CEPH cluster permission consistency management method and system
By dynamically judging and returning permission lists in the CEPH file system, the problem of inconsistency of permissions is solved, the consistency of permissions is ensured, and ease of use and security is improved.
Patent Information
- Application Number
- CN202411893894.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-20
- Publication Date
- 2025-04-15
AI Technical Summary
In the prior art, in the permission management scheme of the CEPH file system, the permission list obtained by the client does not contain the permissions defined by WORM and enhanced ACL, resulting in inconsistent permissions during actual execution, causing misunderstandings and inconvenience to users, and reducing the ease of use of the CEPH file system.
By receiving client request information, we judge the mode permissions, posix acl permissions and worm permission attributes of the operation target, determine the actual permissions based on the client uid and gid, dynamically return the final permission list, resolve permission conflicts, and ensure the consistency of permissions.
It realizes consistency between the permissions actually owned by the client and the permissions received, and improves the ease of use and security of the CEPH file system.
Smart Images
Figure CN119830340A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of information management technology, and in particular to a CEPH cluster authority consistency management method and system. Background Art
[0002] In modern information technology, distributed storage systems such as CEPH are favored for their high scalability and high reliability. As an advanced distributed storage solution, CEPH not only provides high scalability and high reliability data storage capabilities, but also integrates multiple permission management and data protection mechanisms to meet the needs of different users and application scenarios. The following are multiple permission management and data protection mechanisms of the CEPH file system:
[0003] (1) WORM stands for Write Once Read Many, which means write once and read multiple times. There are three WORM protection states: unprotected, protected, and expired. For protected files, only read is allowed, not write or delete. For expired files, read and delete are allowed, but not write. There are no special restrictions on unprotected files.
[0004] (2) There are only three user roles in Linux mode permission management: owner, group and other, and only three permission types: r read, w write and x execute. Group is a user in the same group as the file owner and has certain permissions.
[0005] (3) POSIX ACL extends the user role based on mode. In addition to owner, group, and other, it can also be set for individual uid and gid.
[0006] (4) Enhanced ACL is an extension of POSIX ACL. It extends the permission types of POSIX ACL to include delete, traverse, etc. in addition to rwx.
[0007] In the prior art, after the client mounts the CEPH file system using ceph-fuse, ganesha, cifs (including but not limited to these three mounting methods), before performing IO operations, the access interface will be called to obtain the permission list, and the existing access interface will return permissions based on mode and posxi acl. After the client obtains the permission list returned by the access interface, it can determine the permission list that can actually be obtained in the end according to the uid / gid information in the IO request (uid / gid information carried by the client when sending the request) and the uid / gid information of the file / directory to be operated (uid / gid information of the object to be operated), and then determine whether the subsequent IO operation can be performed. However, in the prior art solution, after the client mounts the CEPH file system, the permission list obtained through the access interface does not include the permissions defined by WORM and enhanced ACL, so when the file enters the WORM and enhanced ACL protection period, there may be a conflict with the final permission returned, resulting in inconsistency between the final permission received and the permission range of the actual operation, which brings misunderstandings and contradictions to the user. If file a enters the WORM protection period, file a is not allowed to be written or deleted. However, if WORM is not implemented, the existing access interface will return the permission for file a to be written or deleted. After obtaining the permission for file a to be written or deleted, the client performs the write and delete operations. However, due to the WORM limitation of the CEPH file system, the write and delete operations on file a fail. The inconsistency between the actual execution permissions and the permissions received by the client will cause misunderstandings and inconveniences to users, and reduce the usability of the CEPH file system. Summary of the invention
[0008] Based on this, in response to the above technical problems, a CEPH cluster permission consistency management method and system are provided to solve the problem of inconsistency between the permissions actually executed in the prior art and the permissions received by the client.
[0009] In a first aspect, a CEPH cluster permission consistency management method is applied to a distributed file system, and the method includes:
[0010] Receive request information from a client, the request information including: request type, requested operation target, client uid, and group gid to which the client belongs;
[0011] Determine whether the operation target has the permission attributes of mode permission, posix acl permission, enhanced acl permission and worm permission;
[0012] Determine the actual permission of each permission attribute owned by the client according to the client uid and the gid of the group to which the client belongs, and determine the final permission list of the client according to the actual permission of each permission attribute owned by the client;
[0013] Returns the final permission list to the client.
[0014] In the above solution, optionally, the client final permission list determined according to the actual permission of each permission attribute possessed by the client includes:
[0015] Get the actual permission set based on the actual permissions of multiple permission attributes owned by the client;
[0016] When there is a permission conflict in the actual permission collection, the information of the affirmative permission in the permission conflict is deleted in the actual permission collection to obtain a final permission list.
[0017] In the above scheme, optionally, before receiving the request information from the client, the method further includes: receiving a login request from the client user, verifying the user identity of the client, and determining whether the user identity of the client is legal.
[0018] In the above solution, optionally, the returning the final permission list to the client further includes:
[0019] Receiving an operation request sent by the client according to the final permission list;
[0020] The operation request is verified according to the final permission list, and the operation request that passes the verification is processed.
[0021] In a second aspect, a CEPH cluster authority consistency management system is provided, the system comprising:
[0022] Request information receiving module: used to receive request information from the client, the request information includes: request type, requested operation target, client uid and gid of the group to which the client belongs;
[0023] Permission attribute judgment module: used to judge whether the operation target has the permission attributes of mode permission, posix acl permission, enhanced acl permission and worm permission;
[0024] The final permission list determination module is used to determine the actual permission of each permission attribute owned by the client according to the client uid and the gid of the group to which the client belongs, and determine the client's final permission list according to the determined actual permission of each permission attribute owned by the client;
[0025] Return final permission list module: used to return the final permission list to the client.
[0026] In the above solution, the system may optionally further include: an identity authentication module: configured to receive a login request from a client user, verify the user identity of the client, and determine whether the user identity of the client is legal.
[0027] In the above solution, optionally, the client final permission list determined according to the actual permission of each permission attribute possessed by the client includes:
[0028] Get the actual permission set based on the actual permissions of multiple permission attributes owned by the client;
[0029] When there is a permission conflict in the actual permission collection, the information of the affirmative permission in the permission conflict is deleted in the actual permission collection to obtain a final permission list.
[0030] In the above scheme, optionally, the system further comprises an operation request verification module: configured to receive an operation request sent by a client according to the final permission list; verify the operation request according to the final permission list, and process the operation request that passes the verification.
[0031] In a third aspect, a computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of a CEPH cluster permission consistency management method described in the first aspect are implemented.
[0032] In a fourth aspect, a computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of a CEPH cluster permission consistency management method described in the first aspect are implemented.
[0033] This application has at least the following beneficial effects:
[0034] When receiving a client request, the present application determines in sequence whether the operation target has the permission attributes of mode permission, posix acl permission, enhanced acl permission and worm permission, and then determines the actual permission of each permission attribute owned by the client according to the client uid and the gid of the group to which the client belongs, and determines the final permission list of the client according to the actual permission of each permission attribute owned by the client. Thus, the scope of the actual mode permission, posix acl permission, enhanced acl permission and worm permission of the operation file is integrated, so that the permission actually owned by the client is consistent with the permission received by the client, and the usability and security of the CEPH file system are improved. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] Figure 1A flowchart of a CEPH cluster permission consistency management method provided by an embodiment of the present application;
[0036] Figure 2 A schematic diagram of a specific flow chart of a CEPH cluster permission consistency management method provided by an embodiment of the present application. DETAILED DESCRIPTION
[0037] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0038] Some of the terms used in this application are explained as follows:
[0039] 1) Client: A program that uses the file system services provided by the CEPH cluster.
[0040] 2) CEPH file system: The file system service provided by the CEPH cluster to the outside world.
[0041] 3) Mount: refers to connecting the CEPH file system to a directory of the client's file system. Accessing this directory is equivalent to accessing the CEPH file system. There are two ways for the client to mount CEPHFS: kernel-mode mount and user-mode mount. User-mode mount can be divided into three ways: ceph-fuse, nfs-ganesha, and cifs.
[0042] 4) Access interface: The interface function provided by the file system to the outside world, used by the client to obtain the permission list.
[0043] 5) Mode permission: The user roles of mode permission are owner, group and other. The types of mode permission are: r for reading, w for writing and x for executing.
[0044] 6) POSIX ACL permissions: In addition to owner, group, and other, POSIX ACL permissions can also be set for individual UIDs and GIDs. POSIX ACL permissions are similar to the three types of rwx.
[0045] 7) Enhanced ACL permissions: The roles of enhanced ACL permissions are the same as those of POSIX ACL permissions, but in addition to rwx, enhanced ACL permission types also include delete, traverse, etc.
[0046] 8) Worm permissions: There are three worm protection states: unprotected, protected, and expired. Files in the protected state are not allowed to be written or deleted, that is, files in the protected state have no write permission or delete permission. Files in the expired state are not allowed to be written, that is, files in the expired state have no write permission.
[0047] In one embodiment, Figure 1 As shown, a CEPH cluster permission consistency management method is provided, which is applied to a distributed file system, and the method includes:
[0048] Step S1: Receive request information from a client, the request information including: request type, requested operation target, client uid, and group gid to which the client belongs.
[0049] In step S1, after the client successfully mounts the CEPH file system, the CEPH file system records the operation type op_type requested by the client, the target directory or directory file target_object requested by the client, and the uid / gid requested.
[0050] Step S2: Determine whether the operation target has the permission attributes of mode permission, posix acl permission, enhanced acl permission and worm permission.
[0051] Step S3: Determine the actual permission of each permission attribute owned by the client according to the client uid and the gid of the group to which the client belongs, and determine the final permission list of the client according to the determined actual permission of each permission attribute owned by the client.
[0052] In step S3, the final permission list returned to the client is determined based on uid / gid. Regardless of owner, group or other, for the CEPH file system, uid / gid is used to represent them. That is to say, for the role of permission, all permission roles can be uniformly represented by uid / gid, and the types of permissions include rwx, delete, traverse, etc. After obtaining various permission information of the operation target, the final permission list that can be obtained by the uid / gid can be matched based on the uid / gid in the request.
[0053] Each time the client calls the access interface, the CEPH file system will obtain various permission information in real time and dynamically return the permission list to the client.
[0054] Step S4: Return the final permission list to the client.
[0055] In this embodiment, if Figure 2 As shown, the specific process is as follows:
[0056] (1). The client successfully mounts the CEPH file system;
[0057] (2) For the client's requested operation, the CEPH file system will record the client's requested operation type op_type and the requested target directory or directory file target_object (the target of the client's requested operation), as well as the requested uid / gid (the target of the client's requested operation);
[0058] (3) If the client request type op_type is access interface, obtain the mode permission list of the requested operation target target_object;
[0059] (4). If the posix acl permission is set on the target object, obtain the posix acl permission list;
[0060] (5). If the enhanced ACL permission is set on the operation target target_object, obtain the enhanced ACL permission list;
[0061] (6) If worm is set on the target_object, obtain the worm permission;
[0062] (7) Based on the uid / gid in the client request, return the list of permissions actually obtained by the client.
[0063] Step (7) in the above algorithm returns the permission list actually obtained by the client. This is a comprehensive consideration of steps (3), (4), (5), and (6). Specifically, it is a maximum set of the permission lists in steps (3), (4), (5), and (6). This maximum set is the permission list that the client can actually obtain.
[0064] In step (3) of the above algorithm, each time the client sends an access request, the CEPH file system will obtain the permission lists of steps (3), (4), (5), and (6) in real time, and will return the permission list actually obtained to the client after step (7).
[0065] The order of obtaining steps (3), (4), (5), and (6) in the above algorithm can be any order, and it is not required to obtain the permission list in the order of steps (3), (4), (5), and (6).
[0066] In the permission set of the above algorithm, if there is a permission conflict, the negative permission takes precedence (that is, the negative permission has a higher priority). For example, in step (5), the user with uid 1000 is allowed to delete file A. In step (6), because file A enters the worm protection state and is not allowed to be deleted, the permission list returned to the client does not allow the deletion of file A.
[0067] In the above-mentioned CEPH cluster permission consistency management method, when receiving a client request, it is judged in turn whether the operation target has the permission attributes of mode permission, posix acl permission, enhanced acl permission and worm permission, and then the actual permission of each permission attribute owned by the client is determined according to the client uid and the gid of the group to which the client belongs, and the final permission list of the client is determined according to the actual permission of each permission attribute owned by the client. In this way, the scope of the actual mode permission, posix acl permission, enhanced acl permission and worm permission of the operation file is integrated, so that the permission during actual execution is consistent with the permission received by the client, and the usability of the CEPH file system is improved.
[0068] In one embodiment, the client final permission list determined according to the actual permission of each permission attribute possessed by the client includes:
[0069] Get the actual permission set based on the actual permissions of multiple permission attributes owned by the client;
[0070] When there is a permission conflict in the actual permission collection, the information of the affirmative permission in the permission conflict is deleted in the actual permission collection to obtain a final permission list.
[0071] In this embodiment, if there is a conflict of permissions, the negative permissions take precedence (that is, the permissions of the negative class have a higher priority). For example, for the user with uid 1000, file A is allowed to be deleted. Since file A enters the worm protection state and is not allowed to be deleted, the permission list returned to the client does not allow deletion of file A.
[0072] In one embodiment, before receiving the request information from the client, the method further includes: receiving a login request from the client user, verifying the user identity of the client, and determining whether the user identity of the client is legal.
[0073] In one embodiment, after returning the final permission list to the client, the method further includes:
[0074] Receiving an operation request sent by the client according to the final permission list;
[0075] The operation request is verified according to the final permission list, and the operation request that passes the verification is processed.
[0076] In one embodiment, a CEPH cluster authority consistency management system includes:
[0077] Request information receiving module: used to receive request information from the client, the request information includes: request type, requested operation target, client uid and gid of the group to which the client belongs;
[0078] Permission attribute judgment module: used to judge whether the operation target has the permission attributes of mode permission, posix acl permission, enhanced acl permission and worm permission;
[0079] The final permission list determination module is used to determine the actual permission of each permission attribute owned by the client according to the client uid and the gid of the group to which the client belongs, and determine the client's final permission list according to the determined actual permission of each permission attribute owned by the client;
[0080] Return final permission list module: used to return the final permission list to the client.
[0081] In one embodiment, the system further includes: an identity authentication module: configured to receive a login request from a client user, verify the user identity of the client, and determine whether the user identity of the client is legal.
[0082] In one embodiment, the system further includes an operation request verification module: configured to receive an operation request sent by a client according to the final permission list; verify the operation request according to the final permission list, and process the operation request that passes the verification.
[0083] The advantages of this application are:
[0084] (1) When the client calls the access interface, it has the ability to obtain the operation target mode permission list, posixacl permission list, enhanced acl permission list, and wrom permission. The dynamic acquisition of the permission list can ensure the consistency of permissions and improve the availability and security of the CEPH file system.
[0085] (2) The present invention designs an algorithm for dynamically obtaining a permission list, which determines the actual permission list returned to the client based on the operation type requested by the client, the target directory or target file requested by the client, and the uid / gid in the client request.
[0086] (3) The permission types on the operation target include mode permission, posix acl permission, enhanced acl permission and worm permission. Among them, posix acl, enhanced acl and worm permissions will only be obtained if they are set on the operation target.
[0087] (4) The permission list described in the present invention, wherein the user roles of the permissions include owner, group, other, and also include single uid and gid, and the types of permissions include rwx, and also include delete, traverse, etc.
[0088] For the specific definition of a CEPH cluster permission consistency management system, please refer to the definition of a CEPH cluster permission consistency management method above, which will not be repeated here. Each module in the above-mentioned CEPH cluster permission consistency management system can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.
[0089] In one embodiment, a computer device is provided, which may be a server. The computer device includes a processor, a memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the above-mentioned CEPH cluster permission consistency management method is implemented.
[0090] In one embodiment, a computer program product is also provided, including a computer program / instruction. When the computer program / instruction is executed by a processor, it involves all or part of the process in the above-mentioned embodiment method.
[0091] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).
[0092] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0093] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.
Claims
1. A CEPH cluster authority consistency management method, characterized in that: Applied to a distributed file system, the method comprises: Receive request information from a client, the request information including: request type, requested operation target, client uid, and group gid to which the client belongs; Determine whether the operation target has the permission attributes of mode permission, posix acl permission, enhanced acl permission and worm permission; Determine the actual permission of each permission attribute owned by the client according to the client uid and the gid of the group to which the client belongs, and determine the final permission list of the client according to the actual permission of each permission attribute owned by the client; Returns the final permission list to the client.
2. The CEPH cluster permission consistency management method according to claim 1 is characterized in that: The client's final permission list determined based on the actual permissions of each permission attribute possessed by the client includes: Get the actual permission set based on the actual permissions of multiple permission attributes owned by the client; When there is a permission conflict in the actual permission collection, the information of the affirmative permission in the permission conflict is deleted in the actual permission collection to obtain a final permission list.
3. The CEPH cluster permission consistency management method according to claim 1, characterized in that: Before receiving the request information from the client, the method further includes: receiving a login request from the client user, verifying the user identity of the client, and determining that the user identity of the client is legal.
4. The CEPH cluster permission consistency management method according to claim 1 is characterized in that: The method further includes returning the final permission list to the client: Receiving an operation request sent by the client according to the final permission list; The operation request is verified according to the final permission list, and the operation request that passes the verification is processed.
5. A CEPH cluster authority consistency management system, characterized in that: The system comprises: Request information receiving module: used to receive request information from the client, the request information includes: request type, requested operation target, client uid and gid of the group to which the client belongs; Permission attribute judgment module: used to judge whether the operation target has the permission attributes of mode permission, posix acl permission, enhanced acl permission and worm permission; The final permission list determination module is used to determine the actual permission of each permission attribute owned by the client according to the client uid and the gid of the group to which the client belongs, and determine the client's final permission list according to the determined actual permission of each permission attribute owned by the client; Return final permission list module: used to return the final permission list to the client.
6. The CEPH cluster authority consistency management system according to claim 5, characterized in that: The system further comprises: an identity authentication module: used for receiving a login request from a client user, verifying the user identity of the client, and determining that the user identity of the client is legitimate.
7. The CEPH cluster authority consistency management system according to claim 5, characterized in that: The client's final permission list determined based on the actual permissions of each permission attribute possessed by the client includes: Get the actual permission set based on the actual permissions of multiple permission attributes owned by the client; When there is a permission conflict in the actual permission collection, the information of the affirmative permission in the permission conflict is deleted in the actual permission collection to obtain a final permission list.
8. The CEPH cluster authority consistency management system according to claim 5, characterized in that: The system also includes an operation request verification module: used for receiving an operation request sent by a client according to the final permission list; verifying the operation request according to the final permission list, and processing the operation request that passes the verification.
9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.
10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.