[
https://issues.apache.org/jira/browse/HDDS-17097?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-17097:
------------------------------
Release Note: Listing the root of a bucket through the filesystem
interfaces (ozone fs -ls, ofs, o3fs), listing keys of an FSO bucket (including
S3 ListObjects and ozone sh key list), and running a snapshot diff now require
the LIST permission on the bucket, in addition to the READ permission they
already required. Principals that have READ but not LIST on a bucket need LIST
added, in native ACLs or Ranger policies, to keep these operations working.
> Require LIST on the bucket for bucket level listStatus and snapshot diff
> ------------------------------------------------------------------------
>
> Key: HDDS-17097
> URL: https://issues.apache.org/jira/browse/HDDS-17097
> Project: Apache Ozone
> Issue Type: Improvement
> Components: Ozone Manager
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
> Labels: pull-request-available
>
> Bucket level listings check different ACL rights depending on the API.
> {{listKeys}} and {{listSnapshotDiffJobs}} check LIST on the bucket.
> {{listStatus}} and {{listStatusLight}} on the bucket root (empty key name),
> and {{snapshotDiff}} and {{submitSnapshotDiff}}, check READ on the bucket.
> With partial prefixes (used by key listing of FSO buckets with a name
> prefix), {{listStatusLight}} checks READ on the prefix as a key.
> This change adds a bucket LIST check and keeps the existing READ checks:
> - {{listStatus}} and {{listStatusLight}} also check LIST on the bucket when
> the key name is empty or when partial prefixes are allowed. Listing a
> directory checks only READ on that path, as before.
> - {{snapshotDiff}} and {{submitSnapshotDiff}} check READ and LIST on the
> bucket. {{cancelSnapshotDiff}} and {{getSnapshotInfo}} check READ, as before.
> This matches the Ranger permissions for listing keys (bucket LIST and READ).
> {{listKeys}}, {{listSnapshot}} and {{listSnapshotDiffJobs}} are not changed.
> Compatibility:
> - No protocol or layout change.
> - A principal with READ but not LIST on a bucket can no longer list the
> bucket root through the filesystem interfaces ({{ozone fs -ls}}, ofs, and key
> listing of FSO buckets, including S3 ListObjects and {{ozone sh key list}})
> or run a snapshot diff. Default native ACLs for bucket owners include LIST.
> Ranger policies that grant read without list need list added.
> Suggested release note: Listing the root of a bucket through the filesystem
> interfaces, and running a snapshot diff, now require both the READ and the
> LIST permission on the bucket.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
