Siyao Meng created HDDS-16842:
---------------------------------
Summary: Check admin rights in the OM bootstrap RPC handler,
consistent with decommission and getOMConfiguration
Key: HDDS-16842
URL: https://issues.apache.org/jira/browse/HDDS-16842
Project: Apache Ozone
Issue Type: Bug
Reporter: Siyao Meng
Attachments: CR-7-check-admin-rights-in-om-bootstrap-rpc.patch
h3. Mechanism
{{OMAdminProtocolServerSideImpl.decommission}} and
{{OMAdminProtocolServerSideImpl.getOMConfiguration}} check
{{isAdminAuthorizationEnabled() && !isAdmin(getRemoteUser())}} before they act.
{{OMInterServiceProtocolServerSideImpl.bootstrap}}, the other membership call
of the OM, checks {{OzoneManagerRatisUtils.checkLeaderStatus}} only. The
attached patch adds the same check to it, so that the three calls are
consistent.
h3. Impact
A consistency gap between the handlers. This is not a report of a reproduced
failure.
A new OM sends the bootstrap request as the user that runs the OMs, which is an
administrator. A normal bootstrap already depends on that, because it calls
{{getOMConfiguration}} on every existing OM first. A bootstrap that works today
is therefore not affected (code reading, and
{{TestAddRemoveOzoneManager.testBootstrap}} with admin authorization enabled).
With admin authorization disabled the new check does nothing.
h3. Reproduction
There is no separate reproduction. The regression test in the patch is the
evidence.
h3. Patch
[^CR-7-check-admin-rights-in-om-bootstrap-rpc.patch], against
7fcf31294859d5d31163e016b5a9a63f21c6edd2. It also applies to master at
1cc6423590f (not built there).
{{OMInterServiceProtocolServerSideImpl.bootstrap}} throws {{OMException}} with
{{PERMISSION_DENIED}} and "Only administrators are authorized to perform
bootstrap." inside its existing try block when {{isAdminAuthorizationEnabled()
&& !isAdmin(getRemoteUser())}}. The existing catch returns it as a
{{RATIS_BOOTSTRAP_ERROR}} response. No config, request or proto change.
Covered by {{bootstrapNonAdminIsDenied}} in the existing
{{TestOMAdminRpcAuthorization}}, which expects that message for a caller
without admin rights and fails on the unfixed commit.
{{TestAddRemoveOzoneManager.testBootstrap}} now runs with admin authorization
enabled, so real OMs join through the new check. With the patch
{{TestOMAdminRpcAuthorization}} (5 tests),
{{TestOMAdminProtocolServerSideImpl}} (1 test),
{{TestOMInstallSnapshotDuringBootstrapping}} (1 test) and
{{TestAddRemoveOzoneManager}} (8 tests) pass, and checkstyle is clean on both
modules.
Found by code review of the OM HA membership change paths (bootstrap,
decommission and leader transfer), as part of the TLA+ verification effort
under HDDS-15926, on commit 7fcf31294859d5d31163e016b5a9a63f21c6edd2. Checked
against HDDS issues and apache/ozone pull requests for duplicates before
filing. The attached patch is a proposal for review. Generated with Specula
(Claude Opus 5.5).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
