Received: by 2002:a05:6358:3188:b0:123:57c1:9b43 with SMTP id q8csp947438rwd; Wed, 7 Jun 2023 08:57:21 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6F90QP5+DRrMHBKxCKs2ftvetL6xpTd747d9vQrPGhLZt76ly8KeAMR/PINpip7KhNt9p2 X-Received: by 2002:a17:90a:e7c2:b0:24e:358a:2c6b with SMTP id kb2-20020a17090ae7c200b0024e358a2c6bmr2085938pjb.40.1686153441080; Wed, 07 Jun 2023 08:57:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1686153441; cv=none; d=google.com; s=arc-20160816; b=EFwodhMx+OYYODN1bisVGjZxZ9qE6gEVwZZNmycvbn3T+axLJOlDWzY46R4Y8m0jpd tA4xh6OgAqC4CJFy+QCuHbu1XGaKCCPGwMS0zoGfph3cmAXe8GRmHsdRiVwd7yatEUdM xKJoLajEeiFVXSwXjt57nMshNsi52uTWT6KMe3QKQXPmDUsK/7GEmf5CTm6b+hvuFIr6 ydZXgAqtAhGBwyQcg2myJzegRAjLd4XC8c24JazPXKeN7HqluUueB5BMGktnkj+z8H4a 3tURyjy5bSYc96d4UubAu+gwWXI3IOIY6zB1bd4UJt24aY7y0BO8aRv/nqQKx+Ki+ju8 dGwA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:cc:to:subject :message-id:date:from:in-reply-to:references:mime-version :dkim-signature; bh=UzyjLDSH3L83BUY14PzO6igurevkkcTAFURgUF3tbLc=; b=Ht4p8U3SZgryCLT42pj66ibm/muABlRdn4GxnQuCnlZgPqkfQc86G0soYwMznhkfVC B0rhljPpVlqwaSi0EgECuznuFqlsV2AuX31sOLrkFXwNTCg1kSbh6qaPXqLCN7fKZI17 xeqFS/wCvL3d7W2IwUypg7thqa32hu9K/e/qOK4STgG1+9ZvgOj6z+Qe7AFcbpYWyJWU iA8TNjfvywiD6NIuUKU3W3YqfKOVQ9DfvhEnvUz1ZFe8bB2l5f1zYLuH84JbCZIBQJ1E CXzIPrHQJQ6Bee0BCWNsyadjwYfOXmBF2b7m7vxq97vICaogRzSjzo+F4UugoLmzfas2 rA5A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@canonical.com header.s=20210705 header.b=fkxgZqGq; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=canonical.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id mj23-20020a17090b369700b00250252e39besi1278865pjb.135.2023.06.07.08.57.08; Wed, 07 Jun 2023 08:57:21 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@canonical.com header.s=20210705 header.b=fkxgZqGq; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=canonical.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240259AbjFGP0o (ORCPT + 99 others); Wed, 7 Jun 2023 11:26:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34018 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241466AbjFGP0M (ORCPT ); Wed, 7 Jun 2023 11:26:12 -0400 Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D619126A5 for ; Wed, 7 Jun 2023 08:25:45 -0700 (PDT) Received: from mail-yb1-f199.google.com (mail-yb1-f199.google.com [209.85.219.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 41AB63F15A for ; Wed, 7 Jun 2023 15:25:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1686151503; bh=UzyjLDSH3L83BUY14PzO6igurevkkcTAFURgUF3tbLc=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=fkxgZqGqHW+pi559AF3RM4Xqo4MsornXTpBlfpZWzdOkVpji690KH2eNnHJKhWqXG 6YMLQL4kY17Z964171EX+fLDe4qQ698rjANTla1OczbOaih3FzPh5KKKSGcT//Of9j QE5eR8NxSCRyqO5KzqOCzxi9Jn87IO+W2nytRWmHlG0y0b/YOCZuxvy9Q0MjzEpv1Z 7iydsKfc8H77R8pDGekPYyxeGiwzFrofPw26xuu2OYOH5IZIt1j2r34q/88GUdOd+3 uGPwe8o+/tEY7YOmn5F63g4TxKo+6I971SZIRWCjZv6TTGXsno/ucxV6F2qr2665r3 4mFX7wOOfWpkQ== Received: by mail-yb1-f199.google.com with SMTP id 3f1490d57ef6-bac6a453dd5so8855868276.2 for ; Wed, 07 Jun 2023 08:25:03 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1686151502; x=1688743502; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=UzyjLDSH3L83BUY14PzO6igurevkkcTAFURgUF3tbLc=; b=Qv+rojlqFzkUs6z+yPNdF5Urrc0l38e4uDkIrQCN7wbXwFE+sKd0zDJ8i5CN7giQiF qAujEqAifuLMSOPy2199nUZuMVg+OaBbvwPtm1u32AKRGhCZJMBZ3oIBUn1ahFVlQZ8U 4N2O+QS9FFu+PY1H9XBJZxEiMslZC/79pk0a+1A7GGudbi/3dePrfZAs1wu2balsNP8U vIEsXp/DlGBHRa6oACvHFSNOUGgDNl2EnNANx4LbJcU2mN6EV01vgi0E7wQXCV4Zagdd CHrFUsS87FCtBi7briW56ADhEEwYUpGSZ+J9PcNdIAK7NdEfljEJ3diJOM9yIZeCZrQe 8icg== X-Gm-Message-State: AC+VfDyjlmj7xi/qTiEX/5Rs4obXhE42Vl7usXjMdHx0hiv1tGpIOA3h mtQ2TeDDHjirOl2Kr4IdAtqS4E8VhBH5/galBqp+RtRqa2q0HhcEWUOUHBcYyvDI6SpVjbBHA+t CY0rJIZaCR+yEFvk72ZpYRmL4ajDuliDqObD2l+lMdErJ/4UD6bq+46KLeA== X-Received: by 2002:a25:d490:0:b0:bb3:cc80:ac4a with SMTP id m138-20020a25d490000000b00bb3cc80ac4amr4129207ybf.42.1686151502105; Wed, 07 Jun 2023 08:25:02 -0700 (PDT) X-Received: by 2002:a25:d490:0:b0:bb3:cc80:ac4a with SMTP id m138-20020a25d490000000b00bb3cc80ac4amr4129185ybf.42.1686151501851; Wed, 07 Jun 2023 08:25:01 -0700 (PDT) MIME-Version: 1.0 References: <20230524153316.476973-1-aleksandr.mikhalitsyn@canonical.com> In-Reply-To: <20230524153316.476973-1-aleksandr.mikhalitsyn@canonical.com> From: Aleksandr Mikhalitsyn Date: Wed, 7 Jun 2023 17:24:50 +0200 Message-ID: Subject: Re: [PATCH v2 00/13] ceph: support idmapped mounts To: xiubli@redhat.com Cc: brauner@kernel.org, stgraber@ubuntu.com, linux-fsdevel@vger.kernel.org, Ilya Dryomov , Jeff Layton , ceph-devel@vger.kernel.org, linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org version 3 was sent https://lore.kernel.org/lkml/20230607152038.469739-1-aleksandr.mikhalitsyn@= canonical.com/ On Wed, May 24, 2023 at 5:33=E2=80=AFPM Alexander Mikhalitsyn wrote: > > Dear friends, > > This patchset was originally developed by Christian Brauner but I'll cont= inue > to push it forward. Christian allowed me to do that :) > > This feature is already actively used/tested with LXD/LXC project. > > v2 is just a rebased version of the original series with some small field= naming change. > > Git tree (based on https://github.com/ceph/ceph-client.git master): > https://github.com/mihalicyn/linux/tree/fs.idmapped.ceph.v2 > > Original description from Christian: > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > This patch series enables cephfs to support idmapped mounts, i.e. the > ability to alter ownership information on a per-mount basis. > > Container managers such as LXD support sharaing data via cephfs between > the host and unprivileged containers and between unprivileged containers. > They may all use different idmappings. Idmapped mounts can be used to > create mounts with the idmapping used for the container (or a different > one specific to the use-case). > > There are in fact more use-cases such as remapping ownership for > mountpoints on the host itself to grant or restrict access to different > users or to make it possible to enforce that programs running as root > will write with a non-zero {g,u}id to disk. > > The patch series is simple overall and few changes are needed to cephfs. > There is one cephfs specific issue that I would like to discuss and > solve which I explain in detail in: > > [PATCH 02/12] ceph: handle idmapped mounts in create_request_message() > > It has to do with how to handle mds serves which have id-based access > restrictions configured. I would ask you to please take a look at the > explanation in the aforementioned patch. > > The patch series passes the vfs and idmapped mount testsuite as part of > xfstests. To run it you will need a config like: > > [ceph] > export FSTYP=3Dceph > export TEST_DIR=3D/mnt/test > export TEST_DEV=3D10.103.182.10:6789:/ > export TEST_FS_MOUNT_OPTS=3D"-o name=3Dadmin,secret=3D$password > > and then simply call > > sudo ./check -g idmapped > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > Alexander Mikhalitsyn (1): > fs: export mnt_idmap_get/mnt_idmap_put > > Christian Brauner (12): > ceph: stash idmapping in mdsc request > ceph: handle idmapped mounts in create_request_message() > ceph: allow idmapped mknod inode op > ceph: allow idmapped symlink inode op > ceph: allow idmapped mkdir inode op > ceph: allow idmapped rename inode op > ceph: allow idmapped getattr inode op > ceph: allow idmapped permission inode op > ceph: allow idmapped setattr inode op > ceph/acl: allow idmapped set_acl inode op > ceph/file: allow idmapped atomic_open inode op > ceph: allow idmapped mounts > > fs/ceph/acl.c | 2 +- > fs/ceph/dir.c | 4 ++++ > fs/ceph/file.c | 10 ++++++++-- > fs/ceph/inode.c | 15 +++++++++++---- > fs/ceph/mds_client.c | 29 +++++++++++++++++++++++++---- > fs/ceph/mds_client.h | 1 + > fs/ceph/super.c | 2 +- > fs/mnt_idmapping.c | 2 ++ > include/linux/mnt_idmapping.h | 3 +++ > 9 files changed, 56 insertions(+), 12 deletions(-) > > -- > 2.34.1 >