Whamcloud - gitweb
LU-13064 sec: check permissions for changelogs access 90/36990/32
authorSebastien Buisson <sbuisson@ddn.com>
Mon, 9 Dec 2019 14:37:50 +0000 (23:37 +0900)
committerOleg Drokin <green@whamcloud.com>
Thu, 7 May 2020 05:42:02 +0000 (05:42 +0000)
commit4e8fcee92d75102314f6c39c72b9c2cbce109bd4
tree2e95779175d9417725c7e3822f5a71f3f3efb64a
parente496dbf7ed9eb64d347ac203873713531a3fbe59
LU-13064 sec: check permissions for changelogs access

root permissions should be checked when reading or clearing changelogs
from clients. In particular, if root is squashed via a nodemap entry,
it should not be allowed to access changelogs.
To achieve this send mdt body along with RQF_LLOG_ORIGIN_HANDLE_CREATE
and RQF_MDT_SET_INFO requests. And on server side, retrieve user
credentials and make sure they have root permission.

Test-Parameters: clientversion=2.12 envdefinitions=SANITY_EXCEPT="27M 56ra 151 156 802"
Test-Parameters: serverversion=2.12
Signed-off-by: Sebastien Buisson <sbuisson@ddn.com>
Change-Id: I0c6cc99f8a7c5a13c2b31009d73f38976931ec37
Reviewed-on: https://review.whamcloud.com/36990
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
Reviewed-by: Emoly Liu <emoly@whamcloud.com>
Reviewed-by: Oleg Drokin <green@whamcloud.com>
lustre/include/lustre_req_layout.h
lustre/mdt/mdt_handler.c
lustre/mdt/mdt_internal.h
lustre/ptlrpc/layout.c
lustre/ptlrpc/llog_client.c
lustre/ptlrpc/pack_generic.c
lustre/ptlrpc/ptlrpc_internal.h
lustre/target/tgt_handler.c
lustre/tests/sanity-sec.sh
lustre/tests/test-framework.sh