Strictly validate lctl set_param parameter keys against allowlist in upcall server

[amacaskill]

What this PR does

Enforces strict security allowlist validation in the upcall IPC server for lctl set_param parameter keys executed on behalf of the host Lustre kernel/udev proxy on Container-Optimized OS (COS) nodes.

Context & Motivation

On COS nodes, Lustre kernel udev events and IAM upcalls communicate with the privileged CSI driver container over a Unix domain socket (ipc.sock). While lctl set_param is an authorized subcommand, unrestricted parameter setting poses a security risk because attackers could configure kernel upcall binary paths (e.g. ptlrpc.*.upcall, mdt.*.identity_upcall, osc.*.upcall) that execute as root on the host.

Implementation Details

Following review and confirmation with Lustre performance experts:

1. Allowlisted Subsystems: Parameter keys are restricted to the four core client subsystems:
   • osc.*: Object Storage Client tunables (e.g. osc.*.max_dirty_mb, max_rpcs_in_flight, checksums) and dynamic mount target connections (osc.<fs>-<target>-osc-<addr>.import).
   • mdc.*: Metadata Client tunables (mdc.*.max_rpcs_in_flight) and dynamic target connections (mdc.<fs>-<target>-mdc-<addr>.import).
   • llite.*: Client VFS/caching tunables (llite.*.max_read_ahead_mb, enable_compression, opencache_*, statahead_*).
   • ldlm.*: Lustre Distributed Lock Manager namespace tunables (ldlm.namespaces.*.lru_size, ldlm.*.*mdc*.lru_max_age).
2. Flag Disallowal: Options/flags (such as -n and -P) are rejected because client nodes on GKE do not require them (-P is exclusive to MGS persistent configs).
3. Defense in Depth: Explicitly blocks any parameter key containing the upcall keyword.
4. Test Coverage: Unit test and manual local test

[gemini-code-assist]

Code Review

This pull request introduces strict argument validation for the lctl set_param command to prevent unauthorized upcall configurations and path traversals. Feedback focuses on a critical security vulnerability where attackers could bypass the upcall substring check using globbing/wildcard characters or backslashes. It is recommended to disallow backslashes in the parameter key and restrict globbing characters in the final component of the parameter name, as well as to add robust test cases covering these bypass scenarios.

[tyuchn]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces stricter argument validation for the lctl set_param command by restricting parameter keys to specific allowed prefixes (osc., mdc., llite., ldlm.) and blocking keys containing the substring "upcall". It also adds comprehensive unit tests to verify these validation rules. The review feedback identifies a critical security vulnerability where the "upcall" block can be bypassed using wildcard characters (e.g., up*all) that lctl expands. It is recommended to explicitly disallow wildcard characters in the final parameter name component and to add corresponding test cases to verify this behavior.