]> git.apps.os.sepia.ceph.com Git - ceph.git/commitdiff
rgw: remote copy obj pass rgwx-perm-check-uid for perm evaluation
authorSeena Fallah <seenafallah@gmail.com>
Fri, 28 Mar 2025 20:55:20 +0000 (21:55 +0100)
committerSeena Fallah <seenafallah@gmail.com>
Mon, 28 Apr 2025 16:56:06 +0000 (18:56 +0200)
When copying object from remote source (bucket from another zonegroup)
the perms of the source is not evaluated resulting in reading from
unauthorized buckets.
passing `rgwx-perm-check-uid` will let the source zone evaluates the
perm and close this bug.

Signed-off-by: Seena Fallah <seenafallah@gmail.com>
src/rgw/driver/rados/rgw_rados.cc

index 06d64538ed34dff6b3bff28a8193ff434cda9b07..08731ab69cd6f0c92b8e0681bcde3c538f0b3db2 100644 (file)
@@ -4891,7 +4891,7 @@ int RGWRados::copy_obj(RGWObjectCtx& src_obj_ctx,
     // that only one thread tries to suspend that coroutine
     const req_context rctx{dpp, null_yield, nullptr};
     const rgw_owner remote_user_owner(remote_user);
-    return fetch_remote_obj(dest_obj_ctx, &remote_user_owner, nullptr, info, source_zone,
+    return fetch_remote_obj(dest_obj_ctx, &remote_user_owner, &remote_user, info, source_zone,
                dest_obj, src_obj, dest_bucket_info, &src_bucket_info,
                dest_placement, src_mtime, mtime, mod_ptr,
                unmod_ptr, high_precision_time,