)]}'
{"files/udev/95-charm-ceph-osd.rules":[{"author":{"_account_id":935,"name":"James Page","email":"ringo.page@gmail.com","username":"james-page"},"change_message_id":"ebd91366ab4e0457c3aa849e09310b2035117a9f","unresolved":true,"context_lines":[{"line_number":16,"context_line":"  OWNER:\u003d\"ceph\", GROUP:\u003d\"ceph\", MODE:\u003d\"660\""},{"line_number":17,"context_line":"ACTION\u003d\u003d\"change\", SUBSYSTEM\u003d\u003d\"block\", \\"},{"line_number":18,"context_line":"  ENV{DEVTYPE}\u003d\u003d\"disk\", \\"},{"line_number":19,"context_line":"  ENV{DM_UUID}\u003d\u003d\"CRYPT-LUKS*\", \\"},{"line_number":20,"context_line":"  OWNER\u003d\"ceph\", GROUP\u003d\"ceph\", MODE\u003d\"660\""}],"source_content_type":"application/octet-stream","patch_set":1,"id":"25ae678c_5870ab0e","line":19,"updated":"2021-04-07 09:03:37.000000000","message":"This seems very general - is there no specific way of detecting a Ceph created luks volume?","commit_id":"a1741c97e7490bef114d462b66597590b41ec1d2"},{"author":{"_account_id":31959,"name":"Ponnuvel Palaniyappan","email":"ponnuvel.palaniyappan@canonical.com","username":"pponnuvel"},"change_message_id":"e48ea42444c2d1ab52e9655b706c369e3f520d0b","unresolved":true,"context_lines":[{"line_number":16,"context_line":"  OWNER:\u003d\"ceph\", GROUP:\u003d\"ceph\", MODE:\u003d\"660\""},{"line_number":17,"context_line":"ACTION\u003d\u003d\"change\", SUBSYSTEM\u003d\u003d\"block\", \\"},{"line_number":18,"context_line":"  ENV{DEVTYPE}\u003d\u003d\"disk\", \\"},{"line_number":19,"context_line":"  ENV{DM_UUID}\u003d\u003d\"CRYPT-LUKS*\", \\"},{"line_number":20,"context_line":"  OWNER\u003d\"ceph\", GROUP\u003d\"ceph\", MODE\u003d\"660\""}],"source_content_type":"application/octet-stream","patch_set":1,"id":"76b92227_17367927","line":19,"in_reply_to":"25ae678c_5870ab0e","updated":"2021-04-08 19:30:46.000000000","message":"\u003e is there no specific way of detecting a Ceph created luks volume?\n\nI think, no. At the time, I do agree that this is generic and could unintentionally change ownership of someone else\u0027s devices.\n\nThe internal dm device created doesn\u0027t have any way to identify that it was created by ceph-volum (it\u0027s created when --dmcrypt is passed to ceph-volume. I don\u0027t see a way to supply a name, either (a known prefix like we do for the osd data, for example).\n\nAn alternative I can think of is to look at /var/lib/ceph/osd/ceph-*/block and get the actual device and then change permission of that device. This can be done using a script that gets run by a udev rule. I\u0027ll do this change and then we can see if it\u0027s viable.","commit_id":"a1741c97e7490bef114d462b66597590b41ec1d2"}],"files/udev/ceph-osd-perms.sh":[{"author":{"_account_id":935,"name":"James Page","email":"ringo.page@gmail.com","username":"james-page"},"change_message_id":"b6d020baed485561b4b5d9360c30fe3054be03a3","unresolved":true,"context_lines":[{"line_number":3,"context_line":"# Change the encrypted OSD device\u0027s ownership and permission"},{"line_number":4,"context_line":"# to ceph:ceph and 660 respectively."},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"for i in /var/lib/ceph/osd/ceph-*/block; do"},{"line_number":7,"context_line":"    if [ \"`readlink -f $i`\" \u003d \"$DEVNAME\" ]; then"},{"line_number":8,"context_line":"           chown ceph:ceph $DEVNAME"},{"line_number":9,"context_line":"           chmod 660 $DEVNAME"}],"source_content_type":"text/x-sh","patch_set":4,"id":"e9662c67_656090e7","line":6,"updated":"2021-04-12 08:39:50.000000000","message":"This approach feels likely to be racey and only covers the block device personality - db and wal are not covered.\n\nIts important that the permissions are set on the block devices before ceph tries to use them - checking for the links in the OSD directory feels to late.","commit_id":"8a92f913a5deadd976e2b667e5aab123ecbbb8af"}]}