[pve-devel] [PATCH pve-manager v2] fix #7011: ceph monitor: set ownership of monitor logs

[pve-devel] [PATCH pve-manager v2] fix #7011: ceph monitor: set ownership of monitor logs

[Dominik Rusovac]

Ownership of the ceph monitor log file is now set to ceph:ceph after the
creation of a new monitor and before the new monitor starts. Hence,
effective ceph monitor logging on freshly set up ceph clusters no longer
depends on the first upgrade of ceph-common.

For setups (still) affected by #7011 it is required that ownership of
the ceph monitor log file is set to ceph:ceph (either manually or due to
some ceph-common upgrade), followed by a monitor restart.

Signed-off-by: Dominik Rusovac <d.rusovac@proxmox.com>
---
 PVE/API2/Ceph/MON.pm | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/PVE/API2/Ceph/MON.pm b/PVE/API2/Ceph/MON.pm
index 70fc158d..18407b1c 100644
--- a/PVE/API2/Ceph/MON.pm
+++ b/PVE/API2/Ceph/MON.pm
@@ -428,6 +428,15 @@ __PACKAGE__->register_method({
                             $mon_keyring,
                         ]);
                         run_command(['chown', 'ceph:ceph', '-R', $mondir]);
+
+                        eval {
+                            # fix-up initial log file from freshly created monitor here, as currently
+                            # we cannot instruct ceph-mon to create it with the correct ownership without
+                            # losing access to the mon keyring inside pmxcfs.
+                            run_command(
+                                ['chown', 'ceph:ceph', "/var/log/ceph/ceph-mon.$monid.log"]);
+                        };
+                        warn "$@" if $@;
                     };
                     my $err = $@;
                     unlink $monmap;
-- 
2.47.3



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] [PATCH pve-manager v2] fix #7011: ceph monitor: set ownership of monitor logs

[Dominik Rusovac]

Haven't added the notes due to omitting "--notes" in my "git-format-path" command, sorry. 
Notes:
changes since v1:
* only the concrete ceph monitor log file is being chown'ed, meaning:
* the whole log directory is no longer being chown'ed
* no more globbing involed
* command passed as array
v1: https://lore.proxmox.com/all/20251212130531.116019-1-d.rusovac@proxmox.com/ [https://lore.proxmox.com/all/20251212130531.116019-1-d.rusovac@proxmox.com/]
On Wednesday, 12/17/2025, 09:38, Dominik Rusovac <d.rusovac@proxmox.com> wrote:

From : Dominik Rusovac <d.rusovac@proxmox.com>
Sent on : Wednesday, 12/17/2025, 09:38
To : pve-devel@lists.proxmox.com
Cc : Dominik Rusovac <d.rusovac@proxmox.com>
Subject : [PATCH pve-manager v2] fix #7011: ceph monitor: set ownership of monitor logs
Ownership of the ceph monitor log file is now set to ceph:ceph after the
creation of a new monitor and before the new monitor starts. Hence,
effective ceph monitor logging on freshly set up ceph clusters no longer
depends on the first upgrade of ceph-common.

For setups (still) affected by #7011 it is required that ownership of
the ceph monitor log file is set to ceph:ceph (either manually or due to
some ceph-common upgrade), followed by a monitor restart.

Signed-off-by: Dominik Rusovac <d.rusovac@proxmox.com>
---
 PVE/API2/Ceph/MON.pm [http://mon.pm/] | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/PVE/API2/Ceph/MON.pm [http://mon.pm/] b/PVE/API2/Ceph/MON.pm [http://mon.pm/]
index 70fc158d..18407b1c 100644
--- a/PVE/API2/Ceph/MON.pm [http://mon.pm/]
+++ b/PVE/API2/Ceph/MON.pm [http://mon.pm/]
@@ -428,6 +428,15 @@ __PACKAGE__->register_method({
                             $mon_keyring,
                         ]);
                         run_command(['chown', 'ceph:ceph', '-R', $mondir]);
+
+                        eval {
+                            # fix-up initial log file from freshly created monitor here, as currently
+                            # we cannot instruct ceph-mon to create it with the correct ownership without
+                            # losing access to the mon keyring inside pmxcfs.
+                            run_command(
+                                ['chown', 'ceph:ceph', "/var/log/ceph/ceph-mon.$monid.log"]);
+                        };
+                        warn "$@" if $@;
                     };
                     my $err = $@;
                     unlink $monmap;
-- 
2.47.3


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] [PATCH pve-manager v2] fix #7011: ceph monitor: set ownership of monitor logs

[Dominik Rusovac]

gentle ping, still applies to master branch
On Wednesday, 12/17/2025, 09:38, Dominik Rusovac <d.rusovac@proxmox.com> wrote:

From : Dominik Rusovac <d.rusovac@proxmox.com>
Sent on : Wednesday, 12/17/2025, 09:38
To : pve-devel@lists.proxmox.com
Cc : Dominik Rusovac <d.rusovac@proxmox.com>
Subject : [PATCH pve-manager v2] fix #7011: ceph monitor: set ownership of monitor logs
Ownership of the ceph monitor log file is now set to ceph:ceph after the
creation of a new monitor and before the new monitor starts. Hence,
effective ceph monitor logging on freshly set up ceph clusters no longer
depends on the first upgrade of ceph-common.

For setups (still) affected by #7011 it is required that ownership of
the ceph monitor log file is set to ceph:ceph (either manually or due to
some ceph-common upgrade), followed by a monitor restart.

Signed-off-by: Dominik Rusovac <d.rusovac@proxmox.com>
---
 PVE/API2/Ceph/MON.pm [http://mon.pm/] | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/PVE/API2/Ceph/MON.pm [http://mon.pm/] b/PVE/API2/Ceph/MON.pm [http://mon.pm/]
index 70fc158d..18407b1c 100644
--- a/PVE/API2/Ceph/MON.pm [http://mon.pm/]
+++ b/PVE/API2/Ceph/MON.pm [http://mon.pm/]
@@ -428,6 +428,15 @@ __PACKAGE__->register_method({
                             $mon_keyring,
                         ]);
                         run_command(['chown', 'ceph:ceph', '-R', $mondir]);
+
+                        eval {
+                            # fix-up initial log file from freshly created monitor here, as currently
+                            # we cannot instruct ceph-mon to create it with the correct ownership without
+                            # losing access to the mon keyring inside pmxcfs.
+                            run_command(
+                                ['chown', 'ceph:ceph', "/var/log/ceph/ceph-mon.$monid.log"]);
+                        };
+                        warn "$@" if $@;
                     };
                     my $err = $@;
                     unlink $monmap;
-- 
2.47.3


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] [PATCH pve-manager v2] fix #7011: ceph monitor: set ownership of monitor logs

[Maximiliano Sandoval]

Dominik Rusovac <d.rusovac@proxmox.com> writes:

> Ownership of the ceph monitor log file is now set to ceph:ceph after the
> creation of a new monitor and before the new monitor starts. Hence,
> effective ceph monitor logging on freshly set up ceph clusters no longer
> depends on the first upgrade of ceph-common.
>
> For setups (still) affected by #7011 it is required that ownership of
> the ceph monitor log file is set to ceph:ceph (either manually or due to
> some ceph-common upgrade), followed by a monitor restart.
>
> Signed-off-by: Dominik Rusovac <d.rusovac@proxmox.com>

I tested the following on a fresh Promxox VE 9.1 host:

- yes | pveceph install --repository=no-subscription
- pveceph init
- pveceph mon create
- ls -la /var/log/ceph/ceph-mon.$(hostname).log

Before this patch the owner would be set to root:ceph. After rolling
back the VM, applying the changes in this patch, and redoing the list
above the owner would be set correctly to ceph:ceph.

This issue has came up in enterprise support a couple of times. Please
consider this.

Reviewed-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
Tested-by: Maximiliano Sandoval <m.sandoval@proxmox.com>

-- 
Maximiliano