Ceph

File - src/mon/AuthMonitor.cc

void AuthMonitor::import_keyring(KeyRing& keyring)
{
  for (map<EntityName, EntityAuth>::iterator p = keyring.get_keys().begin();
       p != keyring.get_keys().end();
       ++p) {
    KeyServerData::Incremental auth_inc;
    auth_inc.name = p->first;
    auth_inc.auth = p->second;
    auth_inc.op = KeyServerData::AUTH_INC_ADD;
    dout(10) << " importing " << auth_inc.name << dendl;
    dout(30) << "    " << auth_inc.auth << dendl;
    push_cephx_inc(auth_inc);
  }
}

- Looks like we can add some check here if import kerying file does not have 'caps', we should not allow import. Because we do not keep any keyring without 'caps' in ceph auth list.

- I have tested other scenarios like if keyring is not in the correct format or corrupted import command hangs.

- But if keyring is fine and format of keyring file is fine as given in¹ and only 'caps' are missing it updates the keyring in the list.

[1] keyring

# cat /etc/ceph/ceph.client.admin.keyring 
[client.admin]
    key = AQAC9CBWyJXIARAAM/0fpu0rG2ZWkZqIUTVn+w==