setattr
>
> In the version 4 I've reworked the ("ceph: stash idmapping in mdsc request")
> commit. Now we take idmap refcounter just in place where req->r_mnt_idmap
> is filled. It's more safer approach and prevents possible refcounter underflow
> on error paths where __register_request wasn't called but ceph_mdsc_release_request is
> called.
>
> I can confirm that this version passes xfstests.
>
> Links to previous versions:
> v1: https://lore.kernel.org/all/20220104140414.155198-1-brauner@kernel.org/
> v2: https://lore.kernel.org/lkml/20230524153316.476973-1-aleksandr.mikhalitsyn@canonical.com/
> v3: https://lore.kernel.org/lkml/20230607152038.469739-1-aleksandr.mikhalitsyn@canonical.com/#t
>
> Kind regards,
> Alex
>
> Original description from Christian:
> ========================================================================
> This patch series enables cephfs to support idmapped mounts, i.e. the
> ability to alter ownership information on a per-mount basis.
>
> Container managers such as LXD support sharaing data via cephfs between
> the host and unprivileged containers and between unprivileged containers.
> They may all use different idmappings. Idmapped mounts can be used to
> create mounts with the idmapping used for the container (or a different
> one specific to the use-case).
>
> There are in fact more use-cases such as remapping ownership for
> mountpoints on the host itself to grant or restrict access to different
> users or to make it possible to enforce that programs running as root
> will write with a non-zero {g,u}id to disk.
>
> The patch series is simple overall and few changes are needed to cephfs.
> There is one cephfs specific issue that I would like to discuss and
> solve which I explain in detail in:
>
> [PATCH 02/12] ceph: handle idmapped mounts in create_request_message()
>
> It has to do with how to handle mds serves which have id-based access
> restrictions configured. I would ask you to please take a look at the
> explanation in the aforementioned patch.
>
> The patch series passes the vfs and idmapped mount testsuite as part of
> xfstests. To run it you will need a config like:
>
> [ceph]
> export FSTYP=ceph
> export TEST_DIR=/mnt/test
> export TEST_DEV=10.103.182.10:6789:/
> export TEST_FS_MOUNT_OPTS="-o name=admin,secret=$password
>
> and then simply call
>
> sudo ./check -g idmapped
>
> ========================================================================
>
> Alexander Mikhalitsyn (2):
> fs: export mnt_idmap_get/mnt_idmap_put
> ceph: pass idmap to __ceph_setattr
>
> Christian Brauner (12):
> ceph: stash idmapping in mdsc request
> ceph: handle idmapped mounts in create_request_message()
> ceph: allow idmapped mknod inode op
> ceph: allow idmapped symlink inode op
> ceph: allow idmapped mkdir inode op
> ceph: allow idmapped rename inode op
> ceph: allow idmapped getattr inode op
> ceph: allow idmapped permission inode op
> ceph: allow idmapped setattr inode op
> ceph/acl: allow idmapped set_acl inode op
> ceph/file: allow idmapped atomic_open inode op
> ceph: allow idmapped mounts
>
> fs/ceph/acl.c | 6 +++---
> fs/ceph/dir.c | 4 ++++
> fs/ceph/file.c | 10 ++++++++--
> fs/ceph/inode.c | 29 +++++++++++++++++------------
> fs/ceph/mds_client.c | 27 +++++++++++++++++++++++----
> fs/ceph/mds_client.h | 1 +
> fs/ceph/super.c | 2 +-
> fs/ceph/super.h | 3 ++-
> fs/mnt_idmapping.c | 2 ++
> include/linux/mnt_idmapping.h | 3 +++
> 10 files changed, 64 insertions(+), 23 deletions(-)
>
Powered by blists - more mailing lists