[
https://issues.apache.org/jira/browse/HDDS-17097?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated HDDS-17097:
----------------------------------
Labels: pull-request-available (was: )
> Require LIST on the bucket for bucket level listStatus and snapshot diff
> ------------------------------------------------------------------------
>
> Key: HDDS-17097
> URL: https://issues.apache.org/jira/browse/HDDS-17097
> Project: Apache Ozone
> Issue Type: Improvement
> Components: Ozone Manager
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
> Labels: pull-request-available
>
> Bucket level listings check different ACL rights depending on the API.
> {{listKeys}} and {{listSnapshotDiffJobs}} check LIST on the bucket, while
> {{listStatus}} and {{listStatusLight}} with an empty key name (the bucket
> root), and {{snapshotDiff}} and {{submitSnapshotDiff}}, check READ on the
> bucket. With partial prefixes (used by key listing of FSO buckets with a name
> prefix), {{listStatusLight}} checks READ on the prefix as if it were a key.
> This change makes them consistent:
> - {{listStatus}} and {{listStatusLight}} check LIST on the bucket when the
> key name is empty (instead of READ on the bucket), and when partial prefixes
> are allowed (in addition to READ on the prefix). Listing a directory keeps
> checking READ on that path.
> - {{snapshotDiff}} and {{submitSnapshotDiff}} check LIST on the resolved
> bucket instead of READ. {{cancelSnapshotDiff}} is unchanged.
> Compatibility:
> - No protocol or layout change.
> - A principal that has READ but not LIST on a bucket can no longer list the
> bucket root through the filesystem interfaces ({{ozone fs -ls}}, ofs, and key
> listing of FSO buckets, including S3 ListObjects and {{ozone sh key list}})
> or run a snapshot diff. Default native ACLs for bucket owners include LIST.
> Ranger policies that grant read without list need list added.
> Suggested release note: Listing the root of a bucket through the filesystem
> interfaces, and running a snapshot diff, now require the LIST permission on
> the bucket, as listKeys already does.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
