RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2025-03-25 11:48:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

rgw: deny writes to a secondary zone by non-system users

Browse Source 
Fixes: #6678
We don't want to allow regular users to write to secondary zones,
otherwise we'd end up with data inconsistencies.

Reviewed-by: Josh Durgin <josh.durgin@inktank.com>
Signed-off-by: Yehuda Sadeh <yehuda@inktank.com>
This commit is contained in:
Yehuda Sadeh 2013-11-05 14:54:20 -08:00
parent d8f05024e7
commit 84fb1bf3ee
3 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/rgw/rgw_op.cc
View File

@ -418,6 +418,11 @@ int RGWOp::verify_op_mask()
return -EPERM;
}
if (!s->system_request && (required_mask & RGW_OP_TYPE_MODIFY) && !store->zone.is_master) {
ldout(s->cct, 5) << "NOTICE: modify request to a non-master zone by a non-system user, permission denied" << dendl;
return -EPERM;
}
return 0;
}

4
src/rgw/rgw_rados.cc
View File

@ -362,6 +362,10 @@ int RGWZoneParams::init(CephContext *cct, RGWRados *store, RGWRegion& region)
return -EIO;
}
is_master = (name == region.master_zone) || (region.master_zone.empty() && name == "default");
ldout(cct, 2) << "zone " << name << " is " << (is_master ? "" : "NOT ") << "master" << dendl;
return 0;
}

3
src/rgw/rgw_rados.h
View File

@ -428,11 +428,14 @@ struct RGWZoneParams {
rgw_bucket user_uid_pool;
string name;
bool is_master;
RGWAccessKey system_key;
map<string, RGWZonePlacementInfo> placement_pools;
RGWZoneParams() : is_master(false) {}
static int get_pool_name(CephContext *cct, string *pool_name);
void init_name(CephContext *cct, RGWRegion& region);
int init(CephContext *cct, RGWRados *store, RGWRegion& region);