rgw: revert account-related changes to get_iam_policy_from_attr()#59169
rgw: revert account-related changes to get_iam_policy_from_attr()#59169
Conversation
while bucket ARNs in iam policies don't include account names, policy evaluation does need to differentiate between buckets in different tenant namespaces when requests pass bucket/object ARNs into verify_bucket/object_permission(), those do include the bucket's tenant name. to match against those ARNs, we also need to pass the requested bucket's tenant name into get_iam_policy_from_attr() Fixes: https://tracker.ceph.com/issues/67464 Signed-off-by: Casey Bodley <[email protected]>
|
the original commit was tested successfully by @pritha-srivastava in cbodley@706bb5d#commitcomment-145269321 the only change to that commit in this PR is the addition of a commit message |
|
|
jenkins test make check |
|
passed qa in https://pulpito.ceph.com/cbodley-2024-08-12_18:08:18-rgw-wip-67464-distro-default-smithi with rerun https://pulpito.ceph.com/cbodley-2024-08-13_12:28:23-rgw-wip-67464-distro-default-smithi/ i opened ceph/s3-tests#577 to fix the existing test case and add a similar test for a tenanted bucket. i started a new run in https://pulpito.ceph.com/cbodley-2024-08-13_15:09:16-rgw-wip-67464-distro-default-smithi/ against that s3-tests branch |
Signed-off-by: Casey Bodley <[email protected]>
|
2 participants
while bucket ARNs in iam policies don't include account names, policy evaluation does need to differentiate between buckets in different tenant namespaces
when requests pass bucket/object ARNs into verify_bucket/object_permission(), those do include the bucket's tenant name. to match against those ARNs, we also need to pass the requested bucket's tenant name into get_iam_policy_from_attr()
Fixes: https://tracker.ceph.com/issues/67464
Show available Jenkins commands
jenkins retest this pleasejenkins test classic perfjenkins test crimson perfjenkins test signedjenkins test make checkjenkins test make check arm64jenkins test submodulesjenkins test dashboardjenkins test dashboard cephadmjenkins test apijenkins test docsjenkins render docsjenkins test ceph-volume alljenkins test ceph-volume toxjenkins test windowsjenkins test rook e2e