CephFS no permissions for subdir
Hi! Is it possible and if yes how to remove any permission to a subdir for a user. I'd tried to make this: ceph auth caps client.XYZ mon 'allow r' mds 'allow r, allow rws path=/XYZ, allow path=/ABC' osd 'allow rw pool=cephfs_data' but got: Error EINVAL: mds capability parse failed, stopped at ', allow path=/ABC' of 'allow r, allow rws path=/XYZ, allow path=/ABC' Thanks Lars
Hi,
I'd tried to make this: ceph auth caps client.XYZ mon 'allow r' mds 'allow r, allow rws path=/XYZ, allow path=/ABC' osd 'allow rw pool=cephfs_data'
do you want to remove all permissions from path "/ABC"? If so you should simply remove that from the command:
ceph auth caps client.XYZ mon 'allow r' mds 'allow r, allow rwx path=/XYZ' osd 'allow rw pool=cephfs_data'
I'm not aware of a 'rws' capability, using that also leads to an error. You should either set 'rw' or 'rwx' (or maybe it was just a typo?). Regards, Eugen Zitat von Lars Täuber <taeuber@bbaw.de>:
Hi!
Is it possible and if yes how to remove any permission to a subdir for a user.
I'd tried to make this: ceph auth caps client.XYZ mon 'allow r' mds 'allow r, allow rws path=/XYZ, allow path=/ABC' osd 'allow rw pool=cephfs_data'
but got: Error EINVAL: mds capability parse failed, stopped at ', allow path=/ABC' of 'allow r, allow rws path=/XYZ, allow path=/ABC'
Thanks Lars _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
Hi Eugen, Wed, 09 Oct 2019 08:44:28 +0000 Eugen Block <eblock@nde.ag> ==> ceph-users@ceph.io :
Hi,
I'd tried to make this: ceph auth caps client.XYZ mon 'allow r' mds 'allow r, allow rws path=/XYZ, allow path=/ABC' osd 'allow rw pool=cephfs_data'
do you want to remove all permissions from path "/ABC"? If so you should simply remove that from the command:
ceph auth caps client.XYZ mon 'allow r' mds 'allow r, allow rwx path=/XYZ' osd 'allow rw pool=cephfs_data'
then the client has read permissions to path=/ABC.
I'm not aware of a 'rws' capability, using that also leads to an error. You should either set 'rw' or 'rwx' (or maybe it was just a typo?).
It is for being able to make snapshots in cephfs (not rgw or rbd). I get no error in nautilus. Thanks, Lars
then the client has read permissions to path=/ABC.
This is because of "mds 'allow r, allow rws ...". Remove the 'allow r' caps from mds section and then the client only gets read permissions to the specified paths.
It is for being able to make snapshots in cephfs (not rgw or rbd). I get no error in nautilus.
You're right, I was in the wrong lab cluster. Zitat von Lars Täuber <taeuber@bbaw.de>:
Hi Eugen,
Wed, 09 Oct 2019 08:44:28 +0000 Eugen Block <eblock@nde.ag> ==> ceph-users@ceph.io :
Hi,
I'd tried to make this: ceph auth caps client.XYZ mon 'allow r' mds 'allow r, allow rws path=/XYZ, allow path=/ABC' osd 'allow rw pool=cephfs_data'
do you want to remove all permissions from path "/ABC"? If so you should simply remove that from the command:
ceph auth caps client.XYZ mon 'allow r' mds 'allow r, allow rwx path=/XYZ' osd 'allow rw pool=cephfs_data'
then the client has read permissions to path=/ABC.
I'm not aware of a 'rws' capability, using that also leads to an error. You should either set 'rw' or 'rwx' (or maybe it was just a typo?).
It is for being able to make snapshots in cephfs (not rgw or rbd). I get no error in nautilus.
Thanks, Lars _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
participants (2)
-
Eugen Block
-
Lars Täuber