aayush2761 opened a new pull request, #11759: URL: https://github.com/apache/ozone/pull/11759
## What changes were proposed in this pull request? DeleteKey and RenameKey perform ACL checks in `preExecute` through `resolveBucketAndCheckAcls`. When the check fails with `PERMISSION_DENIED`, the request does not go to Ratis and `validateAndUpdateCache` never runs, which is where audit logging happens today. Denied delete and rename attempts therefore do not appear in the OM audit log. This pull request adds `markForAudit` in `OMKeyDeleteRequest.preExecute` and `OMKeyRenameRequest.preExecute` when `resolveBucketAndCheckAcls` throws `IOException`, using the same approach as `OMKeySetTimesRequest` and volume/bucket create requests. `OMExecutionFlow` already logs the audit builder on `preExecute` failure once it is marked. FSO layouts are covered by the base request classes; FSO subclasses only override `resolveBucketAndCheckAcls`. Unit tests `preExecutePermissionDeniedWhenAclEnabled` were added for delete and rename. Parent issue: HDDS-17382. Regression context: HDDS-16951 (FSO rename no longer gets incidental audit from other paths). ## What is the link to the Apache JIRA https://issues.apache.org/jira/browse/HDDS-17384 https://issues.apache.org/jira/browse/HDDS-17382 ## How was this patch tested? - `mvn -pl :ozone-manager test -Dtest=TestOMKeyDeleteRequest#preExecutePermissionDeniedWhenAclEnabled,TestOMKeyRenameRequest#preExecutePermissionDeniedWhenAclEnabled -DskipShade -DskipRecon -DskipDocs` - `mvn -pl :ozone-manager test -Dtest=TestOMKeyDeleteRequest,TestOMKeyRenameRequest,TestOMKeyDeleteRequestWithFSO,TestOMKeyRenameRequestWithFSO -DskipShade -DskipRecon -DskipDocs` - `./hadoop-ozone/dev-support/checks/checkstyle.sh` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
