Delete operation not allowed with Bearer token and eACL with deny all operations (complex object) #700

New issue

Open

opened 2023-09-20 13:40:50 +00:00 by anikeev-yadro · 1 comment

anikeev-yadro commented

2023-09-20 13:40:50 +00:00

Member

May be related to #687

Autotest

testsuites.acl.test_bearer.TestACLBearer#test_bearer_token_compound_operations
testsuites.acl.test_bearer.TestACLBearer#test_bearer_token_operations

Expected Behavior

Delete operation should be allowed with Bearer token (complex object).

Current Behavior

Delete operation not allowed with Bearer token (complex object).

Steps to Reproduce (for bugs)

Create container
PUT object
Set deny all operations for others via eACL
Create bearer token for others with all operations allowed
Check others with token has access to all operations with container. Cannot delete object from container:

COMMAND: frostfs-cli --config /jenkins/workspace/sbercloud_functional_tests_nightly/tmp.ymWkhkOMZZ/frostfs-testcases/wallet_config.yml object delete --rpc-endpoint '172.26.161.185:8080' --wallet '/jenkins/workspace/sbercloud_functional_tests_nightly/tmp.ymWkhkOMZZ/frostfs-testcases/TemporaryDir/1de0d0f7-527b-4575-8313-d7d4a4b1468f.json' --cid 'J1DuMViuG8hAWEeKS64DgXPfxk8bWbn7ZNqVgkpkcfK1' --oid '9Yy434brzL8s6Bv5FbFCV4s8f3h3NrTTURzexcNbMV56' --bearer '/jenkins/workspace/sbercloud_functional_tests_nightly/tmp.ymWkhkOMZZ/frostfs-testcases/TemporaryDir/75280e62-91f9-4057-b309-738a1728b091'
RETCODE: 2

STDOUT:
failed to search objects by split ID: read object list: status: code = 2048 message = access to object operation denied: access to operation OBJECT_SEARCH is denied by extended ACL check: denied by rule

STDERR:

Start / End / Elapsed	 00:09:04.818412 / 00:09:05.183623 / 0:00:00.365211

Regression

Yes

Version

0.37.0-rc.1-2-g368774be

Your Environment

Cloud

May be related to #687 ## Autotest testsuites.acl.test_bearer.TestACLBearer#test_bearer_token_compound_operations testsuites.acl.test_bearer.TestACLBearer#test_bearer_token_operations ## Expected Behavior Delete operation should be allowed with Bearer token (complex object). ## Current Behavior Delete operation not allowed with Bearer token (complex object). ## Steps to Reproduce (for bugs) 1. Create container 2. PUT object 3. Set deny all operations for others via eACL 4. Create bearer token for others with all operations allowed 5. Check others with token has access to all operations with container. Cannot delete object from container: ``` COMMAND: frostfs-cli --config /jenkins/workspace/sbercloud_functional_tests_nightly/tmp.ymWkhkOMZZ/frostfs-testcases/wallet_config.yml object delete --rpc-endpoint '172.26.161.185:8080' --wallet '/jenkins/workspace/sbercloud_functional_tests_nightly/tmp.ymWkhkOMZZ/frostfs-testcases/TemporaryDir/1de0d0f7-527b-4575-8313-d7d4a4b1468f.json' --cid 'J1DuMViuG8hAWEeKS64DgXPfxk8bWbn7ZNqVgkpkcfK1' --oid '9Yy434brzL8s6Bv5FbFCV4s8f3h3NrTTURzexcNbMV56' --bearer '/jenkins/workspace/sbercloud_functional_tests_nightly/tmp.ymWkhkOMZZ/frostfs-testcases/TemporaryDir/75280e62-91f9-4057-b309-738a1728b091' RETCODE: 2 STDOUT: failed to search objects by split ID: read object list: status: code = 2048 message = access to object operation denied: access to operation OBJECT_SEARCH is denied by extended ACL check: denied by rule STDERR: Start / End / Elapsed 00:09:04.818412 / 00:09:05.183623 / 0:00:00.365211 ``` ## Regression Yes ## Version ``` 0.37.0-rc.1-2-g368774be ``` ## Your Environment Cloud

anikeev-yadro added the

bug

triage

labels 2023-09-20 13:40:50 +00:00

dstepanov-yadro self-assigned this 2023-09-21 07:54:59 +00:00

dstepanov-yadro removed their assignment 2023-09-21 14:08:25 +00:00

dstepanov-yadro commented

2023-09-21 14:10:06 +00:00

Member

How to reproduce:

In the cmd/frostfs-cli/module/object/util file.go comment out the lines:

splitInfo:= arr split.Split Into() 

//if members, ok := tryGetSplitMembersByLinkingObject(cmd, splitInfo, prmHead, cnr); ok { 
// return members 
//} 

if members, ok:=tryGetSplitMembersBySplitID(cmd, splitInfo, cli, clr); ok { return members } 

returntryRestoreChainInReverse(cmd, splitInfo, prmHead, cli, cnr, obj)

Run tests again dev-env
The bug is that the tryGetSplitMembersBySplitID method does Search, and the bearer token is not used.

How to reproduce: In the `cmd/frostfs-cli/module/object/util file.go` comment out the lines: ``` splitInfo:= arr split.Split Into() //if members, ok := tryGetSplitMembersByLinkingObject(cmd, splitInfo, prmHead, cnr); ok { // return members //} if members, ok:=tryGetSplitMembersBySplitID(cmd, splitInfo, cli, clr); ok { return members } returntryRestoreChainInReverse(cmd, splitInfo, prmHead, cli, cnr, obj) ``` Run tests again dev-env The bug is that the tryGetSplitMembersBySplitID method does Search, and the bearer token is not used.