Bug #21244
closedway too relaxed syntax checking in ceph auth commands can lead to exploit or used as attack vector?
0%
Description
It seams that you can fill whatever strings to auth caps without any warnings.
- ceph auth caps client.nova-test osd "rwx pool=cinder-devel,allow kamalaa_with_huge_string_than_can_contain_malicious_strings_ddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd pool=whatever"
updated caps for client.nova-test
for write read and execute flags, the system expects that it can find rwx in right order, not in rxw or wrx.
I believe that this functionality is part of this area of the code https://github.com/ceph/ceph/blob/master/src/mon/MonCommands.h
Updated by Josh Durgin over 6 years ago
The monitors don't interpret the caps strings - that's done by the relevant daemon since e.g. the osds may be at a different version. See https://github.com/ceph/ceph/blob/master/src/osd/OSDCap.cc#L285 . Since the capabilities are whitelists, incoherent strings simply mean no permissions. Setting capabilities is generally not allowed by usual client user permissions, but if you see some problem we could e.g. add a maximum size for the string if that's missing.