From f9d1ae1d153319e870c3ccaf7afdc92786cdaa3b Mon Sep 17 00:00:00 2001 From: "Adam C. Emerson" Date: Thu, 14 Sep 2017 18:07:15 -0400 Subject: [PATCH] rgw: Check payment operations in policy Add code to check s3:GetBucketRequestPayment and s3:PutBucketRequestPayment operations against bucket policy. Fixes: http://tracker.ceph.com/issues/21389 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1490278 Signed-off-by: Adam C. Emerson --- src/rgw/rgw_op.cc | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc index 39a5dee9b7158..2632550d218b6 100644 --- a/src/rgw/rgw_op.cc +++ b/src/rgw/rgw_op.cc @@ -5084,6 +5084,12 @@ void RGWOptionsCORS::execute() int RGWGetRequestPayment::verify_permission() { + if (s->iam_policy && + s->iam_policy->eval(s->env, *s->auth.identity, + rgw::IAM::s3GetBucketRequestPayment, + ARN(s->bucket)) != Effect::Allow) { + return -EACCES; + } return 0; } @@ -5099,11 +5105,16 @@ void RGWGetRequestPayment::execute() int RGWSetRequestPayment::verify_permission() { - if (false == s->auth.identity->is_owner_of(s->bucket_owner.get_id())) { - return -EACCES; + if (s->iam_policy) { + if (s->iam_policy->eval(s->env, *s->auth.identity, + rgw::IAM::s3PutBucketRequestPayment, + ARN(s->bucket)) == Effect::Allow) { + return 0; + } + } else if (s->auth.identity->is_owner_of(s->bucket_owner.get_id())) { + return 0; } - - return 0; + return -EACCES; } void RGWSetRequestPayment::pre_exec() -- 2.39.5