void MonCapGrant::expand_profile_mon(const EntityName& name) const
{
  if (profile == "mon") {
    profile_grants.push_back(MonCapGrant("mon", MON_CAP_ALL));
    profile_grants.push_back(MonCapGrant("log", MON_CAP_ALL));
  }
  if (profile == "osd") {
    profile_grants.push_back(MonCapGrant("osd", MON_CAP_ALL));
    profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
    profile_grants.push_back(MonCapGrant("pg", MON_CAP_R | MON_CAP_W));
    profile_grants.push_back(MonCapGrant("log", MON_CAP_W));
  }
  if (profile == "mds") {
    profile_grants.push_back(MonCapGrant("mds", MON_CAP_ALL));
    profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
    profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));
    // This command grant is checked explicitly in MRemoveSnaps handling
    profile_grants.push_back(MonCapGrant("osd pool rmsnap"));
    profile_grants.push_back(MonCapGrant("osd blacklist"));
    profile_grants.push_back(MonCapGrant("log", MON_CAP_W));
  }
  if (profile == "mgr") {
    profile_grants.push_back(MonCapGrant("mgr", MON_CAP_ALL));
    profile_grants.push_back(MonCapGrant("log", MON_CAP_R | MON_CAP_W));
    profile_grants.push_back(MonCapGrant("mon", MON_CAP_R | MON_CAP_W));
    profile_grants.push_back(MonCapGrant("mds", MON_CAP_R | MON_CAP_W));
    profile_grants.push_back(MonCapGrant("osd", MON_CAP_R | MON_CAP_W));
    profile_grants.push_back(MonCapGrant("auth", MON_CAP_R | MON_CAP_X));
    profile_grants.push_back(MonCapGrant("config-key", MON_CAP_R | MON_CAP_W));
    profile_grants.push_back(MonCapGrant("config", MON_CAP_R | MON_CAP_W));
  }
  if (profile == "osd" || profile == "mds" || profile == "mon" ||
      profile == "mgr") {
    StringConstraint constraint(StringConstraint::MATCH_TYPE_PREFIX,
                                string("daemon-private/") + stringify(name) +
                                string("/"));
    string prefix = string("daemon-private/") + stringify(name) + string("/");
    profile_grants.push_back(MonCapGrant("config-key get", "key", constraint));
    profile_grants.push_back(MonCapGrant("config-key put", "key", constraint));
    profile_grants.push_back(MonCapGrant("config-key set", "key", constraint));
    profile_grants.push_back(MonCapGrant("config-key exists", "key", constraint));
    profile_grants.push_back(MonCapGrant("config-key delete", "key", constraint));
  }
  if (profile == "bootstrap-osd") {
    profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));  // read monmap
    profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));  // read osdmap
    profile_grants.push_back(MonCapGrant("mon getmap"));
    profile_grants.push_back(MonCapGrant("osd new"));
    profile_grants.push_back(MonCapGrant("osd purge-new"));
  }
  if (profile == "bootstrap-mds") {
    profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));  // read monmap
    profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));  // read osdmap
    profile_grants.push_back(MonCapGrant("mon getmap"));
    profile_grants.push_back(MonCapGrant("auth get-or-create"));  // FIXME: this can expose other mds keys
    profile_grants.back().command_args["entity"] = StringConstraint(
      StringConstraint::MATCH_TYPE_PREFIX, "mds.");
    profile_grants.back().command_args["caps_mon"] = StringConstraint(
      StringConstraint::MATCH_TYPE_EQUAL, "allow profile mds");
    profile_grants.back().command_args["caps_osd"] = StringConstraint(
      StringConstraint::MATCH_TYPE_EQUAL, "allow rwx");
    profile_grants.back().command_args["caps_mds"] = StringConstraint(
      StringConstraint::MATCH_TYPE_EQUAL, "allow");
  }
  if (profile == "bootstrap-mgr") {
    profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));  // read monmap
    profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));  // read osdmap
    profile_grants.push_back(MonCapGrant("mon getmap"));
    profile_grants.push_back(MonCapGrant("auth get-or-create"));  // FIXME: this can expose other mgr keys
    profile_grants.back().command_args["entity"] = StringConstraint(
      StringConstraint::MATCH_TYPE_PREFIX, "mgr.");
    profile_grants.back().command_args["caps_mon"] = StringConstraint(
      StringConstraint::MATCH_TYPE_EQUAL, "allow profile mgr");
  }
  if (profile == "bootstrap-rgw") {
    profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));  // read monmap
    profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));  // read osdmap
    profile_grants.push_back(MonCapGrant("mon getmap"));
    profile_grants.push_back(MonCapGrant("auth get-or-create"));  // FIXME: this can expose other mds keys
    profile_grants.back().command_args["entity"] = StringConstraint(
      StringConstraint::MATCH_TYPE_PREFIX, "client.rgw.");
    profile_grants.back().command_args["caps_mon"] = StringConstraint(
      StringConstraint::MATCH_TYPE_EQUAL, "allow rw");
    profile_grants.back().command_args["caps_osd"] = StringConstraint(
      StringConstraint::MATCH_TYPE_EQUAL, "allow rwx");
  }
  if (profile == "bootstrap-rbd") {
    profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));  // read monmap
    profile_grants.push_back(MonCapGrant("auth get-or-create"));  // FIXME: this can expose other mds keys
    profile_grants.back().command_args["entity"] = StringConstraint(
      StringConstraint::MATCH_TYPE_PREFIX, "client.");
    profile_grants.back().command_args["caps_mon"] = StringConstraint(
      StringConstraint::MATCH_TYPE_EQUAL, "profile rbd");
    profile_grants.back().command_args["caps_osd"] = StringConstraint(
      StringConstraint::MATCH_TYPE_REGEX,
      "^([ ,]*profile(=|[ ]+)['\"]?rbd[^ ,'\"]*['\"]?([ ]+pool(=|[ ]+)['\"]?[^,'\"]+['\"]?)?)+$");
  }
  if (profile == "fs-client") {
    profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
    profile_grants.push_back(MonCapGrant("mds", MON_CAP_R));
    profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));
    profile_grants.push_back(MonCapGrant("pg", MON_CAP_R));
  }
  if (profile == "simple-rados-client") {
    profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
    profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));
    profile_grants.push_back(MonCapGrant("pg", MON_CAP_R));
  }
  if (profile == "rbd") {
    profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
    profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));
    profile_grants.push_back(MonCapGrant("pg", MON_CAP_R));

    // exclusive lock dead-client blacklisting (IP+nonce required)
    profile_grants.push_back(MonCapGrant("osd blacklist"));
    profile_grants.back().command_args["blacklistop"] = StringConstraint(
      StringConstraint::MATCH_TYPE_EQUAL, "add");
    profile_grants.back().command_args["addr"] = StringConstraint(
      StringConstraint::MATCH_TYPE_REGEX, "^[^/]+/[0-9]+$");
  }

  if (profile == "role-definer") {
    // grants ALL caps to the auth subsystem, read-only on the
    // monitor subsystem and nothing else.
    profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
    profile_grants.push_back(MonCapGrant("auth", MON_CAP_ALL));
  }
}