From ceed535957ac186e241fcff26b103cf7efa959b1 Mon Sep 17 00:00:00 2001 From: "Adam C. Emerson" Date: Thu, 28 Sep 2017 13:54:32 -0400 Subject: [PATCH] rgw: Check bucket Website operations in policy Add code to check s3:GetBucketWebsite and s3:PutBucketWebsite operations against bucket policy. Fixes: http://tracker.ceph.com/issues/21597 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1493896 Signed-off-by: Adam C. Emerson --- src/rgw/rgw_op.cc | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc index 66567b43d9cf0..f47fbfaf580cc 100644 --- a/src/rgw/rgw_op.cc +++ b/src/rgw/rgw_op.cc @@ -2083,10 +2083,17 @@ void RGWSetBucketVersioning::execute() int RGWGetBucketWebsite::verify_permission() { - if (s->user->user_id.compare(s->bucket_owner.get_id()) != 0) - return -EACCES; + if (s->iam_policy) { + if (s->iam_policy->eval(s->env, *s->auth.identity, + rgw::IAM::s3GetBucketWebsite, + ARN(s->bucket)) == Effect::Allow) { + return 0; + } + } else if (s->auth.identity->is_owner_of(s->bucket_owner.get_id())) { + return 0; + } - return 0; + return -EACCES; } void RGWGetBucketWebsite::pre_exec() @@ -2103,10 +2110,17 @@ void RGWGetBucketWebsite::execute() int RGWSetBucketWebsite::verify_permission() { - if (s->user->user_id.compare(s->bucket_owner.get_id()) != 0) - return -EACCES; + if (s->iam_policy) { + if (s->iam_policy->eval(s->env, *s->auth.identity, + rgw::IAM::s3PutBucketWebsite, + ARN(s->bucket)) == Effect::Allow) { + return 0; + } + } else if (s->auth.identity->is_owner_of(s->bucket_owner.get_id())) { + return 0; + } - return 0; + return -EACCES; } void RGWSetBucketWebsite::pre_exec() -- 2.39.5