Ceph » RADOS

A note from a bug scrub:

1. if somebody already has the access to monitors, he can do a lot.
2. no new comments over 2 years so likely this isn't so missed by users.

Radek, I think this was misunderstood. It's a security issue that resulted from exposing all admin socket commands via the "tell" interface.
So you don't need monitor access, except fairly normal user permissions, and can then run commands that when implemented, we assumed required privileged access to the monitor host to run!

(Sorry for the late update.)

Tagging as medium-hanging-fruit as, IIUC, we would need to:

0. (only if necessary): introduce a config variable to preserve old behavior to not surprise an operator after an upgrade.
1. maybe introduce new permission level.
2. audit all our asok cmds.