Bug #63791: RGW: a subuser with no permission can still list buckets and create buckets - rgw - Ceph

Actions

Bug #63791

open

RGW: a subuser with no permission can still list buckets and create buckets

Added by Huy Nguyen over 2 years ago. Updated about 1 year ago.

Status:

New

Priority:

Normal

Assignee:

Shreyansh Sancheti

Target version:

% Done:

0%

Source:

Community (user)

Backport:

reef squid

Regression:

No

Severity:

3 - minor

Reviewed:

Affected Versions:

ceph-qa-suite:

Pull request ID:

Tags (freeform):

Merge Commit:

Fixed In:

Released In:

Upkeep Timestamp:

Description

Hi,
I just found out a subuser with no permission can still list buckets and create buckets. Is it a bug or a feature? Because as I know, this issue has been there for a long time

Related issues 4 (1 open — 3 closed)

Actions

#1

Updated by Casey Bodley over 2 years ago

is this with s3? subusers were invented for swift, so the interactions with s3 have never been well-defined

Actions

#2

Updated by hoan nv over 2 years ago

Casey Bodley wrote:

is this with s3? subusers were invented for swift, so the interactions with s3 have never been well-defined

I have same problem.

From 14 ceph versions, ceph rgw can assign permission to s3 subuser. It is a helpful feature.

So if this feature can improve, it will be great.

Actions

#3

Updated by Shreyansh Sancheti over 2 years ago

Assignee set to Shreyansh Sancheti

Actions

#4

Updated by Shreyansh Sancheti over 2 years ago

Status changed from New to Need More Info

Casey Bodley wrote:

is this with s3? subusers were invented for swift, so the interactions with s3 have never been well-defined

So a subuser with no permission should be able to do what operations? I mean it should not be able to list buckets and create new ones is that the request?.

Actions

#5

Updated by hoan nv over 2 years ago

Shreyansh Sancheti wrote:

Casey Bodley wrote:

is this with s3? subusers were invented for swift, so the interactions with s3 have never been well-defined

So a subuser with no permission should be able to do what operations? I mean it should not be able to list buckets and create new ones is that the request?.

subuser with no permission should not able to do anything.

Actions

#6

Updated by Shreyansh Sancheti about 2 years ago

Status changed from Need More Info to In Progress

Actions

#7

Updated by Shreyansh Sancheti about 2 years ago

Pull request ID set to 55661

Actions

#8

Updated by Daniel Gryniewicz almost 2 years ago

Status changed from In Progress to Fix Under Review

Actions

#9

Updated by Casey Bodley almost 2 years ago

Status changed from Fix Under Review to Resolved

Actions

#10

Updated by hoan nv almost 2 years ago

This commit can be backported to quincy reef ?

Actions

#11

Updated by Pierre Riteau almost 2 years ago

I believe this is also an issue for subusers with read permissions: they can still create buckets (at least on Quincy 17.2.6).

Actions

#12

Updated by Konstantin Shalygin almost 2 years ago

Status changed from Resolved to Pending Backport
Target version set to v20.0.0
Source set to Community (user)
Backport set to quincy reef squid

Actions

#13

Updated by Konstantin Shalygin almost 2 years ago

hoan nv wrote in #note-10:

This commit can be backported to quincy reef ?

I revert status from resolved, now is possible

Actions

#14

Updated by Upkeep Bot almost 2 years ago

Copied to Backport #65960: quincy: RGW: a subuser with no permission can still list buckets and create buckets added

Actions

#15

Updated by Upkeep Bot almost 2 years ago

Copied to Backport #65961: reef: RGW: a subuser with no permission can still list buckets and create buckets added

Actions

#16

Updated by Upkeep Bot almost 2 years ago

Copied to Backport #65962: squid: RGW: a subuser with no permission can still list buckets and create buckets added

Actions

#18

Updated by Casey Bodley over 1 year ago

Status changed from Pending Backport to New
Pull request ID deleted (~~55661~~)

https://github.com/ceph/ceph/pull/55661 was reverted as part of https://github.com/ceph/ceph/pull/54333, moving status back to New

Actions

#19

Updated by J. Eric Ivancich about 1 year ago

Do we need to look at this again? A duplicate was just reported.

Actions

#20

Updated by J. Eric Ivancich about 1 year ago

Has duplicate Bug #69104: RGW: a subuser with no permission can still get and edit Versioning, object lock, cors on buckets added

Actions

#21

Updated by Konstantin Shalygin about 1 year ago

Backport changed from quincy reef squid to reef squid

Actions

Also available in: Atom PDF