<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
On Jan 26, 2020, at 15:15, Hans Henrik Happe <<a href="mailto:happe@nbi.dk" class="">happe@nbi.dk</a>> wrote:<br class="">
<div>
<blockquote type="cite" class=""><br class="Apple-interchange-newline">
<div class="">
<div class="">Hi,<br class="">
<br class="">
When looking into the documentation (28.2.1) and also while testing, it<br class="">
seems that it is not possible to give a tenant access to a fileset like<br class="">
it was a regular lustre fs.<br class="">
<br class="">
I would like to map IDs to a separate range including root (0). This<br class="">
works when admin=0 for the nodemap, but then root will not be able to<br class="">
modify other user's files. In admin=1 mode, root is not mapped and will<br class="">
become id 0 on the underlying fs.<br class="">
<br class="">
Have I missed a way to accomplish this? If not it would be on my<br class="">
wishlist. Mapping ranges is also on that list.<br class="">
</div>
</div>
</blockquote>
<div><br class="">
</div>
My understanding is that if root is mapped, and admin=0, then the "root"</div>
<div>user on the client node could still use client-side access to impersonate</div>
<div>other users (e.g. "su - user -c command", assuming that "user" is part of</div>
<div>the nodemap for that client), and perform other commands locally.</div>
<div><br class="">
</div>
<div>This does not extend to the filesystem operations themselves, because</div>
<div>that would make containers insecure as "root" within the container image</div>
<div>could perform any action they wanted.</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">
<div class="">I could also see a lot of quota control scenarios for this kind of<br class="">
setup. I.e. allow to control quotas for mapped UIDs and GIDs, but not<br class="">
others.<br class="">
</div>
</div>
</blockquote>
</div>
<div class=""><br class="">
</div>
<div class="">That likely needs some other kind of permission granting, which does not</div>
<div class="">exist today. Otherwise, again "root" users in a container could assign any</div>
<div class="">quota they like, which is probably not what most sysadmins want.</div>
<div class=""><br class="">
</div>
<div class="">You _might_ be able to use project quotas to handle this within the nodemap,</div>
<div class="">but it isn't clear what you want to do in the end.</div>
<br class="">
<div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div>Cheers, Andreas</div>
<div>--</div>
<div>Andreas Dilger</div>
<div>Principal Lustre Architect</div>
<div>Whamcloud</div>
<div><br class="">
</div>
<div><br class="">
</div>
<div><br class="">
</div>
</div>
</div>
</div>
</div>
</div>
<br class="Apple-interchange-newline">
<br class="Apple-interchange-newline">
</div>
<br class="">
</body>
</html>