Merge pull request ceph#64152 from cbodley/wip-63323

rgw: support S3 Object Ownership controls to disable object ACLs

Reviewed-by: Adam Emerson <[email protected]>

Author: yuriw

PendingReleaseNotes

@@ -63,6 +63,7 @@
    - osd_op_num_shards_hdd = 1 (was 5)
    - osd_op_num_threads_per_shard_hdd = 5 (was 1)
   For more details see https://tracker.ceph.com/issues/66289.
+* RGW: Added support for S3 Object Ownership to disable object ACLs.
 * MGR: The Ceph Manager's always-on modulues/plugins can now be force-disabled.
   This can be necessary when we wish to prevent the Manager from being
   flooded by module commands when Ceph services are down or degraded.

doc/radosgw/s3.rst

@@ -84,6 +84,8 @@ The following table describes the support status for current Amazon S3 functiona
 +---------------------------------+-----------------+--------------------------------------------------+
 | **Bucket Logging**              | Supported       |                                                  |
 +---------------------------------+-----------------+--------------------------------------------------+
+| **Object Ownership**            | Supported       |                                                  |
++---------------------------------+-----------------+--------------------------------------------------+
 
 Unsupported Header Fields
 -------------------------

doc/radosgw/s3/bucketops.rst

@@ -45,6 +45,9 @@ Parameters
 +--------------------------------------+-------------------------------+-----------------------------------------------+------------+
 | ``x-amz-bucket-object-lock-enabled`` | Enable object lock on bucket. | ``true``, ``false``                           | No         |
 +--------------------------------------+-------------------------------+-----------------------------------------------+------------+
+| ``x-amz-object-ownership``           | Set ownership controls.       | ``BucketOwnerEnforced``,                      | No         |
+|                                      |                               | ``BucketOwnerPreferred``, ``ObjectWriter``    |            |
++--------------------------------------+-------------------------------+-----------------------------------------------+------------+
 
 Request Entities
 ~~~~~~~~~~~~~~~~

src/rgw/CMakeLists.txt

@@ -72,6 +72,7 @@ set(librgw_common_srcs
   rgw_multi_del.cc
   rgw_multipart_meta_filter.cc
   rgw_obj_manifest.cc
+  rgw_object_ownership.cc
   rgw_period.cc
   rgw_realm.cc
   rgw_sync.cc

src/rgw/driver/rados/rgw_data_sync.cc

@@ -2693,6 +2693,7 @@ int RGWUserPermHandler::Bucket::init(RGWUserPermHandler *handler,
              info->env,
              info->identity.get(),
              bucket_info,
+             rgw::s3::ObjectOwnership::ObjectWriter,
              info->identity->get_perm_mask(),
              false, /* defer to bucket acls */
              nullptr, /* referer */

src/rgw/rgw_acl_s3.cc

@@ -677,14 +677,32 @@ void write_policy_xml(const RGWAccessControlPolicy& policy,
 
 int create_canned_acl(const ACLOwner& owner,
                       const ACLOwner& bucket_owner,
+                      ObjectOwnership object_ownership,
                       const std::string& canned_acl,
-                      RGWAccessControlPolicy& policy)
+                      RGWAccessControlPolicy& policy,
+                      std::string& error_message)
 {
   if (owner.id == parse_owner("anonymous")) {
     policy.set_owner(bucket_owner);
   } else {
     policy.set_owner(owner);
   }
+
+  // special handling for BucketOwnerEnforced/Preferred
+  if (object_ownership == ObjectOwnership::BucketOwnerEnforced) {
+    // only supports bucket-owner-full-control
+    if (canned_acl != "" && canned_acl != "bucket-owner-full-control") {
+      error_message = "Cannot set ACLs when ObjectOwnership is BucketOwnerEnforced.";
+      return -ERR_ACLS_NOT_SUPPORTED;
+    }
+    policy.set_owner(bucket_owner);
+  } else if (object_ownership == ObjectOwnership::BucketOwnerPreferred) {
+    // prefer bucket owner only for bucket-owner-full-control
+    if (canned_acl == "bucket-owner-full-control") {
+      policy.set_owner(bucket_owner);
+    }
+  }
+
   return create_canned(owner, bucket_owner, canned_acl, policy.get_acl());
 }
 

src/rgw/rgw_acl_s3.h

@@ -11,6 +11,7 @@
 #include "common/async/yield_context.h"
 #include "rgw_xml.h"
 #include "rgw_acl.h"
+#include "rgw_object_ownership.h"
 #include "rgw_sal_fwd.h"
 
 class RGWEnv;
@@ -34,8 +35,10 @@ void write_policy_xml(const RGWAccessControlPolicy& policy,
 /// Construct a policy from a s3 canned acl string.
 int create_canned_acl(const ACLOwner& owner,
                       const ACLOwner& bucket_owner,
+                      ObjectOwnership object_ownership,
                       const std::string& canned_acl,
-                      RGWAccessControlPolicy& policy);
+                      RGWAccessControlPolicy& policy,
+                      std::string& error_message);
 
 /// Construct a policy from x-amz-grant-* request headers.
 int create_policy_from_headers(const DoutPrefixProvider* dpp,

src/rgw/rgw_bucket.cc

@@ -140,7 +140,14 @@ int rgw_chown_bucket_and_objects(rgw::sal::Driver* driver, rgw::sal::Bucket* buc
   int ret = bucket->chown(dpp, new_user->get_id(), new_user->get_display_name(),
                           y);
   if (ret < 0) {
-    set_err_msg(err_msg, "Failed to change object ownership: " + cpp_strerror(-ret));
+    set_err_msg(err_msg, "Failed to change bucket ownership: " + cpp_strerror(-ret));
+    return ret;
+  }
+
+  // skip object acls when BucketOwnerEnforced
+  if (auto ownership = rgw::s3::get_object_ownership(bucket->get_attrs());
+      ownership == rgw::s3::ObjectOwnership::BucketOwnerEnforced) {
+    return 0;
   }
 
   /* Now chown on all the objects in the bucket */

src/rgw/rgw_common.cc

@@ -145,6 +145,9 @@ rgw_http_errors rgw_http_s3_errors({
     { ECANCELED, {409, "ConcurrentModification"}},
     { EDQUOT, {507, "InsufficientCapacity"}},
     { ENOSPC, {507, "InsufficientCapacity"}},
+    { ERR_ACLS_NOT_SUPPORTED, {400, "AccessControlListNotSupported"}},
+    { ERR_INVALID_BUCKET_ACL, {400, "InvalidBucketAclWithObjectOwnership"}},
+    { ERR_NO_SUCH_OWNERSHIP_CONTROLS, {404, "OwnershipControlsNotFoundError"}},
 });
 
 rgw_http_errors rgw_http_swift_errors({
@@ -1118,6 +1121,7 @@ struct perm_state_from_req_state : public perm_state_base {
 		      _s->env,
 		      _s->auth.identity.get(),
 		      _s->bucket.get() ? _s->bucket->get_info() : RGWBucketInfo(),
+		      _s->bucket_object_ownership,
 		      _s->perm_mask,
 		      _s->defer_to_bucket_acls,
 		      _s->bucket_access_conf),
@@ -1625,11 +1629,12 @@ bool verify_object_permission_no_policy(const DoutPrefixProvider* dpp,
     return true;
   }
 
-  bool ret = object_acl.verify_permission(dpp, *ps->identity, ps->perm_mask, perm,
-					  nullptr, /* http referrer */
-					  ps->bucket_access_conf &&
-					  ps->bucket_access_conf->ignore_public_acls());
-  if (ret) {
+  // object ACLs don't apply for BucketOwnerEnforced
+  if (ps->bucket_object_ownership != rgw::s3::ObjectOwnership::BucketOwnerEnforced &&
+      object_acl.verify_permission(dpp, *ps->identity, ps->perm_mask, perm,
+                                   nullptr, /* http referrer */
+                                   ps->bucket_access_conf &&
+                                   ps->bucket_access_conf->ignore_public_acls())) {
     ldpp_dout(dpp, 10) << __func__ << ": granted by object acl" << dendl;
     if (granted_by_acl) {
       *granted_by_acl = true;
@@ -1638,7 +1643,7 @@ bool verify_object_permission_no_policy(const DoutPrefixProvider* dpp,
   }
 
   if (!ps->cct->_conf->rgw_enforce_swift_acls)
-    return ret;
+    return false;
 
   if ((perm & (int)ps->perm_mask) != perm)
     return false;

src/rgw/rgw_common.h

@@ -43,6 +43,7 @@
 #include "common/async/yield_context.h"
 #include "rgw_website.h"
 #include "rgw_object_lock.h"
+#include "rgw_object_ownership.h"
 #include "rgw_tag.h"
 #include "rgw_op_type.h"
 #include "rgw_sync_policy.h"
@@ -121,6 +122,8 @@ using ceph::crypto::MD5;
 #define RGW_ATTR_OBJECT_RETENTION   RGW_ATTR_PREFIX "object-retention"
 #define RGW_ATTR_OBJECT_LEGAL_HOLD  RGW_ATTR_PREFIX "object-legal-hold"
 
+// S3 Object Ownership
+#define RGW_ATTR_OWNERSHIP_CONTROLS RGW_ATTR_PREFIX "ownership-controls"
 
 #define RGW_ATTR_PG_VER 	RGW_ATTR_PREFIX "pg_ver"
 #define RGW_ATTR_SOURCE_ZONE    RGW_ATTR_PREFIX "source_zone"
@@ -350,6 +353,9 @@ inline constexpr const char* RGW_REST_STS_XMLNS =
 #define ERR_PRESIGNED_URL_DISABLED     2224
 #define ERR_AUTHORIZATION        2225 // SNS 403 AuthorizationError
 #define ERR_ILLEGAL_LOCATION_CONSTRAINT_EXCEPTION 2226
+#define ERR_ACLS_NOT_SUPPORTED   2227 // 400 AccessControlListNotSupported
+#define ERR_INVALID_BUCKET_ACL   2228 // 400 InvalidBucketAclWithObjectOwnership
+#define ERR_NO_SUCH_OWNERSHIP_CONTROLS 2229 // 404 OwnershipControlsNotFoundError
 
 #define ERR_BUSY_RESHARDING      2300 // also in cls_rgw_types.h, don't change!
 #define ERR_NO_SUCH_ENTITY       2301
@@ -1382,6 +1388,7 @@ struct req_state : DoutPrefixProvider {
   rgw::IAM::Environment env;
   boost::optional<rgw::IAM::Policy> iam_policy;
   boost::optional<PublicAccessBlockConfiguration> bucket_access_conf;
+  rgw::s3::ObjectOwnership bucket_object_ownership = rgw::s3::ObjectOwnership::ObjectWriter;
   std::vector<rgw::IAM::Policy> iam_identity_policies;
 
   /* Is the request made by an user marked as a system one?
@@ -1696,6 +1703,7 @@ struct perm_state_base {
   const rgw::IAM::Environment& env;
   rgw::auth::Identity *identity;
   const RGWBucketInfo bucket_info;
+  rgw::s3::ObjectOwnership bucket_object_ownership;
   int perm_mask;
   bool defer_to_bucket_acls;
   boost::optional<PublicAccessBlockConfiguration> bucket_access_conf;
@@ -1704,13 +1712,15 @@ struct perm_state_base {
                   const rgw::IAM::Environment& _env,
                   rgw::auth::Identity *_identity,
                   const RGWBucketInfo& _bucket_info,
+                  rgw::s3::ObjectOwnership bucket_object_ownership,
                   int _perm_mask,
                   bool _defer_to_bucket_acls,
                   boost::optional<PublicAccessBlockConfiguration> _bucket_access_conf = boost::none) :
                                                 cct(_cct),
                                                 env(_env),
                                                 identity(_identity),
                                                 bucket_info(_bucket_info),
+                                                bucket_object_ownership(bucket_object_ownership),
                                                 perm_mask(_perm_mask),
                                                 defer_to_bucket_acls(_defer_to_bucket_acls),
                                                 bucket_access_conf(_bucket_access_conf)
@@ -1733,13 +1743,15 @@ struct perm_state : public perm_state_base {
              const rgw::IAM::Environment& _env,
              rgw::auth::Identity *_identity,
              const RGWBucketInfo& _bucket_info,
+             rgw::s3::ObjectOwnership bucket_object_ownership,
              int _perm_mask,
              bool _defer_to_bucket_acls,
              const char *_referer,
              bool _request_payer) : perm_state_base(_cct,
                                                     _env,
                                                     _identity,
                                                     _bucket_info,
+                                                    bucket_object_ownership,
                                                     _perm_mask,
                                                     _defer_to_bucket_acls),
                                     referer(_referer),