Skip to content

HDDS-7240. List all volume operation should go through ACL check as well in order to trigger audit logging #3770

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
smengcl merged 2 commits into from
Sep 22, 2022
Merged

HDDS-7240. List all volume operation should go through ACL check as well in order to trigger audit logging #3770

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
36ea145
Removed if condition in order to trigger ACL check everytime.
dombizita Sep 21, 2022
c71f738
Changed ozone.om.volume.listall.allowed description accordingly.
dombizita Sep 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion hadoop-hdds/common/src/main/resources/ozone-default.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -608,7 +608,11 @@
<description>
Allows everyone to list all volumes when set to true. Defaults to true.
When set to false, non-admin users can only list the volumes they have
access to. Admins can always list all volumes.
access to. Admins can always list all volumes. Note that this config
only applies to OzoneNativeAuthorizer. For other authorizers, admin
needs to set policies accordingly to allow all volume listing
e.g. for Ranger, a new policy with special volume "/" can be added to
allow group public LIST access.
</description>
</property>
<property>
Expand Down
9 changes: 3 additions & 6 deletions hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2709,12 +2709,9 @@ public List<OmVolumeArgs> listAllVolumes(String prefix, String prevKey, int
auditMap.put(OzoneConsts.USERNAME, null);
try {
metrics.incNumVolumeLists();
if (!allowListAllVolumes) {
// Only admin can list all volumes when disallowed in config
if (isAclEnabled) {
checkAcls(ResourceType.VOLUME, StoreType.OZONE, ACLType.LIST,
OzoneConsts.OZONE_ROOT, null, null);
}
if (isAclEnabled) {
checkAcls(ResourceType.VOLUME, StoreType.OZONE, ACLType.LIST,
OzoneConsts.OZONE_ROOT, null, null);
}
return volumeManager.listVolumes(null, prefix, prevKey, maxKeys);
} catch (Exception ex) {
Expand Down