From a4947ff49e62df7aa643e14e2af0150c8c7cbf57 Mon Sep 17 00:00:00 2001 From: Casey Bodley Date: Sat, 27 Jan 2024 14:20:53 -0500 Subject: [PATCH] rgw: verify_permission logs acl grants Signed-off-by: Casey Bodley (cherry picked from commit be35990b85c6b486434d022c77d87fe49db05f12) --- src/rgw/rgw_common.cc | 35 ++++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-) diff --git a/src/rgw/rgw_common.cc b/src/rgw/rgw_common.cc index 1e7b29d65777b..1513c6e33b505 100644 --- a/src/rgw/rgw_common.cc +++ b/src/rgw/rgw_common.cc @@ -1336,10 +1336,15 @@ bool verify_bucket_permission_no_policy(const DoutPrefixProvider* dpp, struct pe if (bucket_acl.verify_permission(dpp, *s->identity, perm, perm, s->get_referer(), s->bucket_access_conf && - s->bucket_access_conf->ignore_public_acls())) + s->bucket_access_conf->ignore_public_acls())) { + ldpp_dout(dpp, 10) << __func__ << ": granted by bucket acl" << dendl; return true; - - return user_acl.verify_permission(dpp, *s->identity, perm, perm); + } + if (user_acl.verify_permission(dpp, *s->identity, perm, perm)) { + ldpp_dout(dpp, 10) << __func__ << ": granted by user acl" << dendl; + return true; + } + return false; } bool verify_bucket_permission_no_policy(const DoutPrefixProvider* dpp, req_state * const s, @@ -1530,6 +1535,7 @@ bool verify_object_permission(const DoutPrefixProvider* dpp, struct perm_state_b s->bucket_access_conf && s->bucket_access_conf->ignore_public_acls()); if (ret) { + ldpp_dout(dpp, 10) << __func__ << ": granted by user acl" << dendl; return true; } @@ -1551,10 +1557,15 @@ bool verify_object_permission(const DoutPrefixProvider* dpp, struct perm_state_b /* we already verified the user mask above, so we pass swift_perm as the mask here, otherwise the mask might not cover the swift permissions bits */ if (bucket_acl.verify_permission(dpp, *s->identity, swift_perm, swift_perm, - s->get_referer())) + s->get_referer())) { + ldpp_dout(dpp, 10) << __func__ << ": granted by bucket acl" << dendl; return true; - - return user_acl.verify_permission(dpp, *s->identity, swift_perm, swift_perm); + } + if (user_acl.verify_permission(dpp, *s->identity, swift_perm, swift_perm)) { + ldpp_dout(dpp, 10) << __func__ << ": granted by user acl" << dendl; + return true; + } + return false; } bool verify_object_permission(const DoutPrefixProvider* dpp, req_state * const s, @@ -1591,6 +1602,7 @@ bool verify_object_permission_no_policy(const DoutPrefixProvider* dpp, s->bucket_access_conf && s->bucket_access_conf->ignore_public_acls()); if (ret) { + ldpp_dout(dpp, 10) << __func__ << ": granted by object acl" << dendl; return true; } @@ -1612,10 +1624,15 @@ bool verify_object_permission_no_policy(const DoutPrefixProvider* dpp, /* we already verified the user mask above, so we pass swift_perm as the mask here, otherwise the mask might not cover the swift permissions bits */ if (bucket_acl.verify_permission(dpp, *s->identity, swift_perm, swift_perm, - s->get_referer())) + s->get_referer())) { + ldpp_dout(dpp, 10) << __func__ << ": granted by bucket acl" << dendl; return true; - - return user_acl.verify_permission(dpp, *s->identity, swift_perm, swift_perm); + } + if (user_acl.verify_permission(dpp, *s->identity, swift_perm, swift_perm)) { + ldpp_dout(dpp, 10) << __func__ << ": granted by user acl" << dendl; + return true; + } + return false; } bool verify_object_permission_no_policy(const DoutPrefixProvider* dpp, req_state *s, int perm) -- 2.39.5