rgw: rename iam_user_policies to iam_identity_policies

identity policies can come from iam groups and roles too

Signed-off-by: Casey Bodley <cbodley@redhat.com>

diff --git a/src/rgw/rgw_auth.cc b/src/rgw/rgw_auth.cc
index 5692f9ae2f5bee2ad5227ad78367a811875d6742..1f84fcb2da4a738d50c9f1ff8e921c53e72e192f 100644 (file)
--- a/src/rgw/rgw_auth.cc
+++ b/src/rgw/rgw_auth.cc
@@ -998,7 +998,7 @@ void rgw::auth::RoleApplier::modify_request_state(const DoutPrefixProvider *dpp,
   for (const auto& policy : role.inline_policies) {
     try {
       const rgw::IAM::Policy p(s->cct, role.tenant, policy, false);
-      s->iam_user_policies.push_back(std::move(p));
+      s->iam_identity_policies.push_back(std::move(p));
     } catch (rgw::IAM::PolicyParseException& e) {
       //Control shouldn't reach here as the policy has already been
       //verified earlier
@@ -1008,7 +1008,7 @@ void rgw::auth::RoleApplier::modify_request_state(const DoutPrefixProvider *dpp,
   for (const auto& arn : role.managed_policies) {
     try {
       if (auto p = rgw::IAM::get_managed_policy(s->cct, arn); p) {
-        s->iam_user_policies.push_back(std::move(*p));
+        s->iam_identity_policies.push_back(std::move(*p));
       }
     } catch (rgw::IAM::PolicyParseException& e) {
       //Control shouldn't reach here as the policy has already been

diff --git a/src/rgw/rgw_common.cc b/src/rgw/rgw_common.cc
index 6ce92b742b1c84c8ad117a776bc9906231e5b194..4a0ffb2a5a56be030a9fc0a67580eaa33e935024 100644 (file)
--- a/src/rgw/rgw_common.cc
+++ b/src/rgw/rgw_common.cc
@@ -1291,7 +1291,7 @@ bool verify_user_permission(const DoutPrefixProvider* dpp,
     // account users always require an Allow from identity-based policy
     mandatory_policy = true;
   }
-  return verify_user_permission(dpp, &ps, s->user_acl, s->iam_user_policies, s->session_policies, res, op, mandatory_policy);
+  return verify_user_permission(dpp, &ps, s->user_acl, s->iam_identity_policies, s->session_policies, res, op, mandatory_policy);
 }
 
 bool verify_user_permission_no_policy(const DoutPrefixProvider* dpp, 
@@ -1448,7 +1448,7 @@ bool verify_bucket_permission(const DoutPrefixProvider* dpp, req_state * const s
     return false;
   }
   return verify_bucket_permission(dpp, s, s->bucket->get_key(), s->user_acl, s->bucket_acl,
-                                  s->iam_policy, s->iam_user_policies, s->session_policies, op);
+                                  s->iam_policy, s->iam_identity_policies, s->session_policies, op);
 }
 
 // Authorize anyone permitted by the bucket policy, identity policies, session policies and the bucket owner
@@ -1461,7 +1461,7 @@ int verify_bucket_owner_or_policy(const DoutPrefixProvider* dpp,
   const auto arn = ARN(s->bucket->get_key());
   const auto effect = evaluate_iam_policies(
       dpp, s->env, *s->auth.identity, account_root, op, arn,
-      s->iam_policy, s->iam_user_policies, s->session_policies);
+      s->iam_policy, s->iam_identity_policies, s->session_policies);
   if (effect == Effect::Deny) {
     return -EACCES;
   }
@@ -1630,7 +1630,7 @@ bool verify_object_permission(const DoutPrefixProvider* dpp, req_state *s, uint6
                                   s->bucket_acl,
                                   s->object_acl,
                                   s->iam_policy,
-                                  s->iam_user_policies,
+                                  s->iam_identity_policies,
                                   s->session_policies,
                                   op);
 }

diff --git a/src/rgw/rgw_common.h b/src/rgw/rgw_common.h
index f8ca6988e783ce4907f52ee1a4339949c9c2211f..d9e4d75a4fdae1ebdc11983ddf211f36251327f1 100644 (file)
--- a/src/rgw/rgw_common.h
+++ b/src/rgw/rgw_common.h
@@ -1331,7 +1331,7 @@ struct req_state : DoutPrefixProvider {
   rgw::IAM::Environment env;
   boost::optional<rgw::IAM::Policy> iam_policy;
   boost::optional<PublicAccessBlockConfiguration> bucket_access_conf;
-  std::vector<rgw::IAM::Policy> iam_user_policies;
+  std::vector<rgw::IAM::Policy> iam_identity_policies;
 
   /* Is the request made by an user marked as a system one?
    * Being system user means we also have the admin status. */

diff --git a/src/rgw/rgw_lua_request.cc b/src/rgw/rgw_lua_request.cc
index 4119d8f93a5c5041bc384cb6b5ed2936a2274358..3caad29654532450c5041fcc05be68a11ea5ff6d 100644 (file)
--- a/src/rgw/rgw_lua_request.cc
+++ b/src/rgw/rgw_lua_request.cc
@@ -743,7 +743,7 @@ struct RequestMetaTable : public EmptyMetaTable {
         create_metatable<PolicyMetaTable>(L, name, index, false, s->iam_policy.get_ptr());
       }
     } else if (strcasecmp(index, "UserPolicies") == 0) {
-        create_metatable<PoliciesMetaTable>(L, name, index, false, &(s->iam_user_policies));
+        create_metatable<PoliciesMetaTable>(L, name, index, false, &(s->iam_identity_policies));
     } else if (strcasecmp(index, "RGWId") == 0) {
       pushstring(L, s->host_id);
     } else if (strcasecmp(index, "HTTP") == 0) {

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 8dd80c9fe9c243fe45cd9a95da06805b48c004d1..efc18003a5edeb0e01ab41fe7cc4d7c66ee5b096 100644 (file)
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -454,7 +454,7 @@ static int read_obj_policy(const DoutPrefixProvider *dpp,
     const rgw_owner& bucket_owner = bucket_policy.get_owner().id;
     if (bucket_owner != s->owner.id &&
         !s->auth.identity->is_admin_of(bucket_owner)) {
-      auto r = eval_identity_or_session_policies(dpp, s->iam_user_policies, s->env,
+      auto r = eval_identity_or_session_policies(dpp, s->iam_identity_policies, s->env,
                                   rgw::IAM::s3ListBucket, ARN(bucket->get_key()));
       if (r == Effect::Allow)
         return -ENOENT;
@@ -642,9 +642,9 @@ int rgw_build_bucket_policies(const DoutPrefixProvider *dpp, rgw::sal::Driver* d
        auto user_policies = get_iam_user_policy_from_attr(s->cct,
                                                           s->user->get_attrs(),
                                                           s->user->get_tenant());
-          s->iam_user_policies.insert(s->iam_user_policies.end(),
-                                      std::make_move_iterator(user_policies.begin()),
-                                      std::make_move_iterator(user_policies.end()));
+          s->iam_identity_policies.insert(s->iam_identity_policies.end(),
+                                          std::make_move_iterator(user_policies.begin()),
+                                          std::make_move_iterator(user_policies.end()));
       } else {
         if (ret == -ENOENT)
           ret = 0;
@@ -884,7 +884,7 @@ static std::tuple<bool, bool> rgw_check_policy_condition(const DoutPrefixProvide
 }
 
 static std::tuple<bool, bool> rgw_check_policy_condition(const DoutPrefixProvider *dpp, req_state* s, bool check_obj_exist_tag=true) {
-  return rgw_check_policy_condition(dpp, s->iam_policy, s->iam_user_policies, s->session_policies, check_obj_exist_tag);
+  return rgw_check_policy_condition(dpp, s->iam_policy, s->iam_identity_policies, s->session_policies, check_obj_exist_tag);
 }
 
 static void rgw_add_grant_to_iam_environment(rgw::IAM::Environment& e, req_state *s){
@@ -1755,7 +1755,7 @@ int RGWGetObj::read_user_manifest_part(rgw::sal::Bucket* bucket,
     ldpp_dout(this, 2) << "overriding permissions due to admin operation" << dendl;
   } else if (!verify_object_permission(this, s, part->get_obj(), s->user_acl,
                                       bucket_acl, obj_policy, bucket_policy,
-                                      s->iam_user_policies, s->session_policies, action)) {
+                                      s->iam_identity_policies, s->session_policies, action)) {
     return -EPERM;
   }
   if (ent.meta.size == 0) {
@@ -3925,14 +3925,14 @@ int RGWPutObj::verify_permission(optional_yield y)
 
     /* admin request overrides permission checks */
     if (! s->auth.identity->is_admin_of(cs_acl.get_owner().id)) {
-      if (policy || ! s->iam_user_policies.empty() || !s->session_policies.empty()) {
+      if (policy || ! s->iam_identity_policies.empty() || !s->session_policies.empty()) {
         //add source object tags for permission evaluation
-        auto [has_s3_existing_tag, has_s3_resource_tag] = rgw_check_policy_condition(this, policy, s->iam_user_policies, s->session_policies);
+        auto [has_s3_existing_tag, has_s3_resource_tag] = rgw_check_policy_condition(this, policy, s->iam_identity_policies, s->session_policies);
         if (has_s3_existing_tag || has_s3_resource_tag)
           rgw_iam_add_objtags(this, s, cs_object.get(), has_s3_existing_tag, has_s3_resource_tag);
         auto usr_policy_res = Effect::Pass;
         rgw::ARN obj_arn(cs_object->get_obj());
-        for (auto& user_policy : s->iam_user_policies) {
+        for (auto& user_policy : s->iam_identity_policies) {
           if (usr_policy_res = user_policy.eval(s->env, boost::none,
                              cs_object->get_instance().empty() ?
                              rgw::IAM::s3GetObject :
@@ -3979,7 +3979,7 @@ int RGWPutObj::verify_permission(optional_yield y)
     return ret;
   }
 
-  if (s->iam_policy || ! s->iam_user_policies.empty() || !s->session_policies.empty()) {
+  if (s->iam_policy || ! s->iam_identity_policies.empty() || !s->session_policies.empty()) {
     rgw_add_grant_to_iam_environment(s->env, s);
 
     rgw_add_to_iam_environment(s->env, "s3:x-amz-acl", s->canned_acl);
@@ -3999,7 +3999,7 @@ int RGWPutObj::verify_permission(optional_yield y)
     if (has_s3_resource_tag)
       rgw_iam_add_buckettags(this, s);
 
-    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_user_policies, s->env,
+    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_identity_policies, s->env,
                                             rgw::IAM::s3PutObject,
                                             s->object->get_obj());
     if (identity_policy_res == Effect::Deny)
@@ -4654,8 +4654,8 @@ void RGWPostObj::execute(optional_yield y)
   // add server-side encryption headers
   rgw_iam_add_crypt_attrs(s->env, s->info.crypt_attribute_map);
 
-  if (s->iam_policy || ! s->iam_user_policies.empty() || !s->session_policies.empty()) {
-    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_user_policies, s->env,
+  if (s->iam_policy || ! s->iam_identity_policies.empty() || !s->session_policies.empty()) {
+    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_identity_policies, s->env,
                                             rgw::IAM::s3PutObject,
                                             s->object->get_obj());
     if (identity_policy_res == Effect::Deny) {
@@ -5235,9 +5235,9 @@ int RGWDeleteObj::verify_permission(optional_yield y)
     if (has_s3_existing_tag || has_s3_resource_tag)
       rgw_iam_add_objtags(this, s, has_s3_existing_tag, has_s3_resource_tag);
 
-  if (s->iam_policy || ! s->iam_user_policies.empty() || ! s->session_policies.empty()) {
+  if (s->iam_policy || ! s->iam_identity_policies.empty() || ! s->session_policies.empty()) {
     if (s->bucket->get_info().obj_lock_enabled() && bypass_governance_mode) {
-      auto r = eval_identity_or_session_policies(this, s->iam_user_policies, s->env,
+      auto r = eval_identity_or_session_policies(this, s->iam_identity_policies, s->env,
                                                rgw::IAM::s3BypassGovernanceRetention, ARN(s->bucket->get_key(), s->object->get_name()));
       if (r == Effect::Deny) {
         bypass_perm = false;
@@ -5255,7 +5255,7 @@ int RGWDeleteObj::verify_permission(optional_yield y)
         }
       }
     }
-    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_user_policies, s->env,
+    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_identity_policies, s->env,
                                               s->object->get_instance().empty() ?
                                               rgw::IAM::s3DeleteObject :
                                               rgw::IAM::s3DeleteObjectVersion,
@@ -5587,13 +5587,13 @@ int RGWCopyObj::verify_permission(optional_yield y)
 
     /* admin request overrides permission checks */
     if (!s->auth.identity->is_admin_of(src_acl.get_owner().id)) {
-      if (src_policy || ! s->iam_user_policies.empty() || !s->session_policies.empty()) {
-        auto [has_s3_existing_tag, has_s3_resource_tag] = rgw_check_policy_condition(this, src_policy, s->iam_user_policies, s->session_policies);
+      if (src_policy || ! s->iam_identity_policies.empty() || !s->session_policies.empty()) {
+        auto [has_s3_existing_tag, has_s3_resource_tag] = rgw_check_policy_condition(this, src_policy, s->iam_identity_policies, s->session_policies);
         if (has_s3_existing_tag || has_s3_resource_tag)
           rgw_iam_add_objtags(this, s, s->src_object.get(), has_s3_existing_tag, has_s3_resource_tag);
 
         ARN obj_arn(s->src_object->get_obj());
-        auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_user_policies, s->env,
+        auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_identity_policies, s->env,
                                                   s->src_object->get_instance().empty() ?
                                                   rgw::IAM::s3GetObject :
                                                   rgw::IAM::s3GetObjectVersion,
@@ -5671,9 +5671,9 @@ int RGWCopyObj::verify_permission(optional_yield y)
   auto dest_iam_policy = get_iam_policy_from_attr(s->cct, s->bucket->get_attrs(), s->bucket->get_tenant());
   /* admin request overrides permission checks */
   if (! s->auth.identity->is_admin_of(dest_policy.get_owner().id)){
-    if (dest_iam_policy != boost::none || ! s->iam_user_policies.empty() || !s->session_policies.empty()) {
+    if (dest_iam_policy != boost::none || ! s->iam_identity_policies.empty() || !s->session_policies.empty()) {
       //Add destination bucket tags for authorization
-      auto [has_s3_existing_tag, has_s3_resource_tag] = rgw_check_policy_condition(this, dest_iam_policy, s->iam_user_policies, s->session_policies);
+      auto [has_s3_existing_tag, has_s3_resource_tag] = rgw_check_policy_condition(this, dest_iam_policy, s->iam_identity_policies, s->session_policies);
       if (has_s3_resource_tag)
         rgw_iam_add_buckettags(this, s, s->bucket.get());
 
@@ -5683,7 +5683,7 @@ int RGWCopyObj::verify_permission(optional_yield y)
                                   *md_directive);
 
       ARN obj_arn(s->object->get_obj());
-      auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_user_policies,
+      auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_identity_policies,
                                                                   s->env,
                                                                   rgw::IAM::s3PutObject,
                                                                   obj_arn);
@@ -6503,8 +6503,8 @@ int RGWInitMultipart::verify_permission(optional_yield y)
   // add server-side encryption headers
   rgw_iam_add_crypt_attrs(s->env, s->info.crypt_attribute_map);
 
-  if (s->iam_policy || ! s->iam_user_policies.empty() || !s->session_policies.empty()) {
-    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_user_policies, s->env,
+  if (s->iam_policy || ! s->iam_identity_policies.empty() || !s->session_policies.empty()) {
+    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_identity_policies, s->env,
                                               rgw::IAM::s3PutObject,
                                               s->object->get_obj());
     if (identity_policy_res == Effect::Deny) {
@@ -6624,8 +6624,8 @@ int RGWCompleteMultipart::verify_permission(optional_yield y)
   // add server-side encryption headers
   rgw_iam_add_crypt_attrs(s->env, s->info.crypt_attribute_map);
 
-  if (s->iam_policy || ! s->iam_user_policies.empty() || ! s->session_policies.empty()) {
-    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_user_policies, s->env,
+  if (s->iam_policy || ! s->iam_identity_policies.empty() || ! s->session_policies.empty()) {
+    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_identity_policies, s->env,
                                               rgw::IAM::s3PutObject,
                                               s->object->get_obj());
     if (identity_policy_res == Effect::Deny) {
@@ -6906,8 +6906,8 @@ int RGWAbortMultipart::verify_permission(optional_yield y)
   if (has_s3_existing_tag || has_s3_resource_tag)
     rgw_iam_add_objtags(this, s, has_s3_existing_tag, has_s3_resource_tag);
 
-  if (s->iam_policy || ! s->iam_user_policies.empty() || !s->session_policies.empty()) {
-    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_user_policies, s->env,
+  if (s->iam_policy || ! s->iam_identity_policies.empty() || !s->session_policies.empty()) {
+    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_identity_policies, s->env,
                                               rgw::IAM::s3AbortMultipartUpload,
                                               s->object->get_obj());
     if (identity_policy_res == Effect::Deny) {
@@ -7111,10 +7111,10 @@ int RGWDeleteMultiObj::verify_permission(optional_yield y)
     if (has_s3_existing_tag || has_s3_resource_tag)
       rgw_iam_add_objtags(this, s, has_s3_existing_tag, has_s3_resource_tag);
 
-  if (s->iam_policy || ! s->iam_user_policies.empty() || ! s->session_policies.empty()) {
+  if (s->iam_policy || ! s->iam_identity_policies.empty() || ! s->session_policies.empty()) {
     if (s->bucket->get_info().obj_lock_enabled() && bypass_governance_mode) {
       ARN bucket_arn(s->bucket->get_key());
-      auto r = eval_identity_or_session_policies(this, s->iam_user_policies, s->env,
+      auto r = eval_identity_or_session_policies(this, s->iam_identity_policies, s->env,
                                                rgw::IAM::s3BypassGovernanceRetention, ARN(s->bucket->get_key()));
       if (r == Effect::Deny) {
         bypass_perm = false;
@@ -7135,7 +7135,7 @@ int RGWDeleteMultiObj::verify_permission(optional_yield y)
 
     bool not_versioned = rgw::sal::Object::empty(s->object.get()) || s->object->get_instance().empty();
 
-    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_user_policies, s->env,
+    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_identity_policies, s->env,
                                               not_versioned ?
                                               rgw::IAM::s3DeleteObject :
                                               rgw::IAM::s3DeleteObjectVersion,
@@ -7237,8 +7237,8 @@ void RGWDeleteMultiObj::handle_individual_object(const rgw_obj_key& o, optional_
 {
   std::string version_id;
   std::unique_ptr<rgw::sal::Object> obj = bucket->get_object(o);
-  if (s->iam_policy || ! s->iam_user_policies.empty() || !s->session_policies.empty()) {
-    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_user_policies, s->env,
+  if (s->iam_policy || ! s->iam_identity_policies.empty() || !s->session_policies.empty()) {
+    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_identity_policies, s->env,
                                                                  o.instance.empty() ?
                                                                  rgw::IAM::s3DeleteObject :
                                                                  rgw::IAM::s3DeleteObjectVersion,
@@ -7498,7 +7498,7 @@ bool RGWBulkDelete::Deleter::verify_permission(RGWBucketInfo& binfo,
   /* We can use global user_acl because each BulkDelete request is allowed
    * to work on entities from a single account only. */
   return verify_bucket_permission(dpp, s, binfo.bucket, s->user_acl,
-                                 bacl, policy, s->iam_user_policies, s->session_policies, rgw::IAM::s3DeleteBucket);
+                                 bacl, policy, s->iam_identity_policies, s->session_policies, rgw::IAM::s3DeleteBucket);
 }
 
 bool RGWBulkDelete::Deleter::delete_single(const acct_path_t& path, optional_yield y)
@@ -7834,8 +7834,8 @@ bool RGWBulkUploadOp::handle_file_verify_permission(RGWBucketInfo& binfo,
   auto policy = get_iam_policy_from_attr(s->cct, battrs, binfo.bucket.tenant);
 
   bucket_owner = bacl.get_owner();
-  if (policy || ! s->iam_user_policies.empty() || !s->session_policies.empty()) {
-    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_user_policies, s->env,
+  if (policy || ! s->iam_identity_policies.empty() || !s->session_policies.empty()) {
+    auto identity_policy_res = eval_identity_or_session_policies(this, s->iam_identity_policies, s->env,
                                               rgw::IAM::s3PutObject, obj);
     if (identity_policy_res == Effect::Deny) {
       return false;

diff --git a/src/rgw/rgw_rest.cc b/src/rgw/rgw_rest.cc
index 56d2e4925f19431ceff47da6a2222e56a54bf23d..4185dee4e20e64b3cc9fdd53ed7da07758961d89 100644 (file)
--- a/src/rgw/rgw_rest.cc
+++ b/src/rgw/rgw_rest.cc
@@ -1879,9 +1879,9 @@ int RGWHandler_REST::init_permissions(RGWOp* op, optional_yield y)
       try {
         if (auto ret = s->user->read_attrs(s, y); ! ret) {
           auto user_policies = get_iam_user_policy_from_attr(s->cct, s->user->get_attrs(), s->user->get_tenant());
-          s->iam_user_policies.insert(s->iam_user_policies.end(),
-                                      std::make_move_iterator(user_policies.begin()),
-                                      std::make_move_iterator(user_policies.end()));
+          s->iam_identity_policies.insert(s->iam_identity_policies.end(),
+                                          std::make_move_iterator(user_policies.begin()),
+                                          std::make_move_iterator(user_policies.end()));
 
         }
       } catch (const std::exception& e) {