Bug 1393924

Summary:	[RFE][cinder] Support secure NAS with NFS Cinder backends
Product:	Red Hat OpenStack	Reporter:	Benjamin Schmaus <bschmaus>
Component:	openstack-cinder	Assignee:	Cinder Bugs List <cinder-bugs>
Status:	CLOSED CANTFIX	QA Contact:	Avi Avraham <aavraham>
Severity:	medium	Docs Contact:	Kim Nylander <knylande>
Priority:	medium
Version:	9.0 (Mitaka)	CC:	abishop, akarlsso, asoni, cinder-bugs, egafford, eharney, geguileo, molasaga, mschuppe, mzheng, pgrist, scohen, srevivo
Target Milestone:	Upstream M2	Keywords:	FutureFeature
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Known Issue
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-03-26 19:09:25 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	1381612

Description Benjamin Schmaus 2016-11-10 16:11:48 UTC

Description of problem:

When using an NFS driver as the Cinder backend, the nas_secure_file_permissions and nas_secure_file_operations settings in the cinder.conf are set to auto.  This is a sane default, but required supporting configuration options are not set to allow this to correctly function.

By default with the OSP install, if your NFS export allows setuid and isn't squashing root, you can succesfully create cinder volumes and cinder snapshots.  You CANNOT however perform any operations on the Cinder volumes once they have been attached to an instance as they are then owned by qemu:qemu and with the NFS security enhancements enabled the changes attempt to run as the Cinder process owner (cinder user) and fail as they have no access to the volumes.

The configuration changes that should be implemented when using an NFS driver as the Cinder backend are:

- Nova user belongs to the Cinder group on all compute nodes
- the /etc/libvirt/qemu.conf file has the following options configured:
   user = "nova"
   group = "cinder"
   dynamic_ownership = 0

Version-Release number of selected component (if applicable):
OSP

How reproducible:
100%

Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 3 Elise Gafford 2016-12-14 14:38:48 UTC

Temporary workaround to this issue is to set these settings to false, until the larger secure NAS epic is complete.

Comment 7 Paul Grist 2017-05-17 02:33:06 UTC

We understand this one better, but it is going to take additional work to fix the intended use of this setting and the feature as people have noted is not really correct.  

At the time it's not clear we can backport the change, but can evaluate that as we get closer.