[PATCH manager] ceph: create service and bootstrap keyrings with mode 0600

[PATCH manager] ceph: create service and bootstrap keyrings with mode 0600

[Kefu Chai]

The keyrings for a new MDS, manager and client.bootstrap-osd are
written without a mode and end up 0644. Whoever reads one gets that
entity's caps: the MDS and manager keys can read and write every pool,
the bootstrap key can register OSDs. Only the 0750 /var/lib/ceph keeps
other users out.

ceph-mon --mkfs was changed to 0600 for the same reason (Ceph tracker
#14950), and ceph-authtool, cephadm and the cephx migration helper all
write keyrings as 0600.

The daemons own their keyrings after the chown, and ceph-volume reads
the bootstrap keyring as root, so nothing loses access. Existing
keyrings are not changed.

Link: https://tracker.ceph.com/issues/14950
Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 PVE/API2/Ceph/OSD.pm | 2 +-
 PVE/Ceph/Services.pm | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/PVE/API2/Ceph/OSD.pm b/PVE/API2/Ceph/OSD.pm
index c5c20140..7ff006d2 100644
--- a/PVE/API2/Ceph/OSD.pm
+++ b/PVE/API2/Ceph/OSD.pm
@@ -421,7 +421,7 @@ __PACKAGE__->register_method({
                 ],
                 format => 'plain',
             });
-            file_set_contents($ceph_bootstrap_osd_keyring, $bindata);
+            file_set_contents($ceph_bootstrap_osd_keyring, $bindata, 0600);
         }
 
         # $size is in kibibytes
diff --git a/PVE/Ceph/Services.pm b/PVE/Ceph/Services.pm
index 6c6bd7e2..10d27623 100644
--- a/PVE/Ceph/Services.pm
+++ b/PVE/Ceph/Services.pm
@@ -325,7 +325,7 @@ sub create_mds {
         format => 'plain',
     });
 
-    PVE::Tools::file_set_contents($service_keyring, $output);
+    PVE::Tools::file_set_contents($service_keyring, $output, 0600);
 
     print "setting ceph as owner for service directory\n";
     run_command(["chown", 'ceph:ceph', '-R', $service_dir]);
@@ -401,7 +401,7 @@ sub create_mgr {
         ],
         format => 'plain',
     });
-    PVE::Tools::file_set_contents($mgrkeyring, $output);
+    PVE::Tools::file_set_contents($mgrkeyring, $output, 0600);
 
     print "setting owner for directory\n";
     run_command(["chown", 'ceph:ceph', '-R', $mgrdir]);
-- 
2.47.3

Re: [PATCH manager] ceph: create service and bootstrap keyrings with mode 0600

[Maximiliano Sandoval]

Kefu Chai <k.chai@proxmox.com> writes:

> The keyrings for a new MDS, manager and client.bootstrap-osd are
> written without a mode and end up 0644. Whoever reads one gets that
> entity's caps: the MDS and manager keys can read and write every pool,
> the bootstrap key can register OSDs. Only the 0750 /var/lib/ceph keeps
> other users out.
>
> ceph-mon --mkfs was changed to 0600 for the same reason (Ceph tracker
> #14950), and ceph-authtool, cephadm and the cephx migration helper all
> write keyrings as 0600.
>
> The daemons own their keyrings after the chown, and ceph-volume reads
> the bootstrap keyring as root, so nothing loses access. Existing
> keyrings are not changed.
>
> Link: https://tracker.ceph.com/issues/14950
> Signed-off-by: Kefu Chai <k.chai@proxmox.com>


Tested

pveceph $service destroy
pveceph $service create

for OSD, MGR, and MDS on a cluster where they were created with 0644.
Recreating the services sets the permission to 600 and worked as
expected.

This came up at Enterprise support ticket #0706190.

Tested-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
Reviewed-by: Maximiliano Sandoval <m.sandoval@proxmox.com>


-- 
Maximiliano