[
https://issues.apache.org/jira/browse/HDDS-17097?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-17097:
------------------------------
Description:
Bucket level listings check different ACL rights depending on the API.
{{listKeys}} and {{listSnapshotDiffJobs}} check LIST on the bucket, while
{{listStatus}} and {{listStatusLight}} with an empty key name (the bucket
root), and {{snapshotDiff}} and {{submitSnapshotDiff}}, check READ on the
bucket. With partial prefixes (used by key listing of FSO buckets with a name
prefix), {{listStatusLight}} checks READ on the prefix as if it were a key.
This change makes them consistent:
- {{listStatus}} and {{listStatusLight}} check LIST on the bucket when the key
name is empty, or when partial prefixes are allowed. Listing a directory keeps
checking READ on that path.
- {{snapshotDiff}} and {{submitSnapshotDiff}} check LIST on the resolved bucket
instead of READ. {{cancelSnapshotDiff}} is unchanged.
Compatibility:
- No protocol or layout change.
- A principal that has READ but not LIST on a bucket can no longer list the
bucket root through the filesystem interfaces ({{ozone fs -ls}}, ofs, and key
listing of FSO buckets, including S3 ListObjects and {{ozone sh key list}}) or
run a snapshot diff. Default native ACLs for bucket owners include LIST. Ranger
policies that grant read without list need list added.
Suggested release note: Listing the root of a bucket through the filesystem
interfaces, and running a snapshot diff, now require the LIST permission on the
bucket, as listKeys already does.
was:
Bucket level listings check different ACL rights depending on the API.
{{listKeys}} and {{listSnapshotDiffJobs}} check LIST on the bucket, while
{{listStatus}} and {{listStatusLight}} with an empty key name (the bucket
root), and {{snapshotDiff}} and {{submitSnapshotDiff}}, check READ on the
bucket.
This change makes them consistent:
- {{listStatus}} and {{listStatusLight}} check LIST instead of READ when the
key name is empty. Listing a directory keeps checking READ on that path.
- {{snapshotDiff}} and {{submitSnapshotDiff}} check LIST on the resolved bucket
instead of READ. {{cancelSnapshotDiff}} is unchanged.
Compatibility:
- No protocol or layout change.
- A principal that has READ but not LIST on a bucket can no longer list the
bucket root through the filesystem interfaces ({{ozone fs -ls}}, ofs, and key
listing of FSO buckets, including S3 ListObjects without a prefix) or run a
snapshot diff. Default native ACLs for bucket owners include LIST. Ranger
policies that grant read without list need list added.
Suggested release note: Listing the root of a bucket through the filesystem
interfaces, and running a snapshot diff, now require the LIST permission on the
bucket, as listKeys already does.
> Require LIST on the bucket for bucket level listStatus and snapshot diff
> ------------------------------------------------------------------------
>
> Key: HDDS-17097
> URL: https://issues.apache.org/jira/browse/HDDS-17097
> Project: Apache Ozone
> Issue Type: Improvement
> Components: Ozone Manager
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
>
> Bucket level listings check different ACL rights depending on the API.
> {{listKeys}} and {{listSnapshotDiffJobs}} check LIST on the bucket, while
> {{listStatus}} and {{listStatusLight}} with an empty key name (the bucket
> root), and {{snapshotDiff}} and {{submitSnapshotDiff}}, check READ on the
> bucket. With partial prefixes (used by key listing of FSO buckets with a name
> prefix), {{listStatusLight}} checks READ on the prefix as if it were a key.
> This change makes them consistent:
> - {{listStatus}} and {{listStatusLight}} check LIST on the bucket when the
> key name is empty, or when partial prefixes are allowed. Listing a directory
> keeps checking READ on that path.
> - {{snapshotDiff}} and {{submitSnapshotDiff}} check LIST on the resolved
> bucket instead of READ. {{cancelSnapshotDiff}} is unchanged.
> Compatibility:
> - No protocol or layout change.
> - A principal that has READ but not LIST on a bucket can no longer list the
> bucket root through the filesystem interfaces ({{ozone fs -ls}}, ofs, and key
> listing of FSO buckets, including S3 ListObjects and {{ozone sh key list}})
> or run a snapshot diff. Default native ACLs for bucket owners include LIST.
> Ranger policies that grant read without list need list added.
> Suggested release note: Listing the root of a bucket through the filesystem
> interfaces, and running a snapshot diff, now require the LIST permission on
> the bucket, as listKeys already does.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
