[PATCH v2 0/3] ceph: support subvolume quarantine

[Alex Markuze]

CephFS subvolume quarantine isolates a subvolume while allowing access
by recovery clients with q/Q MDS auth caps. The kernel client currently
does not advertise quarantine support, so the MDS can hold its requests
until quarantine is lifted.

This Ceph-only series handles MClientCaps v14 quarantine notifications,
checks cached data and metadata access, and handles disable notifications.
Fresh MDS replies allow recovery after a lost disable. It applies directly
to the base below and has no fscrypt prerequisite.

Known limitation: cached encrypted symlink targets can bypass quarantine
checks. fscrypt populates inode->i_link, which the VFS can use for readlink
or symlink traversal without calling Ceph's get_link operation. This series
leaves that gap open. Uncached encrypted targets still pass through Ceph's
checks, and plaintext symlinks use the revalidating callback. Closing the
encrypted-target cache gap needs separate fscrypt support and a Ceph opt-in.

The three patches add the wire definitions, record quarantine state and
ancestry generations, then install the access checks before advertising
the session feature. The fscrypt cache opt-out is separate follow-up work.

Changes since v1:
- Keep metadata submission on its normal path, including POSIX and flock
  unlocks. Uncertain async creates and unlinks fall back to the MDS.
- Treat incomplete ancestry as unknown and ask the MDS. Preserve pending
  state across session loss, and use accepted cap replies to recover.
- Skip ancestry walks when no inode is marked. Cache complete RCU walks
  by generation, bound retries, and invalidate across parent changes
  without holding an odd generation over sleeping LSM hooks.
- Scope MDS read confirmations to the exact inode, credentials and
  generation. Authorize writes separately with a mode-specific OPEN.
- Check cached ACL, plaintext symlink, directory, attribute, ioctl and mmap
  paths. Authorize snapshot operations with a fresh MDS request; preserve
  connected snapshot paths and validate exact inode/snapshot replies.
- Keep nonblocking cap checks free of RPCs and release locked folios
  before blocking revalidation.

Validation: W=1 Ceph/libceph object builds on x86-64 with ACL, encryption,
inline data and fscache enabled and disabled, and on i386 with ACL and
encryption enabled. Seven deterministic source-extraction regression
runners pass. The ASan/UBSan/LSan VFS runner also demonstrates the remaining
cached encrypted-readlink bypass; it does not claim that gap is fixed.
Live cluster, KASAN/lockdep, multi-MDS recovery and depth benchmarks have
not been run for this version.

Protocol limits: existing snapshot mappings need server notifications
to revoke already installed PTEs. Disable messages carry no generation,
so same-rank ordering relies on ordered MDS delivery. Recovery assumes
the intended rwq/rwQ delegation; overlapping ordinary rw and read-only
q/Q grants still need server-side cap filtering.

Alex Markuze (3):
  ceph: add subvolume quarantine wire definitions
  ceph: record subvolume quarantine from MDS cap updates
  ceph: fail quarantined subvolume access with EACCES

 fs/ceph/acl.c                |  28 +-
 fs/ceph/addr.c               |  72 ++-
 fs/ceph/caps.c               | 291 +++++++++++-
 fs/ceph/debugfs.c            |   1 +
 fs/ceph/dir.c                |  51 ++-
 fs/ceph/file.c               | 117 +++--
 fs/ceph/inode.c              | 841 ++++++++++++++++++++++++++++++++++-
 fs/ceph/ioctl.c              |  13 +
 fs/ceph/mds_client.c         |  23 +-
 fs/ceph/mds_client.h         |  26 +-
 fs/ceph/super.c              |   2 +
 fs/ceph/super.h              |  80 +++-
 fs/ceph/xattr.c              |  54 ++-
 include/linux/ceph/ceph_fs.h |  13 +
 net/ceph/ceph_common.c       |   2 +
 15 files changed, 1481 insertions(+), 133 deletions(-)


base-commit: ed0502cb11f84fff29f374238e526ae94d9bdfde
-- 
2.34.1