rgw: GetObject(Version) not allowed to replicate sse-kms objects

To replicate objects encrypted via sse-kms objects,
s3:GetObjectVersionForReplication is required.

Signed-off-by: Seena Fallah <seenafallah@gmail.com>
(cherry picked from commit 3024b70ad56a7733527be7bae53d0a19a368c45c)

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 908371c81fc7d2e4a5be08547beb3f458e015dec..441f527a7a6ae03faf3b9184319e73dc3db51a75 100644 (file)
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -1145,6 +1145,15 @@ int RGWGetObj::verify_permission(optional_yield y)
 
     // fallback to s3:GetObject(Version) permission
     action = s->object->get_instance().empty() ? rgw::IAM::s3GetObject : rgw::IAM::s3GetObjectVersion;
+
+    // sse-kms is not supported by s3:GetObject(Version) permission
+    bufferlist bl;
+    if (s->object->get_attr(RGW_ATTR_CRYPT_MODE, bl) && bl.to_str() == "SSE-KMS") {
+      s->err.message = "object is encrypted with SSE-KMS, missing s3:GetObjectVersionForReplication permission";
+      ldpp_dout(this, 4) << "ERROR: fetching object for replication object=" << s->object << " reason=" << s->err.message << dendl;
+
+      return -EACCES;
+    }
   } else if (get_torrent) {
     action = s->object->get_instance().empty() ? rgw::IAM::s3GetObjectTorrent : rgw::IAM::s3GetObjectVersionTorrent;
   } else {

diff --git a/src/rgw/rgw_process.cc b/src/rgw/rgw_process.cc
index 37d5ac0f6ab93038a7ee8fb27305c68e827a9f39..8cf1c41775f6e91c224deb9c37b9a164bd082fde 100644 (file)
--- a/src/rgw/rgw_process.cc
+++ b/src/rgw/rgw_process.cc
@@ -226,7 +226,7 @@ int rgw_process_authenticated(RGWHandler_REST * const handler,
     ret = op->verify_permission(y);
     std::swap(span, s->trace);
   }
-  if (ret < 0) {
+  if (ret == -EACCES || ret == -EPERM || ret == -ERR_AUTHORIZATION) {
     // system requests may impersonate another user/role for permission checks
     // so only rely on is_admin_of() to override permissions
     if (s->auth.identity->is_admin_of(s->user->get_id())) {
@@ -234,6 +234,9 @@ int rgw_process_authenticated(RGWHandler_REST * const handler,
     } else {
       return ret;
     }
+  } else if (ret < 0) {
+    // other errors are not overridden as they might be invalid input
+    return ret;
   }
 
   ldpp_dout(op, 2) << "verifying op params" << dendl;