smengcl opened a new pull request, #11598: URL: https://github.com/apache/ozone/pull/11598
Generated-by: Claude Code (Opus 5.5) ## What changes were proposed in this pull request? Bucket level listings check different ACL rights depending on the API: `listKeys` and `listSnapshotDiffJobs` check LIST on the bucket, while `listStatus`/`listStatusLight` on the bucket root (empty key name) and `snapshotDiff`/`submitSnapshotDiff` check READ on the bucket. With partial prefixes, which key listing of FSO buckets uses for a name prefix, `listStatusLight` checks READ on the prefix as if it were a key. This makes them consistent: - `OmMetadataReader`: `listStatus` and `listStatusLight` check LIST on the bucket when the key name is empty (instead of READ on the bucket), and when partial prefixes are allowed (in addition to READ on the prefix). Listing a directory keeps checking READ on that path. Requests with STS credentials are unchanged. - `OzoneManager`: `snapshotDiff` (both overloads) and `submitSnapshotDiff` check LIST on the resolved bucket. `cancelSnapshotDiff` and `getSnapshotInfo` keep checking READ. Compatibility: no protocol or layout change. A principal that has READ but not LIST on a bucket can no longer list the bucket root through the filesystem interfaces (`ozone fs -ls`, ofs, and key listing of FSO buckets, including S3 ListObjects and `ozone sh key list`) or run a snapshot diff. Default native ACLs for bucket owners include LIST; Ranger policies that grant read without list need list added. Suggested release note: Listing the root of a bucket through the filesystem interfaces, and running a snapshot diff, now require the LIST permission on the bucket, as listKeys already does. ## What is the link to the Apache JIRA https://issues.apache.org/jira/browse/HDDS-17097 ## How was this patch tested? - `TestOMMetadataReader`: new `testListStatusUsesListAclOnBucketRootForNonStsRequest` and `testListStatusLightUsesListAclForPartialPrefixForNonStsRequest`. Each fails without the change. - `TestOzoneManagerSnapshotAcl#testSnapshotPermissions`: a user with volume and bucket READ but no bucket LIST can get snapshot info, but `snapshotDiff` and `submitSnapshotDiff` are denied. It fails without the change. - Ran locally: `TestOMMetadataReader`, `TestOzoneManagerSnapshotAcl`, `TestKeyLookupAclNormalization`, checkstyle on `ozone-manager` and `ozone-integration-test`. - Size: production code 2 files, +15 -7; tests 2 files, +57 -1. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
