rgw: Evaluating bucket policies also while reading permissions for an object that...

Fixes http://tracker.ceph.com/issues/38638

Signed-off-by: Pritha Srivastava <prsrivas@redhat.com>
(cherry picked from commit 5eb50b7d10da51db72f705807c87775562b79b63)

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 2788fabdb465703898565e0a6078c9343103d564..34b07008b05edc2c8b5f84e23d5fabedc9f3d9b3 100644 (file)
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -523,13 +523,20 @@ static int read_obj_policy(RGWRados *store,
     if (ret < 0) {
       return ret;
     }
-
     const rgw_user& bucket_owner = bucket_policy.get_owner().get_id();
     if (bucket_owner.compare(s->user->user_id) != 0 &&
-        ! s->auth.identity->is_admin_of(bucket_owner) &&
-        ! bucket_policy.verify_permission(s, *s->auth.identity, s->perm_mask,
-                                          RGW_PERM_READ)) {
-      ret = -EACCES;
+        ! s->auth.identity->is_admin_of(bucket_owner)) {
+      if (policy) {
+        auto r =  policy->eval(s->env, *s->auth.identity, rgw::IAM::s3ListBucket, ARN(bucket));
+        if (r == Effect::Allow)
+          return -ENOENT;
+        if (r == Effect::Deny)
+          return -EACCES;
+      }
+      if (! bucket_policy.verify_permission(s, *s->auth.identity, s->perm_mask, RGW_PERM_READ))
+        ret = -EACCES;
+      else
+        ret = -ENOENT;
     } else {
       ret = -ENOENT;
     }