[
https://issues.apache.org/jira/browse/HDDS-17097?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-17097:
------------------------------
Description:
Bucket level listings check different ACL rights depending on the API.
{{listKeys}} and {{listSnapshotDiffJobs}} check LIST on the bucket.
{{listStatus}} and {{listStatusLight}} on the bucket root (empty key name), and
{{snapshotDiff}} and {{submitSnapshotDiff}}, check READ on the bucket. With
partial prefixes (used by key listing of FSO buckets with a name prefix),
{{listStatusLight}} checks READ on the prefix as a key.
This change adds a bucket LIST check and keeps the existing READ checks:
- {{listStatus}} and {{listStatusLight}} also check LIST on the bucket when the
key name is empty or when partial prefixes are allowed. Listing a directory
checks only READ on that path, as before.
- {{snapshotDiff}} and {{submitSnapshotDiff}} check READ and LIST on the
bucket. {{cancelSnapshotDiff}} and {{getSnapshotInfo}} check READ, as before.
This matches the Ranger permissions for listing keys (bucket LIST and READ).
{{listKeys}}, {{listSnapshot}} and {{listSnapshotDiffJobs}} are not changed.
Compatibility:
- No protocol or layout change.
- A principal with READ but not LIST on a bucket can no longer list the bucket
root through the filesystem interfaces ({{ozone fs -ls}}, ofs, and key listing
of FSO buckets, including S3 ListObjects and {{ozone sh key list}}) or run a
snapshot diff. Default native ACLs for bucket owners include LIST. Ranger
policies that grant read without list need list added.
Suggested release note: Listing the root of a bucket through the filesystem
interfaces, and running a snapshot diff, now require both the READ and the LIST
permission on the bucket.
was:
Bucket level listings check different ACL rights depending on the API.
{{listKeys}} and {{listSnapshotDiffJobs}} check LIST on the bucket, while
{{listStatus}} and {{listStatusLight}} with an empty key name (the bucket
root), and {{snapshotDiff}} and {{submitSnapshotDiff}}, check READ on the
bucket. With partial prefixes (used by key listing of FSO buckets with a name
prefix), {{listStatusLight}} checks READ on the prefix as if it were a key.
This change makes them consistent:
- {{listStatus}} and {{listStatusLight}} check LIST on the bucket when the key
name is empty (instead of READ on the bucket), and when partial prefixes are
allowed (in addition to READ on the prefix). Listing a directory keeps checking
READ on that path.
- {{snapshotDiff}} and {{submitSnapshotDiff}} check LIST on the resolved bucket
instead of READ. {{cancelSnapshotDiff}} is unchanged.
Compatibility:
- No protocol or layout change.
- A principal that has READ but not LIST on a bucket can no longer list the
bucket root through the filesystem interfaces ({{ozone fs -ls}}, ofs, and key
listing of FSO buckets, including S3 ListObjects and {{ozone sh key list}}) or
run a snapshot diff. Default native ACLs for bucket owners include LIST. Ranger
policies that grant read without list need list added.
Suggested release note: Listing the root of a bucket through the filesystem
interfaces, and running a snapshot diff, now require the LIST permission on the
bucket, as listKeys already does.
> Require LIST on the bucket for bucket level listStatus and snapshot diff
> ------------------------------------------------------------------------
>
> Key: HDDS-17097
> URL: https://issues.apache.org/jira/browse/HDDS-17097
> Project: Apache Ozone
> Issue Type: Improvement
> Components: Ozone Manager
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
> Labels: pull-request-available
>
> Bucket level listings check different ACL rights depending on the API.
> {{listKeys}} and {{listSnapshotDiffJobs}} check LIST on the bucket.
> {{listStatus}} and {{listStatusLight}} on the bucket root (empty key name),
> and {{snapshotDiff}} and {{submitSnapshotDiff}}, check READ on the bucket.
> With partial prefixes (used by key listing of FSO buckets with a name
> prefix), {{listStatusLight}} checks READ on the prefix as a key.
> This change adds a bucket LIST check and keeps the existing READ checks:
> - {{listStatus}} and {{listStatusLight}} also check LIST on the bucket when
> the key name is empty or when partial prefixes are allowed. Listing a
> directory checks only READ on that path, as before.
> - {{snapshotDiff}} and {{submitSnapshotDiff}} check READ and LIST on the
> bucket. {{cancelSnapshotDiff}} and {{getSnapshotInfo}} check READ, as before.
> This matches the Ranger permissions for listing keys (bucket LIST and READ).
> {{listKeys}}, {{listSnapshot}} and {{listSnapshotDiffJobs}} are not changed.
> Compatibility:
> - No protocol or layout change.
> - A principal with READ but not LIST on a bucket can no longer list the
> bucket root through the filesystem interfaces ({{ozone fs -ls}}, ofs, and key
> listing of FSO buckets, including S3 ListObjects and {{ozone sh key list}})
> or run a snapshot diff. Default native ACLs for bucket owners include LIST.
> Ranger policies that grant read without list need list added.
> Suggested release note: Listing the root of a bucket through the filesystem
> interfaces, and running a snapshot diff, now require both the READ and the
> LIST permission on the bucket.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
