From c62ee110cf8afa1a15f5f4b14e1cbacd4da17c3d Mon Sep 17 00:00:00 2001
From: "Adam C. Emerson" <aemerson@redhat.com>
Date: Thu, 16 Oct 2025 16:07:17 -0400
Subject: [PATCH] rgw/policy: Add missing strings for actions

Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
 src/rgw/rgw_iam_policy.cc | 42 +++++++++++++++++++++++++++++++++------
 src/rgw/rgw_iam_policy.h  |  4 ++--
 src/rgw/rgw_op.h          |  2 +-
 3 files changed, 39 insertions(+), 9 deletions(-)

diff --git a/src/rgw/rgw_iam_policy.cc b/src/rgw/rgw_iam_policy.cc
index 2181b21a457..e42001c8361 100644
--- a/src/rgw/rgw_iam_policy.cc
+++ b/src/rgw/rgw_iam_policy.cc
@@ -1291,7 +1291,7 @@ Effect Statement::eval_conditions(const Environment& e) const {
   return Effect::Deny;
 }
 
-const char* action_bit_string(uint64_t action) {
+const char* action_bit_string(action_t action) {
   switch (action) {
   case s3GetObject:
     return "s3:GetObject";
@@ -1419,8 +1419,8 @@ const char* action_bit_string(uint64_t action) {
   case s3PutBucketLogging:
     return "s3:PutBucketLogging";
 
-    case s3PostBucketLogging:
-      return "s3:PostBucketLogging";
+  case s3PostBucketLogging:
+    return "s3:PostBucketLogging";
 
   case s3GetBucketTagging:
     return "s3:GetBucketTagging";
@@ -1491,6 +1491,27 @@ const char* action_bit_string(uint64_t action) {
   case s3BypassGovernanceRetention:
     return "s3:BypassGovernanceRetention";
 
+  case s3GetBucketPolicyStatus:
+    return "s3:GetBucketPolicyStatus";
+
+  case s3PutPublicAccessBlock:
+    return "s3:PutPublicAccessBlock";
+
+  case s3GetPublicAccessBlock:
+    return "s3:GetPublicAccessBlock";
+
+  case s3DeletePublicAccessBlock:
+    return "s3:DeletePublicAccessBlock";
+
+  case s3PutBucketPublicAccessBlock:
+    return "s3:PutBucketPublicAccessBlock";
+
+  case s3GetBucketPublicAccessBlock:
+    return "s3:GetBucketPublicAccessBlock";
+
+  case s3DeleteBucketPublicAccessBlock:
+    return "s3:DeleteBucketPublicAccessBlock";
+
   case s3GetObjectAttributes:
     return "s3:GetObjectAttributes";
 
@@ -1760,22 +1781,31 @@ const char* action_bit_string(uint64_t action) {
 
   case organizationsListTargetsForPolicy:
     return "organizations:ListTargetsForPolicy";
+
+  case s3All:
+  case s3objectlambdaAll:
+  case iamAll:
+  case stsAll:
+  case snsAll:
+  case organizationsAll:
+  case allCount:
+    return "{invalidSentinel}";
   }
-  return "s3Invalid";
+  return "{invalidUnknown}";
 }
 
 namespace {
 ostream& print_actions(ostream& m, const Action_t a) {
   bool begun = false;
   m << "[ ";
-  for (auto i = 0U; i < allCount; ++i) {
+  for (std::underlying_type_t<action_t> i = 0; i < allCount; ++i) {
     if (a[i] == 1) {
       if (begun) {
         m << ", ";
       } else {
         begun = true;
       }
-      m << action_bit_string(i);
+      m << action_bit_string(action_t(i));
     }
   }
   if (begun) {
diff --git a/src/rgw/rgw_iam_policy.h b/src/rgw/rgw_iam_policy.h
index 2915f0de3ca..85ed19f94c7 100644
--- a/src/rgw/rgw_iam_policy.h
+++ b/src/rgw/rgw_iam_policy.h
@@ -40,7 +40,7 @@ class Identity;
 namespace rgw {
 namespace IAM {
 
-enum {
+enum action_t {
   s3GetObject,
   s3GetObjectVersion,
   s3PutObject,
@@ -339,7 +339,7 @@ inline int op_to_perm(std::uint64_t op) {
 }
 }
 
-const char* action_bit_string(uint64_t action);
+const char* action_bit_string(action_t action);
 
 enum class PolicyPrincipal {
   Role,
diff --git a/src/rgw/rgw_op.h b/src/rgw/rgw_op.h
index 590b2a9c0fe..5172508fb8d 100644
--- a/src/rgw/rgw_op.h
+++ b/src/rgw/rgw_op.h
@@ -453,7 +453,7 @@ protected:
   bool first_data;
   uint64_t cur_ofs;
   bufferlist waiting;
-  uint64_t action = 0;
+  rgw::IAM::action_t action{};
 
   bool get_retention;
   bool get_legal_hold;
-- 
2.47.3