Siyao Meng created HDDS-17097:
---------------------------------
Summary: Require LIST on the bucket for bucket level listStatus
and snapshot diff
Key: HDDS-17097
URL: https://issues.apache.org/jira/browse/HDDS-17097
Project: Apache Ozone
Issue Type: Improvement
Components: Ozone Manager
Reporter: Siyao Meng
Assignee: Siyao Meng
Bucket level listings check different ACL rights depending on the API.
{{listKeys}} and {{listSnapshotDiffJobs}} check LIST on the bucket, while
{{listStatus}} and {{listStatusLight}} with an empty key name (the bucket
root), and {{snapshotDiff}} and {{submitSnapshotDiff}}, check READ on the
bucket.
This change makes them consistent:
- {{listStatus}} and {{listStatusLight}} check LIST instead of READ when the
key name is empty. Listing a directory keeps checking READ on that path.
- {{snapshotDiff}} and {{submitSnapshotDiff}} check LIST on the resolved bucket
instead of READ. {{cancelSnapshotDiff}} is unchanged.
Compatibility:
- No protocol or layout change.
- A principal that has READ but not LIST on a bucket can no longer list the
bucket root through the filesystem interfaces ({{ozone fs -ls}}, ofs, and key
listing of FSO buckets, including S3 ListObjects without a prefix) or run a
snapshot diff. Default native ACLs for bucket owners include LIST. Ranger
policies that grant read without list need list added.
Suggested release note: Listing the root of a bucket through the filesystem
interfaces, and running a snapshot diff, now require the LIST permission on the
bucket, as listKeys already does.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
