WIP: object: Ignore APE check for PutSingle with tombstone object #1051

aarifullin · 2024-03-19T11:44:27Z

aarifullin commented

2024-03-19 11:44:27 +00:00

When a client requests DeleteObject, delete service may send PutSingle with tombstone object type to several nodes. If APE allows deletes, but denies puts, then PutSingle cannot be performed although it is being performed in the delete context. So, check for putting tombstone is ignored.

* When a client requests DeleteObject, delete service may send PutSingle with tombstone object type to several nodes. If APE allows deletes, but denies puts, then PutSingle cannot be performed although it is being performed in the delete context. So, check for putting tombstone is ignored. cc @dkirillov

aarifullin added the

bug

discussion

labels 2024-03-19 11:44:27 +00:00

aarifullin requested review from storage-core-committers 2024-03-19 11:44:38 +00:00

aarifullin requested review from storage-core-developers 2024-03-19 11:44:38 +00:00

aarifullin force-pushed fix/object_ape_ignore_tombstone from fcec701f7d to 740cfe4ac1

2024-03-19 11:46:01 +00:00

Compare

fyrchik reviewed 2024-03-19 11:52:32 +00:00

pkg/services/object/ape/checker.go

													
				@ -78,2 +78,4 @@

					}

					if prm.Method == nativeschema.MethodPutObject &&

						r.Resource().Property(nativeschema.PropertyKeyObjectType) == objectV2.TypeTombstone.String() {

fyrchik commented

2024-03-19 11:52:31 +00:00

So anyone can delete any object?

aarifullin commented

2024-03-19 15:11:36 +00:00

Poster

This approach need to be reconsidered...

fyrchik changed title from ~~object: Ignore APE check for PutSingle with tombstone object~~ to WIP: object: Ignore APE check for PutSingle with tombstone object

2024-03-20 06:02:07 +00:00

fyrchik closed this pull request

2024-03-27 09:06:40 +00:00

Tests and linters / Tests with -race (pull_request) Failing after 4m21s

Details

DCO action / DCO (pull_request) Successful in 6m58s

Details

Vulncheck / Vulncheck (pull_request) Successful in 6m58s

Details

Build / Build Components (1.21) (pull_request) Successful in 9m31s

Details

Build / Build Components (1.20) (pull_request) Successful in 9m44s