[pve-devel] [PATCH pve-manager v2] fix #7011: ceph monitor: set ownership of monitor logs

[Dominik Rusovac]

gentle ping, still applies to master branch
On Wednesday, 12/17/2025, 09:38, Dominik Rusovac <d.rusovac at proxmox.com> wrote:

>From : Dominik Rusovac <d.rusovac at proxmox.com>
Sent on : Wednesday, 12/17/2025, 09:38
To : pve-devel at lists.proxmox.com
Cc : Dominik Rusovac <d.rusovac at proxmox.com>
Subject : [PATCH pve-manager v2] fix #7011: ceph monitor: set ownership of monitor logs
Ownership of the ceph monitor log file is now set to ceph:ceph after the
creation of a new monitor and before the new monitor starts. Hence,
effective ceph monitor logging on freshly set up ceph clusters no longer
depends on the first upgrade of ceph-common.

For setups (still) affected by #7011 it is required that ownership of
the ceph monitor log file is set to ceph:ceph (either manually or due to
some ceph-common upgrade), followed by a monitor restart.

Signed-off-by: Dominik Rusovac <d.rusovac at proxmox.com>
---
 PVE/API2/Ceph/MON.pm [http://mon.pm/] | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/PVE/API2/Ceph/MON.pm [http://mon.pm/] b/PVE/API2/Ceph/MON.pm [http://mon.pm/]
index 70fc158d..18407b1c 100644
--- a/PVE/API2/Ceph/MON.pm [http://mon.pm/]
+++ b/PVE/API2/Ceph/MON.pm [http://mon.pm/]
@@ -428,6 +428,15 @@ __PACKAGE__->register_method({
                             $mon_keyring,
                         ]);
                         run_command(['chown', 'ceph:ceph', '-R', $mondir]);
+
+                        eval {
+                            # fix-up initial log file from freshly created monitor here, as currently
+                            # we cannot instruct ceph-mon to create it with the correct ownership without
+                            # losing access to the mon keyring inside pmxcfs.
+                            run_command(
+                                ['chown', 'ceph:ceph', "/var/log/ceph/ceph-mon.$monid.log"]);
+                        };
+                        warn "$@" if $@;
                     };
                     my $err = $@;
                     unlink $monmap;
-- 
2.47.3