Ceph NFS Charm

Allow the charm to set Squash option of a share volume

Bug #2078303 reported by Bui Hong Ha
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Ceph NFS Charm
In Progress
Wishlist
Ponnuvel Palaniyappan

Bug Description

From the source code, the exported volume has the Squash option set to None by default.

https://opendev.org/openstack/charm-ceph-nfs/src/branch/master/src/ganesha.py#L154

This value is hard-coded in the charm code and I do not see any option to change it.
Could we add actions to the charm to allow modify the squash value?

Tags: sts
Revision history for this message
Bui Hong Ha (telescreen) wrote :

By default the setting is set to None, which means No RootSquash [1]. By default, a normal NFS exports will have RootId Squashed by default [2].

If The configuration for Squash remains as None as set by default by the Charm, a root user in the client is also a root user in the NFS server (manila-ganesha units?). For a general usage, I believe a Root_Id_Squash value should be a more reasonable default.

1. https://github.com/nfs-ganesha/nfs-ganesha/blob/next/src/config_samples/export.txt
2. https://linux.die.net/man/5/exports

Revision history for this message
Ponnuvel Palaniyappan (pponnuvel) wrote (last edit ):

'Root_Id_Squash' (limiting root privilege to clients) appears to be better default than 'None' (no_root_squash) from a security point of view. But this may not be that critical in trusted environments. I am not sure of the implication of changing the default from 'None' to 'Root_Id_Squash'. We do know some customers prefer to keep it 'None'.

So I think we can leave the default as it is (no_root_squash) but implement a charm option to be configurable?

Myles Penner (mylesjp)
Changed in charm-ceph-nfs:
importance: Undecided → Wishlist
status: New → Triaged
Ponnuvel Palaniyappan (pponnuvel)
Changed in charm-ceph-nfs:
assignee: nobody → Ponnuvel Palaniyappan (pponnuvel)
status: Triaged → In Progress
Revision history for this message
Ponnuvel Palaniyappan (pponnuvel) wrote :

It's been agreed that it'd be better to implement it as a juju action rather than a charm option which would allow different squash option for different exports whereas the charm option wouldn't be as flexible.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.