Skip to content

Commit a91d5a7

Browse files
author
Fabian Morgan
committed
updates to ACLs in IamSessionPolicyResolver
1 parent aa09066 commit a91d5a7

2 files changed

Lines changed: 72 additions & 22 deletions

File tree

‎hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/security/acl/iam/IamSessionPolicyResolver.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import static org.apache.hadoop.ozone.security.acl.IAccessAuthorizer.ACLType.LIST;
2727
import static org.apache.hadoop.ozone.security.acl.IAccessAuthorizer.ACLType.READ;
2828
import static org.apache.hadoop.ozone.security.acl.IAccessAuthorizer.ACLType.READ_ACL;
29+
import static org.apache.hadoop.ozone.security.acl.IAccessAuthorizer.ACLType.WRITE;
2930
import static org.apache.hadoop.ozone.security.acl.IAccessAuthorizer.ACLType.WRITE_ACL;
3031

3132
import com.fasterxml.jackson.databind.JsonNode;
@@ -875,23 +876,23 @@ enum S3Action {
875876
// Used for ListMultipartUploads API
876877
LIST_BUCKET_MULTIPART_UPLOADS("s3:ListBucketMultipartUploads", ActionKind.BUCKET, EnumSet.of(READ),
877878
EnumSet.of(READ, LIST), EnumSet.noneOf(ACLType.class)),
878-
PUT_BUCKET_ACL("s3:PutBucketAcl", ActionKind.BUCKET, EnumSet.of(READ), EnumSet.of(WRITE_ACL),
879+
PUT_BUCKET_ACL("s3:PutBucketAcl", ActionKind.BUCKET, EnumSet.of(READ), EnumSet.of(READ, READ_ACL, WRITE_ACL),
879880
EnumSet.noneOf(ACLType.class)),
880881

881882
// Object-scope
882883
ABORT_MULTIPART_UPLOAD("s3:AbortMultipartUpload", ActionKind.OBJECT, EnumSet.of(READ), EnumSet.of(READ),
883-
EnumSet.of(DELETE)),
884+
EnumSet.of(WRITE)),
884885
// Used for DeleteObject (when versionId parameter is not supplied),
885886
// DeleteObjects (when versionId parameter is not supplied) APIs
886887
DELETE_OBJECT("s3:DeleteObject", ActionKind.OBJECT, EnumSet.of(READ), EnumSet.of(READ), EnumSet.of(DELETE)),
887888
DELETE_OBJECT_TAGGING("s3:DeleteObjectTagging", ActionKind.OBJECT, EnumSet.of(READ), EnumSet.of(READ),
888-
EnumSet.of(DELETE)),
889+
EnumSet.of(WRITE)),
889890
// Used for HeadObject, CopyObject (for source bucket), GetObject (without versionId parameter) APIs
890891
GET_OBJECT("s3:GetObject", ActionKind.OBJECT, EnumSet.of(READ), EnumSet.of(READ), EnumSet.of(READ)),
891892
GET_OBJECT_TAGGING("s3:GetObjectTagging", ActionKind.OBJECT, EnumSet.of(READ), EnumSet.of(READ), EnumSet.of(READ)),
892893
// Used for ListParts API
893894
LIST_MULTIPART_UPLOAD_PARTS("s3:ListMultipartUploadParts", ActionKind.OBJECT, EnumSet.of(READ), EnumSet.of(READ),
894-
EnumSet.of(READ)),
895+
EnumSet.of(LIST)),
895896
// Used for CreateMultipartUpload, UploadPart, CompleteMultipartUpload,
896897
// CopyObject (for destination bucket), PutObject APIs
897898
PUT_OBJECT("s3:PutObject", ActionKind.OBJECT, EnumSet.of(READ), EnumSet.of(READ),

‎hadoop-ozone/common/src/test/java/org/apache/hadoop/ozone/security/acl/iam/TestIamSessionPolicyResolver.java‎

Lines changed: 67 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -770,7 +770,7 @@ public void testCreatePathsAndPermissionsWithBucketWildcardResource() {
770770
final Set<S3Action> actions = Collections.singleton(IamSessionPolicyResolver.S3Action.PUT_BUCKET_ACL);
771771
final Set<IamSessionPolicyResolver.ResourceSpec> resourceSpecs = Collections.singleton(
772772
new IamSessionPolicyResolver.ResourceSpec(S3ResourceType.BUCKET_WILDCARD, "bucket1*", null, null));
773-
final Set<IOzoneObj> writeAclObject = objSet(bucket("bucket1*"));
773+
final Set<IOzoneObj> readReadAclAndWriteAclObject = objSet(bucket("bucket1*"));
774774
final Set<IOzoneObj> readVolume = objSet(volume());
775775

776776
expectIllegalArgumentException(
@@ -781,7 +781,8 @@ public void testCreatePathsAndPermissionsWithBucketWildcardResource() {
781781
createPathsAndPermissions(VOLUME, RANGER, actions, resourceSpecs, null, objToAclsMapRanger);
782782
final Set<OzoneGrant> resultRanger = groupObjectsByAcls(objToAclsMapRanger);
783783
assertThat(resultRanger).containsExactlyInAnyOrder(
784-
new OzoneGrant(writeAclObject, acls(WRITE_ACL)), new OzoneGrant(readVolume, acls(READ)));
784+
new OzoneGrant(readReadAclAndWriteAclObject, acls(READ, READ_ACL, WRITE_ACL)),
785+
new OzoneGrant(readVolume, acls(READ)));
785786
}
786787

787788
@Test
@@ -829,6 +830,48 @@ public void testCreatePathsAndPermissionsWithObjectExactResource() {
829830
assertThat(resultRanger).containsExactly(new OzoneGrant(readObjects, acls(READ)));
830831
}
831832

833+
@Test
834+
public void testCreatePathsAndPermissionsWithDeleteObjectGrantsDeleteOnKey() {
835+
final Set<S3Action> actions = Collections.singleton(S3Action.DELETE_OBJECT);
836+
final Set<IamSessionPolicyResolver.ResourceSpec> resourceSpecs = Collections.singleton(
837+
new IamSessionPolicyResolver.ResourceSpec(S3ResourceType.OBJECT_EXACT, "bucket1", null, "key.txt"));
838+
final Set<IOzoneObj> readVolumeAndBucket = objSet(volume(), bucket("bucket1"));
839+
final Set<IOzoneObj> deleteKey = objSet(key("bucket1", "key.txt"));
840+
841+
final Map<IOzoneObj, Set<ACLType>> objToAclsMapNative = new LinkedHashMap<>();
842+
createPathsAndPermissions(VOLUME, NATIVE, actions, resourceSpecs, null, objToAclsMapNative);
843+
final Set<OzoneGrant> resultNative = groupObjectsByAcls(objToAclsMapNative);
844+
assertThat(resultNative).containsExactlyInAnyOrder(
845+
new OzoneGrant(readVolumeAndBucket, acls(READ)), new OzoneGrant(deleteKey, acls(DELETE)));
846+
847+
final Map<IOzoneObj, Set<ACLType>> objToAclsMapRanger = new LinkedHashMap<>();
848+
createPathsAndPermissions(VOLUME, RANGER, actions, resourceSpecs, null, objToAclsMapRanger);
849+
final Set<OzoneGrant> resultRanger = groupObjectsByAcls(objToAclsMapRanger);
850+
assertThat(resultRanger).containsExactlyInAnyOrder(
851+
new OzoneGrant(readVolumeAndBucket, acls(READ)), new OzoneGrant(deleteKey, acls(DELETE)));
852+
}
853+
854+
@Test
855+
public void testCreatePathsAndPermissionsWithAbortMultipartUploadGrantsWriteOnKey() {
856+
final Set<S3Action> actions = Collections.singleton(S3Action.ABORT_MULTIPART_UPLOAD);
857+
final Set<IamSessionPolicyResolver.ResourceSpec> resourceSpecs = Collections.singleton(
858+
new IamSessionPolicyResolver.ResourceSpec(S3ResourceType.OBJECT_EXACT, "bucket1", null, "key.txt"));
859+
final Set<IOzoneObj> readVolumeAndBucket = objSet(volume(), bucket("bucket1"));
860+
final Set<IOzoneObj> writeKey = objSet(key("bucket1", "key.txt"));
861+
862+
final Map<IOzoneObj, Set<ACLType>> objToAclsMapNative = new LinkedHashMap<>();
863+
createPathsAndPermissions(VOLUME, NATIVE, actions, resourceSpecs, null, objToAclsMapNative);
864+
final Set<OzoneGrant> resultNative = groupObjectsByAcls(objToAclsMapNative);
865+
assertThat(resultNative).containsExactlyInAnyOrder(
866+
new OzoneGrant(readVolumeAndBucket, acls(READ)), new OzoneGrant(writeKey, acls(WRITE)));
867+
868+
final Map<IOzoneObj, Set<ACLType>> objToAclsMapRanger = new LinkedHashMap<>();
869+
createPathsAndPermissions(VOLUME, RANGER, actions, resourceSpecs, null, objToAclsMapRanger);
870+
final Set<OzoneGrant> resultRanger = groupObjectsByAcls(objToAclsMapRanger);
871+
assertThat(resultRanger).containsExactlyInAnyOrder(
872+
new OzoneGrant(readVolumeAndBucket, acls(READ)), new OzoneGrant(writeKey, acls(WRITE)));
873+
}
874+
832875
@Test
833876
public void testCreatePathsAndPermissionsWithObjectPrefixResource() {
834877
final Set<S3Action> actions = Collections.singleton(S3Action.GET_OBJECT);
@@ -989,20 +1032,22 @@ public void testCreatePathsAndPermissionsDeduplicatesAcrossSameResourceTypes() {
9891032
.collect(Collectors.toSet());
9901033
final Set<IamSessionPolicyResolver.ResourceSpec> resourceSpecs = Collections.singleton(
9911034
new IamSessionPolicyResolver.ResourceSpec(S3ResourceType.OBJECT_EXACT, "bucket1", null, "key.txt"));
992-
final Set<IOzoneObj> readAndDeleteObject = objSet(key("bucket1", "key.txt"));
1035+
final Set<IOzoneObj> readAndDeleteAndWriteObject = objSet(key("bucket1", "key.txt"));
9931036
final Set<IOzoneObj> readObjects = objSet(bucket("bucket1"), volume());
9941037

9951038
final Map<IOzoneObj, Set<ACLType>> objToAclsMapNative = new LinkedHashMap<>();
9961039
createPathsAndPermissions(VOLUME, NATIVE, actions, resourceSpecs, null, objToAclsMapNative);
9971040
final Set<OzoneGrant> resultNative = groupObjectsByAcls(objToAclsMapNative);
9981041
assertThat(resultNative).containsExactlyInAnyOrder(
999-
new OzoneGrant(readAndDeleteObject, acls(READ, DELETE)), new OzoneGrant(readObjects, acls(READ)));
1042+
new OzoneGrant(readAndDeleteAndWriteObject, acls(READ, DELETE, WRITE)),
1043+
new OzoneGrant(readObjects, acls(READ)));
10001044

10011045
final Map<IOzoneObj, Set<ACLType>> objToAclsMapRanger = new LinkedHashMap<>();
10021046
createPathsAndPermissions(VOLUME, RANGER, actions, resourceSpecs, null, objToAclsMapRanger);
10031047
final Set<OzoneGrant> resultRanger = groupObjectsByAcls(objToAclsMapRanger);
10041048
assertThat(resultRanger).containsExactlyInAnyOrder(
1005-
new OzoneGrant(readAndDeleteObject, acls(READ, DELETE)), new OzoneGrant(readObjects, acls(READ)));
1049+
new OzoneGrant(readAndDeleteAndWriteObject, acls(READ, DELETE, WRITE)),
1050+
new OzoneGrant(readObjects, acls(READ)));
10061051
}
10071052

10081053
@Test
@@ -1973,20 +2018,24 @@ public void testWildcardActionGroupListStar() throws OMException {
19732018

19742019
// Ensure what we got is what we expected
19752020
final Set<OzoneGrant> expectedResolvedNative = new LinkedHashSet<>();
1976-
// Expected for native: READ, LIST bucket acls, READ and LIST acl on prefix "" under bucket; volume READ
1977-
final Set<IOzoneObj> readAndListsObjectsNative = objSet(bucket("my-bucket"), prefix("my-bucket", ""));
2021+
// Expected for native: READ, LIST bucket acls, LIST acl on prefix "" under bucket; volume READ
2022+
final Set<IOzoneObj> readAndListsObjectNative = objSet(bucket("my-bucket"));
19782023
final Set<IOzoneObj> readObjectNative = objSet(volume());
1979-
expectedResolvedNative.add(new OzoneGrant(readAndListsObjectsNative, acls(READ, LIST)));
2024+
final Set<IOzoneObj> listObjectNative = objSet(prefix("my-bucket", ""));
2025+
expectedResolvedNative.add(new OzoneGrant(readAndListsObjectNative, acls(READ, LIST)));
19802026
expectedResolvedNative.add(new OzoneGrant(readObjectNative, acls(READ)));
2027+
expectedResolvedNative.add(new OzoneGrant(listObjectNative, acls(LIST)));
19812028
assertThat(resolvedFromNativeAuthorizer).isEqualTo(expectedResolvedNative);
19822029

19832030
final Set<OzoneGrant> expectedResolvedRanger = new LinkedHashSet<>();
1984-
// Expected for Ranger: READ, LIST bucket acls; READ and LIST key acl for resource type KEY with key name "*";
2031+
// Expected for Ranger: READ, LIST bucket acls; LIST key acl for resource type KEY with key name "*";
19852032
// volume READ
1986-
final Set<IOzoneObj> readAndListObjectsRanger = objSet(bucket("my-bucket"), key("my-bucket", "*"));
2033+
final Set<IOzoneObj> readAndListObjectRanger = objSet(bucket("my-bucket"));
19872034
final Set<IOzoneObj> readObjectRanger = objSet(volume());
1988-
expectedResolvedRanger.add(new OzoneGrant(readAndListObjectsRanger, acls(READ, LIST)));
2035+
final Set<IOzoneObj> listObjectRanger = objSet(key("my-bucket", "*"));
2036+
expectedResolvedRanger.add(new OzoneGrant(readAndListObjectRanger, acls(READ, LIST)));
19892037
expectedResolvedRanger.add(new OzoneGrant(readObjectRanger, acls(READ)));
2038+
expectedResolvedRanger.add(new OzoneGrant(listObjectRanger, acls(LIST)));
19902039
assertThat(resolvedFromRangerAuthorizer).isEqualTo(expectedResolvedRanger);
19912040
}
19922041

@@ -2008,9 +2057,9 @@ public void testWildcardActionGroupPutStar() throws OMException {
20082057

20092058
// Ensure what we got is what we expected
20102059
final Set<OzoneGrant> expectedResolvedNative = new LinkedHashSet<>();
2011-
// Expected for native: bucket READ, WRITE_ACL acl
2060+
// Expected for native: bucket READ, READ_ACL, WRITE_ACL acl
20122061
final Set<IOzoneObj> bucketSet = objSet(bucket("my-bucket"));
2013-
final Set<ACLType> bucketAcl = acls(READ, WRITE_ACL);
2062+
final Set<ACLType> bucketAcl = acls(READ, READ_ACL, WRITE_ACL);
20142063
expectedResolvedNative.add(new OzoneGrant(bucketSet, bucketAcl));
20152064
// Expected for native: CREATE, WRITE acls on prefix "" under bucket
20162065
final Set<IOzoneObj> keyPrefixSet = objSet(prefix("my-bucket", ""));
@@ -2021,7 +2070,7 @@ public void testWildcardActionGroupPutStar() throws OMException {
20212070
assertThat(resolvedFromNativeAuthorizer).isEqualTo(expectedResolvedNative);
20222071

20232072
final Set<OzoneGrant> expectedResolvedRanger = new LinkedHashSet<>();
2024-
// Expected for Ranger: bucket READ, WRITE_ACL acl
2073+
// Expected for Ranger: bucket READ, READ_ACL, WRITE_ACL acl
20252074
expectedResolvedRanger.add(new OzoneGrant(bucketSet, bucketAcl));
20262075
// Expected for Ranger: CREATE, WRITE key acls for resource type KEY with key name "*"
20272076
final Set<IOzoneObj> rangerKeySet = objSet(key("my-bucket", "*"));
@@ -2049,17 +2098,17 @@ public void testWildcardActionGroupDeleteStar() throws OMException {
20492098

20502099
// Ensure what we got is what we expected
20512100
final Set<OzoneGrant> expectedResolvedNative = new LinkedHashSet<>();
2052-
// Expected for native: DELETE on prefix "" under bucket; bucket READ, DELETE; volume READ
2101+
// Expected for native: DELETE and WRITE on prefix "" under bucket; bucket READ, DELETE; volume READ
20532102
final Set<IOzoneObj> resourceSetNative = objSet(prefix("my-bucket", ""));
2054-
expectedResolvedNative.add(new OzoneGrant(resourceSetNative, acls(DELETE)));
2103+
expectedResolvedNative.add(new OzoneGrant(resourceSetNative, acls(DELETE, WRITE)));
20552104
expectedResolvedNative.add(new OzoneGrant(objSet(bucket("my-bucket")), acls(READ, DELETE)));
20562105
expectedResolvedNative.add(new OzoneGrant(objSet(volume()), acls(READ)));
20572106
assertThat(resolvedFromNativeAuthorizer).isEqualTo(expectedResolvedNative);
20582107

20592108
final Set<OzoneGrant> expectedResolvedRanger = new LinkedHashSet<>();
2060-
// Expected for Ranger: DELETE on resource type KEY with key name "*"; bucket READ, DELETE; volume READ
2109+
// Expected for Ranger: DELETE and WRITE on resource type KEY with key name "*"; bucket READ, DELETE; volume READ
20612110
final Set<IOzoneObj> resourceSetRanger = objSet(key("my-bucket", "*"));
2062-
expectedResolvedRanger.add(new OzoneGrant(resourceSetRanger, acls(DELETE)));
2111+
expectedResolvedRanger.add(new OzoneGrant(resourceSetRanger, acls(DELETE, WRITE)));
20632112
expectedResolvedRanger.add(new OzoneGrant(objSet(bucket("my-bucket")), acls(READ, DELETE)));
20642113
expectedResolvedRanger.add(new OzoneGrant(objSet(volume()), acls(READ)));
20652114
assertThat(resolvedFromRangerAuthorizer).isEqualTo(expectedResolvedRanger);

0 commit comments

Comments
 (0)