i/b/microceph-support: add user-identity-switching plug attribute - #17385
Open
UtkarshBhatthere wants to merge 1 commit into
Open
i/b/microceph-support: add user-identity-switching plug attribute#17385UtkarshBhatthere wants to merge 1 commit into
UtkarshBhatthere wants to merge 1 commit into
Conversation
UtkarshBhatthere
force-pushed
the
microceph-support-identity-switching
branch
from
July 20, 2026 10:22
c0f2a4a to
d075631
Compare
|
Fri Jul 24 19:01:54 UTC 2026 Failures:Preparing:
Executing:
Restoring:
Skipped tests from snapd-testing-skipIf you wish to have any of the below tests run in your PR, in your PR description, add 'unskip:' followed by a copy-and-pasted list of the below tests you wish to run (unskip plus test list must be valid yaml)
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #17385 +/- ##
==========================================
+ Coverage 78.92% 79.23% +0.31%
==========================================
Files 1397 1407 +10
Lines 195988 199867 +3879
Branches 2466 2561 +95
==========================================
+ Hits 154688 158374 +3686
- Misses 32013 32086 +73
- Partials 9287 9407 +120
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
UtkarshBhatthere
changed the title
UtkarshBhatthere
force-pushed
the
microceph-support-identity-switching
branch
from
July 20, 2026 11:24
d075631 to
20ae5ef
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends the microceph-support interface to support strictly confined Samba (smbd) use cases that require per-session identity changes (setuid/setgid + non-zero-length setgroups), by adding an opt-in plug attribute that grants the minimal additional AppArmor/seccomp permissions only to apps that bind the attribute-carrying plug.
Changes:
- Add a boolean plug attribute
identity-switchingtomicroceph-support. - When
identity-switching: true, grant AppArmorcapability setuid/capability setgidand seccompsetgroups/setgroups32to the connected plug. - Add unit tests covering: default behavior unchanged,
identity-switching: truegrants added policy,identity-switching: falsebehaves like absent, and invalid values are rejected.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| interfaces/builtin/microceph_support.go | Adds the identity-switching attribute handling, including AppArmor/seccomp conditional policy and plug attribute validation. |
| interfaces/builtin/microceph_support_test.go | Adds tests verifying attribute sanitization and per-app policy application for both AppArmor and seccomp. |
pedronis
added
the
Needs security review
bboozzoo
approved these changes
Jul 20, 2026
bboozzoo
left a comment
bboozzoo
left a comment
Contributor
There was a problem hiding this comment.
The change looks good to me. The interface is already superprivileged and the changes match the intended use case.
MicroCeph ships Samba inside its strictly confined snap to serve CephFS-backed SMB shares. smbd's per-session impersonation model requires switching process identity (setuid/setgid and setgroups with a real supplementary group list) on every identity transition, and under strict confinement it hard-panics at startup (PANIC: sys_setgroups failed in init_guest_session_info). The default seccomp template only allows the zero-length clear-groups form of setgroups, and no suitable interface grants CAP_SETUID/CAP_SETGID. Extend microceph-support with an opt-in boolean plug attribute, user-identity-switching, following the docker-support privileged-containers pattern. When true, the connected plug additionally gets AppArmor capability setuid/setgid and seccomp setgroups/setgroups32. Plugs without the attribute (or with it set to false) get exactly the previous policy, so the existing daemon/osd/rbd apps of the microceph snap are unaffected; only the smbd app, bound to a second attribute-carrying plug of this interface, gains the user-identity-switching policy. Verified on a MicroCeph test cluster: patching exactly these grants into a node's generated profiles makes strict-mode smbd fully functional serving CephFS shares via vfs_ceph. Assisted-by: claude-code:claude-fable-5 Signed-off-by: Utkarsh Bhatt <utkarsh_bhatt@outlook.com>
UtkarshBhatthere
force-pushed
the
microceph-support-identity-switching
branch
from
July 21, 2026 05:53
20ae5ef to
7fde758
Compare
UtkarshBhatthere
changed the title
github-actions
Bot
added
the
Auto rerun spread
jslarraz
removed
the
Needs security review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
MicroCeph ships Samba inside its strictly confined snap to serve CephFS-backed SMB shares. smbd's per-session impersonation model requires switching process identity (setuid/setgid, and setgroups with a real supplementary group list) on every identity transition, and under strict confinement it hard-panics at startup (
PANIC: sys_setgroups failedininit_guest_session_info), so the snap currently needs--devmodefor SMB. Two things block it: the default seccomp template only allows the zero-length clear-groups form ofsetgroups, and no suitable interface grantsCAP_SETUID/CAP_SETGID.This PR extends
microceph-supportwith an opt-in boolean plug attribute,user-identity-switching, following theprivileged-containerspattern fromdocker-support. When true, the connected plug additionally gets AppArmorcapability setuid/capability setgidand seccompsetgroups/setgroups32. Plugs without the attribute get exactly the previous policy, and connected-plug policy is applied per app binding the plug, so the microceph snap's existingdaemon/osd/rbdapps are unaffected; only thesmbdapp, bound to a second attribute-carrying plug of this interface, gains the user-identity-switching policy.Deliberately not granted:
dac_override/dac_read_search(after impersonation smbd accesses files as the target user) and any file rules.Verified on a MicroCeph test cluster: patching exactly these grants into a node's generated profiles made strict-mode smbd fully functional serving CephFS shares via vfs_ceph.
Forum discussion: https://forum.snapcraft.io/t/proposal-extend-the-existing-microceph-support-interface-with-an-user-identity-switching-plug-attribute/52389
🤖 Generated with Claude Code
https://claude.ai/code/session_01QTH2xQMoRkykWfnGqp6xKK