Merge pull request ceph#62020 from cbodley/wip-70191

adamemerson · web-flow · commit 3d80385e874d · 2025-03-05T17:53:11.000-05:00
rgw: use object ARN for InitMultipart permissions

Reviewed-by: J. Eric Ivancich &lt;ivancich@redhat.com&gt;
diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
@@ -6618,7 +6618,8 @@ int RGWInitMultipart::verify_permission(optional_yield y)
   // add server-side encryption headers
   rgw_iam_add_crypt_attrs(s->env, s->info.crypt_attribute_map);
 
-  if (!verify_bucket_permission(this, s, rgw::IAM::s3PutObject)) {
+  if (!verify_bucket_permission(this, s, ARN(s->object->get_obj()),
+                                rgw::IAM::s3PutObject)) {
     return -EACCES;
   }
 

Original file line number	Diff line number	Diff line change
`@@ -6618,7 +6618,8 @@ int RGWInitMultipart::verify_permission(optional_yield y)`
`6618`	`6618`	`// add server-side encryption headers`
`6619`	`6619`	`rgw_iam_add_crypt_attrs(s->env, s->info.crypt_attribute_map);`
`6620`	`6620`
`6621`		`- if (!verify_bucket_permission(this, s, rgw::IAM::s3PutObject)) {`
	`6621`	`+ if (!verify_bucket_permission(this, s, ARN(s->object->get_obj()),`
	`6622`	`+ rgw::IAM::s3PutObject)) {`
`6622`	`6623`	`return -EACCES;`
`6623`	`6624`	`}`
`6624`	`6625`