Re: [PATCH manager] ceph: create service and bootstrap keyrings with mode 0600

[Maximiliano Sandoval <m.sandoval@proxmox.com>]

Kefu Chai <k.chai@proxmox.com> writes:

> The keyrings for a new MDS, manager and client.bootstrap-osd are
> written without a mode and end up 0644. Whoever reads one gets that
> entity's caps: the MDS and manager keys can read and write every pool,
> the bootstrap key can register OSDs. Only the 0750 /var/lib/ceph keeps
> other users out.
>
> ceph-mon --mkfs was changed to 0600 for the same reason (Ceph tracker
> #14950), and ceph-authtool, cephadm and the cephx migration helper all
> write keyrings as 0600.
>
> The daemons own their keyrings after the chown, and ceph-volume reads
> the bootstrap keyring as root, so nothing loses access. Existing
> keyrings are not changed.
>
> Link: https://tracker.ceph.com/issues/14950
> Signed-off-by: Kefu Chai <k.chai@proxmox.com>


Tested

pveceph $service destroy
pveceph $service create

for OSD, MGR, and MDS on a cluster where they were created with 0644.
Recreating the services sets the permission to 600 and worked as
expected.

This came up at Enterprise support ticket #0706190.

Tested-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
Reviewed-by: Maximiliano Sandoval <m.sandoval@proxmox.com>


-- 
Maximiliano