Capability semantics: r, w, x, and scoping

Why this matters in production

The difference between allow rw and allow rwx is not obvious from the letters, and the difference between granting on a pool and granting on a namespace is the difference between a tenant boundary and a suggestion. This is where capability strings stop being syntax and start being policy.

The permissions

x is the one that surprises. Class methods are server-side operations that RADOS classes expose — RBD image management, lock operations, RGW bucket index operations. An RBD client needs x for snapshot and lock handling. A client that only reads and writes plain objects does not.

# plain object storage — no class methods needed
osd 'allow rw pool=simple-data'

# RBD — needs class methods
osd 'allow rwx pool=rbd-vms'

Pool scoping

osd 'allow rwx pool=rbd-vms'
osd 'allow rwx pool=rbd-vms, allow r pool=rbd-templates'

Comma-separated clauses accumulate. This is the standard scoping unit and it maps directly onto how most people think about isolation.

Namespace scoping

Namespaces partition a pool without creating separate pools:

osd 'allow rwx pool=shared-data namespace=tenant-a'

Tenant A can read and write only objects in its namespace, even though tenant B’s objects live in the same pool. This avoids the PG overhead of a pool per tenant while keeping the access boundary real.

rados -p shared-data -N tenant-a put obj1 file
rados -p shared-data -N tenant-a ls

Object prefix scoping

osd 'allow rw pool=app-data object_prefix rbd_data.1f2a3b'

Restricts access to objects whose names begin with the prefix. Useful for granting access to a single RBD image within a shared pool, though namespaces are usually the cleaner mechanism.

Composing a minimal capability

Requirement: a backup agent that reads all VM images and writes only to the backup pool.

ceph auth get-or-create client.backup-agent \
    mon 'profile rbd' \
    osd 'profile rbd-read-only pool=rbd-vms, allow rwx pool=backup-data'

Read-only where it reads, read-write where it writes, nothing anywhere else. The read-only RBD profile is more precise than allow r because it grants exactly the class methods a read path needs.

Quiz

Production discipline

Write capabilities clause by clause from the stated requirement rather than adapting an existing entity’s grant, since adapted grants carry permissions nobody re-justified. Prefer namespaces over object prefixes for tenant separation — they are enforced identically but are far harder to get wrong.

Cross-course references

• Kubernetes: RBAC verbs and resource scoping map almost one-to-one onto this model
• Linux: POSIX permission bits and path scoping express the same two-dimensional idea