Merge pull request ceph#65441 from linuxbox2/wip-72915

anrao19 · web-flow · commit d4b46f37c5a8 · 2025-09-23T11:29:27.000+05:30
rgw: fix policy enforcement for GetObjectAttributes
diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
@@ -6235,10 +6235,7 @@ int RGWGetObjAttrs::verify_permission(optional_yield y)
       rgw_iam_add_objtags(this, s, has_s3_existing_tag, has_s3_resource_tag);
     }
 
-    /* XXXX the following conjunction should be &&--but iam_action2 is currently not
-     * hooked up and always fails (but should succeed if the requestor has READ
-     * acess to the object) */
-    perm = (verify_object_permission(this, s, iam_action1) || /* && */
+    perm = (verify_object_permission(this, s, iam_action1) &&
 	    verify_object_permission(this, s, iam_action2));
   }
 
diff --git a/src/rgw/rgw_op.h b/src/rgw/rgw_op.h
@@ -2224,7 +2224,6 @@ class RGWGetHealthCheck : public RGWOp {
   }
 };
 
-
 class RGWDeleteMultiObj : public RGWOp {
   /**
    * Handles the deletion of an individual object and uses

Original file line number	Diff line number	Diff line change
`@@ -6235,10 +6235,7 @@ int RGWGetObjAttrs::verify_permission(optional_yield y)`
`6235`	`6235`	`rgw_iam_add_objtags(this, s, has_s3_existing_tag, has_s3_resource_tag);`
`6236`	`6236`	`}`
`6237`	`6237`
`6238`		`- /* XXXX the following conjunction should be &&--but iam_action2 is currently not`
`6239`		`- * hooked up and always fails (but should succeed if the requestor has READ`
`6240`		`- * acess to the object) */`
`6241`		`- perm = (verify_object_permission(this, s, iam_action1) \|\| /* && */`
	`6238`	`+ perm = (verify_object_permission(this, s, iam_action1) &&`
`6242`	`6239`	`verify_object_permission(this, s, iam_action2));`
`6243`	`6240`	`}`
`6244`	`6241`
Original file line number	Diff line number	Diff line change
`@@ -2224,7 +2224,6 @@ class RGWGetHealthCheck : public RGWOp {`
`2224`	`2224`	`}`
`2225`	`2225`	`};`
`2226`	`2226`
`2227`		`-`
`2228`	`2227`	`class RGWDeleteMultiObj : public RGWOp {`
`2229`	`2228`	`/**`
`2230`	`2229`	`* Handles the deletion of an individual object and uses`