librgw/rgw_file: correctly handle object permissions

Implement the full object permission model for librgw (aka, NFS
and similar) operations.

Fixes DIRS1 unit tests.

Signed-off-by: Matt Benjamin <mbenjamin@redhat.com>

diff --git a/src/rgw/librgw.cc b/src/rgw/librgw.cc
index 220d02409978907c99e554fdb9da02242d9795ee..37414fc831dbae453bc89ae30ce713aa34ed3bad 100644 (file)
--- a/src/rgw/librgw.cc
+++ b/src/rgw/librgw.cc
@@ -545,16 +545,29 @@ namespace rgw {
   }
 
   int RGWLibRequest::read_permissions(RGWOp* op) {
+    /* bucket and object ops */
     int ret =
       rgw_build_bucket_policies(rgwlib.get_store(), get_state());
     if (ret < 0) {
-      ldout(get_state()->cct, 10) << "read_permissions on "
+      ldout(get_state()->cct, 10) << "read_permissions (bucket policy) on "
                                  << get_state()->bucket << ":"
                                  << get_state()->object
                                  << " only_bucket=" << only_bucket()
                                  << " ret=" << ret << dendl;
       if (ret == -ENODATA)
        ret = -EACCES;
+    } else if (! only_bucket()) {
+      /* object ops */
+      ret = rgw_build_object_policies(rgwlib.get_store(), get_state(),
+                                     op->prefetch_data());
+      if (ret < 0) {
+       ldout(get_state()->cct, 10) << "read_permissions (object policy) on"
+                                   << get_state()->bucket << ":"
+                                   << get_state()->object
+                                   << " ret=" << ret << dendl;
+       if (ret == -ENODATA)
+         ret = -EACCES;
+      }
     }
     return ret;
   } /* RGWLibRequest::read_permissions */

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 66ecd5568d28a5adcc939af66c4c7c1211b18b66..f8ee1924eca19dd311bfdb3dcd72501a61803315 100644 (file)
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -398,7 +398,8 @@ int rgw_build_bucket_policies(RGWRados* store, struct req_state* s)
  * only_bucket: If true, reads the bucket ACL rather than the object ACL.
  * Returns: 0 on success, -ERR# otherwise.
  */
-static int rgw_build_object_policies(RGWRados *store, struct req_state *s, bool prefetch_data)
+int rgw_build_object_policies(RGWRados *store, struct req_state *s,
+                             bool prefetch_data)
 {
   int ret = 0;
 

diff --git a/src/rgw/rgw_op.h b/src/rgw/rgw_op.h
index e3ecd600ed3f9696ba3af8a3b68f6308b593226c..825dd93b41e048249c25386da7dbe4a027e09a09 100644 (file)
--- a/src/rgw/rgw_op.h
+++ b/src/rgw/rgw_op.h
@@ -1338,6 +1338,8 @@ public:
 };
 
 extern int rgw_build_bucket_policies(RGWRados* store, struct req_state* s);
+extern int rgw_build_object_policies(RGWRados *store, struct req_state *s,
+                                   bool prefetch_data);
 
 static inline int put_data_and_throttle(RGWPutObjProcessor *processor,
                                        bufferlist& data, off_t ofs,