CephFS kernel client (ceph.ko, MDS auth caps): In a multi-FS Ceph cluster the kernel client applies an MDS auth cap

Impact

In a multi-FS Ceph cluster the kernel client applies an MDS auth cap from one file system to another because it never compares fsname. A key granted read-only on fsname1 and read-write on fsname2 ends up with write rights on fsname1 - so a tenant scoped to their own file system can write into another one.

Who can reach it

Any user on a compute node that kernel-mounts CephFS in a cluster running more than one file system, using a CephX key with differing caps per file system.

What to do

Update the kernel on all CephFS client nodes to one carrying the multifs auth-caps fix, drain and reboot each node. Until then avoid granting one CephX principal different caps across file systems in the same cluster - use a distinct key per file system.

References