Bug 1393924 - [RFE][cinder] Support secure NAS with NFS Cinder backends
Summary: [RFE][cinder] Support secure NAS with NFS Cinder backends
Keywords:
Status: CLOSED CANTFIX
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-cinder
Version: 9.0 (Mitaka)
Hardware: All
OS: Linux
medium
medium
Target Milestone: Upstream M2
: ---
Assignee: Cinder Bugs List
QA Contact: Avi Avraham
Kim Nylander
URL:
Whiteboard:
Depends On:
Blocks: 1381612
TreeView+ depends on / blocked
 
Reported: 2016-11-10 16:11 UTC by Benjamin Schmaus
Modified: 2022-08-16 13:53 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: Known Issue
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-03-26 19:09:25 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker OSP-4580 0 None None None 2022-08-16 13:53:05 UTC

Description Benjamin Schmaus 2016-11-10 16:11:48 UTC
Description of problem:

When using an NFS driver as the Cinder backend, the nas_secure_file_permissions and nas_secure_file_operations settings in the cinder.conf are set to auto.  This is a sane default, but required supporting configuration options are not set to allow this to correctly function.

By default with the OSP install, if your NFS export allows setuid and isn't squashing root, you can succesfully create cinder volumes and cinder snapshots.  You CANNOT however perform any operations on the Cinder volumes once they have been attached to an instance as they are then owned by qemu:qemu and with the NFS security enhancements enabled the changes attempt to run as the Cinder process owner (cinder user) and fail as they have no access to the volumes.

The configuration changes that should be implemented when using an NFS driver as the Cinder backend are:

- Nova user belongs to the Cinder group on all compute nodes
- the /etc/libvirt/qemu.conf file has the following options configured:
   user = "nova"
   group = "cinder"
   dynamic_ownership = 0

Version-Release number of selected component (if applicable):
OSP

How reproducible:
100%

Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 3 Elise Gafford 2016-12-14 14:38:48 UTC
Temporary workaround to this issue is to set these settings to false, until the larger secure NAS epic is complete.

Comment 7 Paul Grist 2017-05-17 02:33:06 UTC
We understand this one better, but it is going to take additional work to fix the intended use of this setting and the feature as people have noted is not really correct.  

At the time it's not clear we can backport the change, but can evaluate that as we get closer.


Note You need to log in before you can comment on or make changes to this bug.