Merge pull request #1323 from chu11/kvsrolemask

kvs: support non-instance owners of namespaces

doc/man1/flux-kvs.adoc

@@ -55,8 +55,10 @@ arguments are described below.
 
 COMMANDS
 --------
-*namespace-create* 'name' ['name...']::
-Create a new kvs namespace.
+*namespace-create* [-o owner] 'name' ['name...']::
+Create a new kvs namespace.  User may specify an alternate userid of a
+user that owns the namespace via '-o'.  Specifying an alternate owner
+would allow a non-instance owner to read/write to a namespace.
 
 *namespace-remove* 'name' ['name...']::
 Remove a kvs namespace.

doc/man3/flux_kvs_namespace_create.adoc

@@ -14,6 +14,7 @@ SYNOPSIS
 
  flux_future_t *flux_kvs_namespace_create (flux_t *h,
                                            const char *namespace,
+                                           uint32_t owner,
                                            int flags);
 
  flux_future_t *flux_kvs_namespace_remove (flux_t *h,
@@ -24,7 +25,9 @@ DESCRIPTION
 
 `flux_kvs_namespace_create()` creates a KVS namespace.  Within a
 namespace, users can get/put KVS values completely independent of
-other KVS namespaces.
+other KVS namespaces.  An owner of the namespace other than the
+instance owner can be chosen by setting _owner_.  Otherwise, _owner_
+can be set to FLUX_USERID_UNKNOWN.
 
 `flux_kvs_namespace_remove()` removes a KVS namespace.
 

src/cmd/builtin/user.c

@@ -225,6 +225,7 @@ static int internal_user_lookup (optparse_t *p, int ac, char *av[])
         exit (1);
     }
     userid = strtoul (av[n], &endptr, 10);
+
     if (*endptr != '\0')
         userid = lookup_user (av[n]);
     if (userid == FLUX_USERID_UNKNOWN)

src/cmd/flux-kvs.c

@@ -60,6 +60,13 @@ static void dump_kvs_dir (const flux_kvsdir_t *dir, int maxcol,
 
 #define min(a,b) ((a)<(b)?(a):(b))
 
+static struct optparse_option namespace_create_opts[] =  {
+    { .name = "owner", .key = 'o', .has_arg = 1,
+      .usage = "Specify alternate namespace owner via userid",
+    },
+    OPTPARSE_TABLE_END
+};
+
 static struct optparse_option readlink_opts[] =  {
     { .name = "at", .key = 'a', .has_arg = 1,
       .usage = "Lookup relative to RFC 11 snapshot reference",
@@ -176,7 +183,7 @@ static struct optparse_subcommand subcommands[] = {
       "Create a KVS namespace",
       cmd_namespace_create,
       0,
-      NULL
+      namespace_create_opts
     },
     { "namespace-remove",
       "name [name...]",
@@ -355,16 +362,26 @@ int cmd_namespace_create (optparse_t *p, int argc, char **argv)
     flux_t *h = (flux_t *)optparse_get_data (p, "flux_handle");
     flux_future_t *f;
     int optindex, i;
+    uint32_t owner = FLUX_USERID_UNKNOWN;
+    const char *str;
 
     optindex = optparse_option_index (p);
     if ((optindex - argc) == 0) {
         optparse_print_usage (p);
         exit (1);
     }
+
+    if ((str = optparse_get_str (p, "owner", NULL))) {
+        char *endptr;
+        owner = strtoul (str, &endptr, 10);
+        if (*endptr != '\0')
+            log_err_exit ("--owner requires an unsigned integer argument");
+    }
+
     for (i = optindex; i < argc; i++) {
         const char *name = argv[i];
         int flags = 0;
-        if (!(f = flux_kvs_namespace_create (h, name, flags))
+        if (!(f = flux_kvs_namespace_create (h, name, owner, flags))
             || flux_future_get (f, NULL) < 0)
             log_err_exit ("%s", name);
         flux_future_destroy (f);

src/common/libkvs/kvs.c

@@ -25,6 +25,8 @@
 #if HAVE_CONFIG_H
 #include "config.h"
 #endif
+#include <unistd.h>
+
 #include <flux/core.h>
 
 const char *get_kvs_namespace (void)
@@ -35,16 +37,18 @@ const char *get_kvs_namespace (void)
 }
 
 flux_future_t *flux_kvs_namespace_create (flux_t *h, const char *namespace,
-                                          int flags)
+                                          uint32_t owner, int flags)
 {
     if (!namespace || flags) {
         errno = EINVAL;
         return NULL;
     }
 
+    /* N.B. owner cast to int */
     return flux_rpc_pack (h, "kvs.namespace.create", 0, 0,
-                          "{ s:s s:i }",
+                          "{ s:s s:i s:i }",
                           "namespace", namespace,
+                          "owner", owner,
                           "flags", flags);
 }
 

src/common/libkvs/kvs.h

@@ -33,7 +33,7 @@ enum {
  *   consistent".
  */
 flux_future_t *flux_kvs_namespace_create (flux_t *h, const char *namespace,
-                                          int flags);
+                                          uint32_t owner, int flags);
 flux_future_t *flux_kvs_namespace_remove (flux_t *h, const char *namespace);
 
 /* Synchronization:

src/common/libkvs/test/kvs.c

@@ -15,7 +15,7 @@ void errors (void)
     /* check simple error cases */
 
     errno = 0;
-    ok (flux_kvs_namespace_create (NULL, NULL, 5) == NULL && errno == EINVAL,
+    ok (flux_kvs_namespace_create (NULL, NULL, 0, 5) == NULL && errno == EINVAL,
         "flux_kvs_namespace_create fails on bad input");
 
     errno = 0;

src/modules/kvs/kvs.c

@@ -284,6 +284,39 @@ static int event_unsubscribe (kvs_ctx_t *ctx, const char *namespace)
     return rc;
 }
 
+/*
+ * security
+ */
+
+static int check_user (kvs_ctx_t *ctx, struct kvsroot *root,
+                       const flux_msg_t *msg)
+{
+    uint32_t rolemask;
+
+    if (flux_msg_get_rolemask (msg, &rolemask) < 0) {
+        flux_log_error (ctx->h, "flux_msg_get_rolemask");
+        return -1;
+    }
+
+    if (rolemask & FLUX_ROLE_OWNER)
+        return 0;
+
+    if (rolemask & FLUX_ROLE_USER) {
+        uint32_t userid;
+
+        if (flux_msg_get_userid (msg, &userid) < 0) {
+            flux_log_error (ctx->h, "flux_msg_get_userid");
+            return -1;
+        }
+
+        if (userid == root->owner)
+            return 0;
+    }
+
+    errno = EPERM;
+    return -1;
+}
+
 /*
  * set/get root
  */
@@ -311,6 +344,7 @@ static void getroot_completion (flux_future_t *f, void *arg)
     const flux_msg_t *msg;
     const char *namespace;
     int rootseq, flags;
+    uint32_t owner;
     const char *ref;
     struct kvsroot *root;
     int save_errno;
@@ -327,7 +361,9 @@ static void getroot_completion (flux_future_t *f, void *arg)
         goto error;
     }
 
-    if (flux_rpc_get_unpack (f, "{ s:i s:s s:i }",
+    /* N.B. owner read into uint32_t */
+    if (flux_rpc_get_unpack (f, "{ s:i s:i s:s s:i }",
+                             "owner", &owner,
                              "rootseq", &rootseq,
                              "rootref", &ref,
                              "flags", &flags) < 0) {
@@ -343,6 +379,7 @@ static void getroot_completion (flux_future_t *f, void *arg)
                                               ctx->cache,
                                               ctx->hash_name,
                                               namespace,
+                                              owner,
                                               flags))) {
             flux_log_error (ctx->h, "%s: kvsroot_mgr_create_root", __FUNCTION__);
             goto error;
@@ -442,8 +479,13 @@ static struct kvsroot *getroot (kvs_ctx_t *ctx, const char *namespace,
                 return NULL;
             }
             (*stall) = true;
+            return NULL;
         }
     }
+
+    if (check_user (ctx, root, msg) < 0)
+        return NULL;
+
     return root;
 }
 
@@ -1571,6 +1613,9 @@ static void unwatch_request_cb (flux_t *h, flux_msg_handler_t *mh,
     if (!(root = kvsroot_mgr_lookup_root_safe (ctx->km, namespace)))
         goto done;
 
+    if (check_user (ctx, root, msg) < 0)
+        goto done;
+
     if (!(p.key = kvs_util_normalize_key (key, NULL))) {
         errnum = errno;
         goto done;
@@ -1769,6 +1814,7 @@ static void fence_request_cb (flux_t *h, flux_msg_handler_t *mh,
     else {
         flux_future_t *f;
 
+        /* route to rank 0 as instance owner */
         if (!(f = flux_rpc_pack (h, "kvs.relayfence", 0, FLUX_RPC_NORESPONSE,
                                  "{ s:O s:s s:s s:i s:i }",
                                  "ops", ops,
@@ -1865,6 +1911,9 @@ static void getroot_request_cb (flux_t *h, flux_msg_handler_t *mh,
             errno = ENOTSUP;
             goto error;
         }
+
+        if (check_user (ctx, root, msg) < 0)
+            goto error;
     }
     else {
         /* If root is not initialized, we have to intialize ourselves
@@ -1879,7 +1928,9 @@ static void getroot_request_cb (flux_t *h, flux_msg_handler_t *mh,
         }
     }
 
-    if (flux_respond_pack (h, msg, "{ s:i s:s s:i }",
+    /* N.B. owner cast into int */
+    if (flux_respond_pack (h, msg, "{ s:i s:i s:s s:i }",
+                           "owner", root->owner,
                            "rootseq", root->seq,
                            "rootref", root->ref,
                            "flags", root->flags) < 0) {
@@ -2219,7 +2270,8 @@ static void stats_clear_request_cb (flux_t *h, flux_msg_handler_t *mh,
         flux_log_error (h, "%s: flux_respond", __FUNCTION__);
 }
 
-static int namespace_create (kvs_ctx_t *ctx, const char *namespace, int flags)
+static int namespace_create (kvs_ctx_t *ctx, const char *namespace,
+                             uint32_t owner, int flags)
 {
     struct kvsroot *root;
     json_t *rootdir = NULL;
@@ -2238,6 +2290,7 @@ static int namespace_create (kvs_ctx_t *ctx, const char *namespace, int flags)
                                           ctx->cache,
                                           ctx->hash_name,
                                           namespace,
+                                          owner,
                                           flags))) {
         flux_log_error (ctx->h, "%s: kvsroot_mgr_create_root", __FUNCTION__);
         goto cleanup;
@@ -2281,18 +2334,21 @@ static void namespace_create_request_cb (flux_t *h, flux_msg_handler_t *mh,
 {
     kvs_ctx_t *ctx = arg;
     const char *namespace;
+    uint32_t owner;
     int flags;
 
     assert (ctx->rank == 0);
 
-    if (flux_request_unpack (msg, NULL, "{ s:s s:i }",
+    /* N.B. owner read into uint32_t */
+    if (flux_request_unpack (msg, NULL, "{ s:s s:i s:i }",
                              "namespace", &namespace,
+                             "owner", &owner,
                              "flags", &flags) < 0) {
         flux_log_error (h, "%s: flux_request_unpack", __FUNCTION__);
         goto error;
     }
 
-    if (namespace_create (ctx, namespace, flags) < 0) {
+    if (namespace_create (ctx, namespace, owner, flags) < 0) {
         flux_log_error (h, "%s: namespace_create", __FUNCTION__);
         goto error;
     }
@@ -2439,16 +2495,22 @@ static const struct flux_msg_handler_spec htab[] = {
     { FLUX_MSGTYPE_EVENT,   "kvs.stats.clear",stats_clear_event_cb, 0 },
     { FLUX_MSGTYPE_EVENT,   "kvs.setroot.*",  setroot_event_cb, 0 },
     { FLUX_MSGTYPE_EVENT,   "kvs.error.*",    error_event_cb, 0 },
-    { FLUX_MSGTYPE_REQUEST, "kvs.getroot",    getroot_request_cb, 0 },
+    { FLUX_MSGTYPE_REQUEST, "kvs.getroot",
+                            getroot_request_cb, FLUX_ROLE_USER },
     { FLUX_MSGTYPE_REQUEST, "kvs.dropcache",  dropcache_request_cb, 0 },
     { FLUX_MSGTYPE_EVENT,   "kvs.dropcache",  dropcache_event_cb, 0 },
     { FLUX_MSGTYPE_EVENT,   "hb",             heartbeat_cb, 0 },
     { FLUX_MSGTYPE_REQUEST, "kvs.disconnect", disconnect_request_cb, 0 },
-    { FLUX_MSGTYPE_REQUEST, "kvs.unwatch",    unwatch_request_cb, 0 },
-    { FLUX_MSGTYPE_REQUEST, "kvs.sync",       sync_request_cb, 0 },
-    { FLUX_MSGTYPE_REQUEST, "kvs.get",        get_request_cb, 0 },
-    { FLUX_MSGTYPE_REQUEST, "kvs.watch",      watch_request_cb, 0 },
-    { FLUX_MSGTYPE_REQUEST, "kvs.fence",      fence_request_cb, 0 },
+    { FLUX_MSGTYPE_REQUEST, "kvs.unwatch",
+                            unwatch_request_cb, FLUX_ROLE_USER },
+    { FLUX_MSGTYPE_REQUEST, "kvs.sync",
+                            sync_request_cb, FLUX_ROLE_USER },
+    { FLUX_MSGTYPE_REQUEST, "kvs.get",
+                            get_request_cb, FLUX_ROLE_USER },
+    { FLUX_MSGTYPE_REQUEST, "kvs.watch",
+                            watch_request_cb, FLUX_ROLE_USER },
+    { FLUX_MSGTYPE_REQUEST, "kvs.fence",
+                            fence_request_cb, FLUX_ROLE_USER },
     { FLUX_MSGTYPE_REQUEST, "kvs.relayfence", relayfence_request_cb, 0 },
     { FLUX_MSGTYPE_REQUEST, "kvs.namespace.create",
                             namespace_create_request_cb, 0 },
@@ -2553,6 +2615,7 @@ int mod_main (flux_t *h, int argc, char **argv)
     if (ctx->rank == 0) {
         struct kvsroot *root;
         blobref_t rootref;
+        uint32_t owner = geteuid ();
 
         if (store_initial_rootdir (ctx, rootref) < 0) {
             flux_log_error (h, "storing initial root object");
@@ -2569,6 +2632,7 @@ int mod_main (flux_t *h, int argc, char **argv)
                                                   ctx->cache,
                                                   ctx->hash_name,
                                                   KVS_PRIMARY_NAMESPACE,
+                                                  owner,
                                                   0))) {
                 flux_log_error (h, "kvsroot_mgr_create_root");
                 goto done;

src/modules/kvs/kvsroot.c

@@ -108,6 +108,7 @@ struct kvsroot *kvsroot_mgr_create_root (kvsroot_mgr_t *km,
                                          struct cache *cache,
                                          const char *hash_name,
                                          const char *namespace,
+                                         uint32_t owner,
                                          int flags)
 {
     struct kvsroot *root;
@@ -143,6 +144,7 @@ struct kvsroot *kvsroot_mgr_create_root (kvsroot_mgr_t *km,
         goto error;
     }
 
+    root->owner = owner;
     root->flags = flags;
     root->remove = false;
 

src/modules/kvs/kvsroot.h

@@ -13,6 +13,7 @@ typedef struct kvsroot_mgr kvsroot_mgr_t;
 
 struct kvsroot {
     char *namespace;
+    uint32_t owner;
     int seq;
     blobref_t ref;
     commit_mgr_t *cm;
@@ -37,6 +38,7 @@ struct kvsroot *kvsroot_mgr_create_root (kvsroot_mgr_t *km,
                                          struct cache *cache,
                                          const char *hash_name,
                                          const char *namespace,
+                                         uint32_t owner,
                                          int flags);
 
 int kvsroot_mgr_remove_root (kvsroot_mgr_t *km, const char *namespace);