From a6dff039a685e6d460a14c67d3b249f5fb2e1a89 Mon Sep 17 00:00:00 2001 From: Pritha Srivastava Date: Mon, 1 Apr 2019 21:09:22 +0530 Subject: [PATCH] rgw: Evaluating bucket policies also while reading permissions for an object that is non-existent. Fixes http://tracker.ceph.com/issues/38638 Signed-off-by: Pritha Srivastava (cherry picked from commit 5eb50b7d10da51db72f705807c87775562b79b63) Conflicts: src/rgw/rgw_op.cc - bucket_policy.verify_permission() takes different arguments in mimic --- src/rgw/rgw_op.cc | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc index 9c6d06ac37db8..cfc9b2c9838b9 100644 --- a/src/rgw/rgw_op.cc +++ b/src/rgw/rgw_op.cc @@ -369,13 +369,20 @@ static int read_obj_policy(RGWRados *store, if (ret < 0) { return ret; } - const rgw_user& bucket_owner = bucket_policy.get_owner().get_id(); if (bucket_owner.compare(s->user->user_id) != 0 && - ! s->auth.identity->is_admin_of(bucket_owner) && - ! bucket_policy.verify_permission(*s->auth.identity, s->perm_mask, - RGW_PERM_READ)) { - ret = -EACCES; + ! s->auth.identity->is_admin_of(bucket_owner)) { + if (policy) { + auto r = policy->eval(s->env, *s->auth.identity, rgw::IAM::s3ListBucket, ARN(bucket)); + if (r == Effect::Allow) + return -ENOENT; + if (r == Effect::Deny) + return -EACCES; + } + if (! bucket_policy.verify_permission(*s->auth.identity, s->perm_mask, RGW_PERM_READ)) + ret = -EACCES; + else + ret = -ENOENT; } else { ret = -ENOENT; } -- 2.39.5