Skip to content

RGW: a subuser with no permission can still list buckets and create buckets#55661

Merged
cbodley merged 1 commit intoceph:mainfrom
shreyanshjain7174:tracker_63791
Apr 10, 2024
Merged

RGW: a subuser with no permission can still list buckets and create buckets#55661
cbodley merged 1 commit intoceph:mainfrom
shreyanshjain7174:tracker_63791

Conversation

@shreyanshjain7174
Copy link

@shreyanshjain7174 shreyanshjain7174 commented Feb 20, 2024

A S3 subuser having no permissions was able to do a normal user ops, from aws docs there's no functionality for a s3 subuser as we do have with swift. The fix here is to check the "subuser perm mask" before going forward with "no_acl" check.

Fixes: https://tracker.ceph.com/issues/63791

Contribution Guidelines

  • To sign and title your commits, please refer to Submitting Patches to Ceph.

  • If you are submitting a fix for a stable branch (e.g. "quincy"), please refer to Submitting Patches to Ceph - Backports for the proper workflow.

  • When filling out the below checklist, you may click boxes directly in the GitHub web UI. When entering or editing the entire PR message in the GitHub web UI editor, you may also select a checklist item by adding an x between the brackets: [x]. Spaces and capitalization matter when checking off items this way.

Checklist

  • Tracker (select at least one)
    • References tracker ticket
    • Very recent bug; references commit where it was introduced
    • New feature (ticket optional)
    • Doc update (no ticket needed)
    • Code cleanup (no ticket needed)
  • Component impact
    • Affects Dashboard, opened tracker ticket
    • Affects Orchestrator, opened tracker ticket
    • No impact that needs to be tracked
  • Documentation (select at least one)
    • Updates relevant documentation
    • No doc update is appropriate
  • Tests (select at least one)
Show available Jenkins commands
  • jenkins retest this please
  • jenkins test classic perf
  • jenkins test crimson perf
  • jenkins test signed
  • jenkins test make check
  • jenkins test make check arm64
  • jenkins test submodules
  • jenkins test dashboard
  • jenkins test dashboard cephadm
  • jenkins test api
  • jenkins test docs
  • jenkins render docs
  • jenkins test ceph-volume all
  • jenkins test ceph-volume tox
  • jenkins test windows
  • jenkins test rook e2e

RGW: a subuser with no permission can still list buckets and create b…
3cc27f0 
…uckets

A S3 subuser having no permissions was able to do a normal user ops,
from aws docs there's no functionality for a s3 subuser as we do have
with swift. The fix here is to check the "subuser perm mask" before going
forward with "no_acl" check.

Fixes: https://tracker.ceph.com/issues/63791
Signed-off-by: Shreyansh Sancheti <ssanchet@redhat.com>
@shreyanshjain7174 shreyanshjain7174 self-assigned this Feb 20, 2024
@shreyanshjain7174 shreyanshjain7174 requested a review from a team as a code owner February 20, 2024 06:36
@shreyanshjain7174
Copy link
Author

shreyanshjain7174 commented Mar 23, 2024

jenkins test make check

@cbodley
Copy link
Contributor

cbodley commented Apr 10, 2024

passed qa in https://pulpito.ceph.com/cbodley-2024-04-09_13:16:23-rgw-wip-cbodley-testing-distro-default-smithi/

@cbodley cbodley merged commit aca3376 into ceph:main Apr 10, 2024
@cbodley
Copy link
Contributor

cbodley commented Apr 11, 2024

this broke permissions in #54333 which is a high priority for the squid release, so i've opened #56838 to revert for now

@cbodley cbodley mentioned this pull request Apr 11, 2024
Merged
52 tasks
@cbodley
Copy link
Contributor

cbodley commented Apr 11, 2024

this broke permissions in #54333 which is a high priority for the squid release, so i've opened #56838 to revert for now

@shreyanshjain7174 to expand on this, the value of this perm argument comes from rgw::IAM::op_to_perm() in rgw_iam_policy.h. this function only maps the permissions of s3 actions: https://github.com/ceph/ceph/blob/62ed3a0/src/rgw/rgw_iam_policy.h#L256-L259

non-s3 actions map to RGW_PERM_INVALID. these requests had previously succeeded because of the "S3 doesn't support account ACLs, so user_acl will be uninitialized" case that was moved by this pr. after this change, these requests now fail

before we can apply this fix for subusers, we would need to update op_to_perm() to cover all of these actions too: https://github.com/ceph/ceph/blob/62ed3a0/src/rgw/rgw_iam_policy.h#L115-L149 (and note that #54333 adds several more)

@shreyanshjain7174
Copy link
Author

shreyanshjain7174 commented Apr 13, 2024

Got it, Thanks! @cbodley for the detailed explanation, will be sure to look after the merge of users account implementation.

@shreyanshjain7174 shreyanshjain7174 deleted the tracker_63791 branch July 18, 2024 05:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@thotz thotz thotz approved these changes

@cbodley cbodley Awaiting requested review from cbodley

@mkogan1 mkogan1 Awaiting requested review from mkogan1

Assignees

@shreyanshjain7174 shreyanshjain7174

Labels

needs-qa rgw wip-cbodley-testing

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@shreyanshjain7174 @cbodley @thotz