Merge branch '2.7' into stable

apx-parameters.rst

@@ -150,6 +150,7 @@ CVMFS_CREATOR_VERSION               | The CernVM-FS version that was used to cre
                                     | (do not change manually).
 CVMFS_DONT_CHECK_OVERLAYFS_VERSION  | Disable checking of OverlayFS version before usage.
                                     | (see :ref:`sct_reporequirements`)
+CVMFS_ENFORCE_ACLS                  | Enforce POSIX ACLs stored in the repository. Requires libfuse 3.
 CVMFS_ENFORCE_LIMITS                | Set to *true* to cause exceeding \*LIMIT variables to be fatal to a publish
                                     | instead of a warning
 CVMFS_EXTERNAL_DATA                 | Set to *true* to mark repository to contain external data
@@ -179,7 +180,7 @@ CVMFS_NUM_UPLOAD_TASKS              | Number of threads used to commit data to s
                                     | Currently only used by the local backend.
 CVMFS_NUM_WORKERS                   | Maximal number of concurrently downloaded files during a Stratum1 pull operation
                                     | (Stratum~1 only).
-CVMFS_PUBLIC_KEY                    Path to the public key file of the repository to be replicated. (Stratum 1 only).
+CVMFS_PUBLIC_KEY                    Colon-separated path to the public key file(s) or directory(ies) of the repository to be replicated. (Stratum 1 only).
 CVMFS_REPLICA_ACTIVE                | Stratum1-only: Set to *no* to skip this repository when executing
                                     | ``cvmfs_server snapshot -a``
 CVMFS_REPOSITORY_NAME               The fully qualified name of the specific repository.

apx-rpms.rst

@@ -22,6 +22,10 @@ The CernVM-FS software is available in form of several packages:
     dependencies to at least one of the cvmfs-config-\ :math:`\cdots`
     packages.
 
+**cvmfs-fuse3**
+    Contains the additional client libraries necessary to mount with the
+    libfuse3 system libraries.
+
 **cvmfs-devel**
     Contains the ``libcvmfs.a`` static library and the ``libcvmfs.h``
     header file for use of CernVM-FS with Parrot [Thain05]_ as well as the

apx-security.rst

@@ -89,6 +89,12 @@ root privileges and changes the persona to the ``cvmfs`` user early in the file
 system initialization.  The client RPM package installs SElinux rules for RHEL6
 and RHEL7.  The cache directory should be labeled as ``cvmfs_cache_t``.
 
+The client can also be started as a normal user. In this case, the user needs
+to have access to /dev/fuse.  On Linux kernels < 4.18, mounting /dev/fuse is
+either performed by fuse's ``fusermount`` utility or through a pre-mounted file
+descriptor. On newer Linux kernels, the client can mount as an unprivileged
+user in a user namespace with a detached mount namespace.
+
 
 CernVM-FS Software Distribution
 -------------------------------

conf.py

@@ -57,9 +57,9 @@
 # built documents.
 #
 # The short X.Y version.
-version = u'2.6'
+version = u'2.7'
 # The full version, including alpha/beta/rc tags.
-release = u'2.6.3'
+release = u'2.7.0'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.

cpt-configure.rst

@@ -144,9 +144,33 @@ The private mount points can also be used to use the CernVM-FS Fuse
 module in case it has not been installed under /usr and /etc. If the
 public keys are not installed under /etc/cvmfs/keys, the directory of
 the keys needs to be specified in the config file by
-``CVMFS_KEYS_DIR=<directory>``. If the libcvmfs\_fuse.so library is not
-installed in one of the standard search paths, the ``LD_LIBRARY_PATH``
-variable has to be set accordingly for the ``cvmfs2`` command.
+``CVMFS_KEYS_DIR=<directory>``. If the libcvmfs\_fuse.so resp.
+libcvmfs\_fuse3.so library is not installed in one of the standard search paths,
+the ``CVMFS_LIBRARY_PATH`` variable has to be set accordingly for the ``cvmfs2``
+command.
+
+.. _sct_premount:
+
+
+Pre-mounting
+~~~~~~~~~~~~
+
+In usual deployments, the ``fusermount`` utility from the system fuse package
+takes care of mounting a repository before handing of control to the CernVM-FS
+client. The ``fusermount`` utility is a suid binary because on older kernel and
+outside user name spaces mounting is a privileged operation.
+
+As of libfuse3, the task of mounting /dev/fuse can be performed by any utility.
+This functionality has been added, for instance, to
+`Singularity 3.4 <https://github.com/sylabs/singularity/releases/tag/v3.4.0>`_.
+
+An executable that pre-mounts /dev/fuse has to call the ``mount()`` system call
+in order to open a file descriptor. The file descriptor number is than passed
+as command line parameter to the CernVM-FS client. A working code example is
+available in the
+`CernVM-FS tests <https://github.com/cvmfs/cvmfs/blob/cvmfs-2.7/test/src/084-premounted/fuse_premount.c>`_.
+
+
 
 Docker Containers
 ~~~~~~~~~~~~~~~~~
@@ -326,35 +350,35 @@ of load-balanced proxy groups*. The CernVM-FS proxies are set by the
 ``CVMFS_HTTP_PROXY`` parameter.
 
 Proxy groups are used for load-balancing among several proxies of equal priority.
-Starting with the first group, one proxy within a group is selected at random. 
+Starting with the first group, one proxy within a group is selected at random.
 If it fails, CernVM-FS automatically switches to another proxy from the current
 group. If all proxies in a group have failed, CernVM-FS switches to
 the next proxy group. After probing the last proxy group in the chain,
 the first is probed again. To avoid endless loops, for each file
 download the number of switches is limited by the total number of
-proxies. 
+proxies.
 
-Proxies within the same group are separated by a pipe character ``|``, while 
-groups are separated from each other by a semicolon character ``;`` [#]_. 
+Proxies within the same group are separated by a pipe character ``|``, while
+groups are separated from each other by a semicolon character ``;`` [#]_.
 Note that it is possible for a proxy group to consist of only one proxy.
 In the case of proxies that use a DNS *round-robin* entry, wherein a single host name
-resolves to multiple IP addresses, CVMFS automatically internally transforms the name 
+resolves to multiple IP addresses, CVMFS automatically internally transforms the name
 into a load-balanced group, so you should use the host name and a semicolon.
 In order to limit the number of individual proxy servers used in
 a round-robin DNS entry, set ``CVMFS_MAX_IPADDR_PER_PROXY``.  This can also limit
 the perceived "hang duration" while CernVM-FS performs fail-overs.
 
-The ``DIRECT`` keyword for a hostname avoids using a proxy altogether. Note that 
+The ``DIRECT`` keyword for a hostname avoids using a proxy altogether. Note that
 ``CVMFS_HTTP_PROXY`` must be defined in order to mount CVMFS, but to avoid using any
-proxies, you can set the parameter to ``DIRECT``. However, note that this is not recommended 
-for large numbers of clients accessing remote stratum servers, and stratum server 
+proxies, you can set the parameter to ``DIRECT``. However, note that this is not recommended
+for large numbers of clients accessing remote stratum servers, and stratum server
 administrators may ask you to deploy and use proxies.
 
-``CVMFS_HTTP_PROXY`` is typically configured with a primary proxy group listed first, 
+``CVMFS_HTTP_PROXY`` is typically configured with a primary proxy group listed first,
 and potentially other proxy groups listed after that for backup. In order to
 prevent CernVM-FS from permanently using the backup proxies after a
 fail-over, CernVM-FS will automatically retry the first proxy group in the list
-after some time. The delay for re-trying is set in seconds by ``CVMFS_PROXY_RESET_AFTER``. 
+after some time. The delay for re-trying is set in seconds by ``CVMFS_PROXY_RESET_AFTER``.
 This reset behaviour can be disabled by setting this parameter to 0.
 
 Proxy List Examples

cpt-details.rst

@@ -564,9 +564,9 @@ Loader
 
 The CernVM-FS Fuse module comprises a minimal *loader* loader process
 (the ``cvmfs2`` binary) and a shared library containing the actual
-Fuse module (``libcvmfs_fuse.so``). This structure makes it possible to
-reload CernVM-FS code and parameters without unmounting the file system.
-Loader and library don't share any symbols except for two global structs
+Fuse module (``libcvmfs_fuse.so``, ``libcvmfs_fuse3.so``). This structure makes
+it possible to reload CernVM-FS code and parameters without unmounting the file
+system. Loader and library don't share any symbols except for two global structs
 ``cvmfs_exports`` and ``loader_exports`` used to call each others
 functions. The loader process opens the Fuse channel and implements stub
 Fuse callbacks that redirect all calls to the CernVM-FS shared library.
@@ -727,6 +727,13 @@ information. There are several supported attributes:
 **rawlink**
     Shows unresolved variant symbolic links; only accessible as root.
 
+**repo\_counters**
+    Shows the aggregate counters of the repository contents (number of files
+    etc.)
+
+**repo\_metainfo**
+    Shows the :ref:`repository meta info <sct_metainfo>` file, if available
+
 **revision**
     Shows the file catalog revision of the mounted root catalog, an
     auto-increment counter increased on every repository publish.

cpt-quickstart.rst

@@ -46,15 +46,15 @@ To install the CVMFS package run
 
 ::
 
-    sudo dnf install https://ecsft.cern.ch/dist/cvmfs/cvmfs-2.6.3/cvmfs-2.6.3-1.fc29.x86_64.rpm https://ecsft.cern.ch/dist/cvmfs/cvmfs-config/cvmfs-config-default-latest.noarch.rpm
+    sudo dnf install https://ecsft.cern.ch/dist/cvmfs/cvmfs-2.7.0/cvmfs-2.7.0-1.fc29.x86_64.rpm https://ecsft.cern.ch/dist/cvmfs/cvmfs-config/cvmfs-config-default-latest.noarch.rpm
 
 OpenSUSE
 ~~~~~~~~
 To install the CVMFS package run
 
 ::
 
-    zypper install https://ecsft.cern.ch/dist/cvmfs/cvmfs-2.6.3/cvmfs-2.6.3-1.suse1320.x86_64.rpm https://ecsft.cern.ch/dist/cvmfs/cvmfs-config/cvmfs-config-default-latest.noarch.rpm
+    zypper install https://ecsft.cern.ch/dist/cvmfs/cvmfs-2.7.0/cvmfs-2.7.0-1.suse1320.x86_64.rpm https://ecsft.cern.ch/dist/cvmfs/cvmfs-config/cvmfs-config-default-latest.noarch.rpm
 
 
 Mac OS X