From 4c18ac124048f72a10d92aecfe1eadabab0a80b4 Mon Sep 17 00:00:00 2001 From: "Adam C. Emerson" Date: Wed, 27 Sep 2017 14:35:59 -0400 Subject: [PATCH] rgw: Check bucket versioning operations in policy Add code to check s3:GetBucketVersioning and s3:PutBucketVersioning operations against bucket policy. Fixes: http://tracker.ceph.com/issues/21389 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1490278 Signed-off-by: Adam C. Emerson (cherry picked from commit 16de0fc1c5ede961ebd481f13753214a971c206c) --- src/rgw/rgw_op.cc | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc index 9223618a337..24c22f72d8a 100644 --- a/src/rgw/rgw_op.cc +++ b/src/rgw/rgw_op.cc @@ -2017,11 +2017,16 @@ void RGWStatAccount::execute() int RGWGetBucketVersioning::verify_permission() { - if (false == s->auth.identity->is_owner_of(s->bucket_owner.get_id())) { - return -EACCES; + if (s->iam_policy) { + if (s->iam_policy->eval(s->env, *s->auth.identity, + rgw::IAM::s3GetBucketVersioning, + ARN(s->bucket)) == Effect::Allow) { + return 0; + } + } else if (s->auth.identity->is_owner_of(s->bucket_owner.get_id())) { + return 0; } - - return 0; + return -EACCES; } void RGWGetBucketVersioning::pre_exec() @@ -2037,11 +2042,16 @@ void RGWGetBucketVersioning::execute() int RGWSetBucketVersioning::verify_permission() { - if (false == s->auth.identity->is_owner_of(s->bucket_owner.get_id())) { - return -EACCES; + if (s->iam_policy) { + if (s->iam_policy->eval(s->env, *s->auth.identity, + rgw::IAM::s3PutBucketVersioning, + ARN(s->bucket)) == Effect::Allow) { + return 0; + } + } else if (s->auth.identity->is_owner_of(s->bucket_owner.get_id())) { + return 0; } - - return 0; + return -EACCES; } void RGWSetBucketVersioning::pre_exec() -- 2.47.3