[
https://issues.apache.org/jira/browse/HDDS-17097?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-17097:
------------------------------
Description:
Bucket level listings check different ACL rights depending on the API.
{{listKeys}} and {{listSnapshotDiffJobs}} check LIST on the bucket, while
{{listStatus}} and {{listStatusLight}} with an empty key name (the bucket
root), and {{snapshotDiff}} and {{submitSnapshotDiff}}, check READ on the
bucket. With partial prefixes (used by key listing of FSO buckets with a name
prefix), {{listStatusLight}} checks READ on the prefix as if it were a key.
This change makes them consistent:
- {{listStatus}} and {{listStatusLight}} check LIST on the bucket when the key
name is empty (instead of READ on the bucket), and when partial prefixes are
allowed (in addition to READ on the prefix). Listing a directory keeps checking
READ on that path.
- {{snapshotDiff}} and {{submitSnapshotDiff}} check LIST on the resolved bucket
instead of READ. {{cancelSnapshotDiff}} is unchanged.
Compatibility:
- No protocol or layout change.
- A principal that has READ but not LIST on a bucket can no longer list the
bucket root through the filesystem interfaces ({{ozone fs -ls}}, ofs, and key
listing of FSO buckets, including S3 ListObjects and {{ozone sh key list}}) or
run a snapshot diff. Default native ACLs for bucket owners include LIST. Ranger
policies that grant read without list need list added.
Suggested release note: Listing the root of a bucket through the filesystem
interfaces, and running a snapshot diff, now require the LIST permission on the
bucket, as listKeys already does.
was:
Bucket level listings check different ACL rights depending on the API.
{{listKeys}} and {{listSnapshotDiffJobs}} check LIST on the bucket, while
{{listStatus}} and {{listStatusLight}} with an empty key name (the bucket
root), and {{snapshotDiff}} and {{submitSnapshotDiff}}, check READ on the
bucket. With partial prefixes (used by key listing of FSO buckets with a name
prefix), {{listStatusLight}} checks READ on the prefix as if it were a key.
This change makes them consistent:
- {{listStatus}} and {{listStatusLight}} check LIST on the bucket when the key
name is empty, or when partial prefixes are allowed. Listing a directory keeps
checking READ on that path.
- {{snapshotDiff}} and {{submitSnapshotDiff}} check LIST on the resolved bucket
instead of READ. {{cancelSnapshotDiff}} is unchanged.
Compatibility:
- No protocol or layout change.
- A principal that has READ but not LIST on a bucket can no longer list the
bucket root through the filesystem interfaces ({{ozone fs -ls}}, ofs, and key
listing of FSO buckets, including S3 ListObjects and {{ozone sh key list}}) or
run a snapshot diff. Default native ACLs for bucket owners include LIST. Ranger
policies that grant read without list need list added.
Suggested release note: Listing the root of a bucket through the filesystem
interfaces, and running a snapshot diff, now require the LIST permission on the
bucket, as listKeys already does.
> Require LIST on the bucket for bucket level listStatus and snapshot diff
> ------------------------------------------------------------------------
>
> Key: HDDS-17097
> URL: https://issues.apache.org/jira/browse/HDDS-17097
> Project: Apache Ozone
> Issue Type: Improvement
> Components: Ozone Manager
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
>
> Bucket level listings check different ACL rights depending on the API.
> {{listKeys}} and {{listSnapshotDiffJobs}} check LIST on the bucket, while
> {{listStatus}} and {{listStatusLight}} with an empty key name (the bucket
> root), and {{snapshotDiff}} and {{submitSnapshotDiff}}, check READ on the
> bucket. With partial prefixes (used by key listing of FSO buckets with a name
> prefix), {{listStatusLight}} checks READ on the prefix as if it were a key.
> This change makes them consistent:
> - {{listStatus}} and {{listStatusLight}} check LIST on the bucket when the
> key name is empty (instead of READ on the bucket), and when partial prefixes
> are allowed (in addition to READ on the prefix). Listing a directory keeps
> checking READ on that path.
> - {{snapshotDiff}} and {{submitSnapshotDiff}} check LIST on the resolved
> bucket instead of READ. {{cancelSnapshotDiff}} is unchanged.
> Compatibility:
> - No protocol or layout change.
> - A principal that has READ but not LIST on a bucket can no longer list the
> bucket root through the filesystem interfaces ({{ozone fs -ls}}, ofs, and key
> listing of FSO buckets, including S3 ListObjects and {{ozone sh key list}})
> or run a snapshot diff. Default native ACLs for bucket owners include LIST.
> Ranger policies that grant read without list need list added.
> Suggested release note: Listing the root of a bucket through the filesystem
> interfaces, and running a snapshot diff, now require the LIST permission on
> the bucket, as listKeys already does.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
