Storage node doesn't respect group policies #1190

New issue

Closed

opened 2024-06-19 14:12:36 +00:00 by dkirillov · 1 comment

dkirillov commented

2024-06-19 14:12:36 +00:00

Member

Expected Behavior

User can put object if he belongs to group that has rights to do this.

Current Behavior

User cannot put object

rpc error: client failure: status: code = 2048 message = access to object operation denied: ape denied request: method PutObject: NoRuleFound

Possible Solution

We need to take into account user groups policies in the following places

Steps to Reproduce (for bugs)

Create frostfsid user:

frostfs-dev-env$ frostfs-adm -c frostfs-adm.yml morph frostfsid create-subject --subject-key 031a6c6fbbdf02ca351745fa86b9ba5a9452d785ac4f7fc2b7548ca2a46c4fcf4a --subject-name devenv

Create frostfsid group:

frostfs-dev-env$ frostfs-adm -c frostfs-adm.yml morph frostfsid create-group --group-name some-group
Waiting for transactions to persist...
group 'some-group' created with id: 2

Add user to group:

frostfs-dev-env$ frostfs-adm -c frostfs-adm.yml morph frostfsid add-subject-to-group --group-id 2 --subject-address NbUgTSFvPmsRxmGeWpuuGeJUoRoi6PErcM

Add the following chain to policy contract

{
  "ID": "dGVzdA==",
  "Rules": [{
      "Status": "Allow",
      "Actions": {
        "Inverted": false,
        "Names": ["PutObject"]
      },
      "Resources": {
        "Inverted": false,
        "Names": ["native:object/*"]
      },
      "Any": false,
      "Condition": [{
          "Op": "SliceContains",
          "Kind": "Request",
          "Key": "frostfsid:groupID",
          "Value": "2"
      }]
  }],
  "MatchType": "DenyPriority"
}

Create container:

frostfs-dev-env$ frostfs-cli -r s01.frostfs.devenv:8080 -w wallets/wallet.json container create  --policy 'REP 1' --basic-acl 0x0 --await

Enter password > 
CID: 6hbNVQsf7pWkVRs4AVundoDYbYLhLup6HMY5hqmnyPmi
awaiting...
container has been persisted on sidechain

Try to put object:

frostfs-dev-env$ frostfs-cli object put -r s01.frostfs.devenv:8080 --cid 6hbNVQsf7pWkVRs4AVundoDYbYLhLup6HMY5hqmnyPmi --file frostfs-adm.yml  -w wallets/wallet.json

Enter password > 
 402 / 402 [==================================================================================================================================================] 100.00% 0s
rpc error: client failure: status: code = 2048 message = access to object operation denied: ape denied request: method PutObject: NoRuleFound

Context

The initial problem was: cannot create bucket using s3. This has happened because after container creation we update bucket settings (that is stored as node in tree service). And because storage node doesn't handle group policies user doesn't have permission to use tree service

Regression

Probably not.

Your Environment

Version used: v0.40.0
Server setup and configuration: devenv

## Expected Behavior User can put object if he belongs to group that has rights to do this. ## Current Behavior User cannot put object ``` rpc error: client failure: status: code = 2048 message = access to object operation denied: ape denied request: method PutObject: NoRuleFound ``` ## Possible Solution We need to take into account user groups policies in the following places * [tree ape](https://git.frostfs.info/TrueCloudLab/frostfs-node/src/commit/75eedf71f31c8d0d68500779954e708fa884c3ee/pkg/services/tree/ape.go#L164) * [object ape](https://git.frostfs.info/TrueCloudLab/frostfs-node/src/commit/75eedf71f31c8d0d68500779954e708fa884c3ee/pkg/services/object/ape/checker.go#L188) * [container ape 1](https://git.frostfs.info/TrueCloudLab/frostfs-node/src/commit/75eedf71f31c8d0d68500779954e708fa884c3ee/pkg/services/container/ape.go#L323) * [container ape 2](https://git.frostfs.info/TrueCloudLab/frostfs-node/src/commit/75eedf71f31c8d0d68500779954e708fa884c3ee/pkg/services/container/ape.go#L230) * [container ape 3](https://git.frostfs.info/TrueCloudLab/frostfs-node/src/commit/75eedf71f31c8d0d68500779954e708fa884c3ee/pkg/services/container/ape.go#L172) ## Steps to Reproduce (for bugs) 1. Create frostfsid user: ``` frostfs-dev-env$ frostfs-adm -c frostfs-adm.yml morph frostfsid create-subject --subject-key 031a6c6fbbdf02ca351745fa86b9ba5a9452d785ac4f7fc2b7548ca2a46c4fcf4a --subject-name devenv ``` 2. Create frostfsid group: ``` frostfs-dev-env$ frostfs-adm -c frostfs-adm.yml morph frostfsid create-group --group-name some-group Waiting for transactions to persist... group 'some-group' created with id: 2 ``` 3. Add user to group: ``` frostfs-dev-env$ frostfs-adm -c frostfs-adm.yml morph frostfsid add-subject-to-group --group-id 2 --subject-address NbUgTSFvPmsRxmGeWpuuGeJUoRoi6PErcM ``` 4. Add the following chain to `policy` contract ```json { "ID": "dGVzdA==", "Rules": [{ "Status": "Allow", "Actions": { "Inverted": false, "Names": ["PutObject"] }, "Resources": { "Inverted": false, "Names": ["native:object/*"] }, "Any": false, "Condition": [{ "Op": "SliceContains", "Kind": "Request", "Key": "frostfsid:groupID", "Value": "2" }] }], "MatchType": "DenyPriority" } ``` 5. Create container: ``` frostfs-dev-env$ frostfs-cli -r s01.frostfs.devenv:8080 -w wallets/wallet.json container create --policy 'REP 1' --basic-acl 0x0 --await Enter password > CID: 6hbNVQsf7pWkVRs4AVundoDYbYLhLup6HMY5hqmnyPmi awaiting... container has been persisted on sidechain ``` 6. Try to put object: ``` frostfs-dev-env$ frostfs-cli object put -r s01.frostfs.devenv:8080 --cid 6hbNVQsf7pWkVRs4AVundoDYbYLhLup6HMY5hqmnyPmi --file frostfs-adm.yml -w wallets/wallet.json Enter password > 402 / 402 [==================================================================================================================================================] 100.00% 0s rpc error: client failure: status: code = 2048 message = access to object operation denied: ape denied request: method PutObject: NoRuleFound ``` ## Context The initial problem was: cannot create bucket using s3. This has happened because after container creation we update bucket settings (that is stored as node in tree service). And because storage node doesn't handle group policies user doesn't have permission to use tree service ## Regression Probably not. ## Your Environment  * Version used: v0.40.0 * Server setup and configuration: devenv