From: Casey Bodley <cbodley@redhat.com>
Date: Thu, 14 Mar 2024 19:25:02 +0000 (-0400)
Subject: rgw/pubsub: fix DeleteTopic permissions
X-Git-Tag: v20.0.0~2159^2~15
X-Git-Url: http://git.apps.os.sepia.ceph.com/?a=commitdiff_plain;h=4568b7a0c74404e0d21fcd221070530684de5066;p=ceph.git

rgw/pubsub: fix DeleteTopic permissions

non-account users now consult identity policies with
verify_user_permission() when the topic doesn't exist

account users now consult topic policy when it does exist

Signed-off-by: Casey Bodley <cbodley@redhat.com>
---

diff --git a/src/rgw/rgw_rest_pubsub.cc b/src/rgw/rgw_rest_pubsub.cc
index 891b015a7f4f8..60da1177059c3 100644
--- a/src/rgw/rgw_rest_pubsub.cc
+++ b/src/rgw/rgw_rest_pubsub.cc
@@ -920,17 +920,21 @@ class RGWPSDeleteTopicOp : public RGWOp {
   }
 
   int verify_permission(optional_yield y) override {
-    if (s->auth.identity->get_account()) {
+    if (topic) {
+      // consult topic policy for delete permission
+      if (!verify_topic_permission(this, s, *topic, topic_arn,
+                                   rgw::IAM::snsDeleteTopic)) {
+        return -ERR_AUTHORIZATION;
+      }
+    } else {
+      // if no topic policy exists, just check identity policies
+      // account users require an Allow, non-account users just check for Deny
+      const bool mandatory_policy = !!s->auth.identity->get_account();
       if (!verify_user_permission(this, s, topic_arn,
-                                  rgw::IAM::snsDeleteTopic)) {
+                                  rgw::IAM::snsDeleteTopic,
+                                  mandatory_policy)) {
         return -ERR_AUTHORIZATION;
       }
-      return 0;
-    }
-
-    if (topic && !verify_topic_permission(this, s, *topic, topic_arn,
-                                          rgw::IAM::snsDeleteTopic)) {
-      return -ERR_AUTHORIZATION;
     }
     return 0;
   }