From 5eb50b7d10da51db72f705807c87775562b79b63 Mon Sep 17 00:00:00 2001 From: Pritha Srivastava Date: Mon, 1 Apr 2019 21:09:22 +0530 Subject: [PATCH] rgw: Evaluating bucket policies also while reading permissions for an object that is non-existent. Fixes http://tracker.ceph.com/issues/38638 Signed-off-by: Pritha Srivastava --- src/rgw/rgw_op.cc | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc index bc9e877557f..2598e9db8ed 100644 --- a/src/rgw/rgw_op.cc +++ b/src/rgw/rgw_op.cc @@ -523,13 +523,20 @@ static int read_obj_policy(RGWRados *store, if (ret < 0) { return ret; } - const rgw_user& bucket_owner = bucket_policy.get_owner().get_id(); if (bucket_owner.compare(s->user->user_id) != 0 && - ! s->auth.identity->is_admin_of(bucket_owner) && - ! bucket_policy.verify_permission(s, *s->auth.identity, s->perm_mask, - RGW_PERM_READ)) { - ret = -EACCES; + ! s->auth.identity->is_admin_of(bucket_owner)) { + if (policy) { + auto r = policy->eval(s->env, *s->auth.identity, rgw::IAM::s3ListBucket, ARN(bucket)); + if (r == Effect::Allow) + return -ENOENT; + if (r == Effect::Deny) + return -EACCES; + } + if (! bucket_policy.verify_permission(s, *s->auth.identity, s->perm_mask, RGW_PERM_READ)) + ret = -EACCES; + else + ret = -ENOENT; } else { ret = -ENOENT; } -- 2.39.5