Ceph » rgw

The swift cli command can be used to set acls on buckets or objects: -r acl, -w acl. To delete an acl, it's supposed to be possible to do this by specifying an empty string. This causes swift to post to the endpoint with a header field of "x-container-read" (or write) with an empty string. This works with openstack swift, and there's no other method provided with the swift command to delete acls.

The api documentation is also not wonderfully clear on this. It does document use of "x-container-read" and "x-container-write" to set acls, and it describes use of "x-remove-container-read" "x-remove-container-write" to remove acls. The latter two appear to be provided for the benefit of client implementations that don't have a way to send empty header strings, such as (apparently) old versions of curl.

The existing logic in radosgw can't tell the difference between an empty header field, and a missing header field. So attempting to remove a swift acl using the swift command silently fails. Of course, in jewel, one could delete a swift acl by supplying an acl string including only invalid elements, but that would be wrong, and it won't work in master.

I have a commit that fixes this for jewel as part of a longer sequence in PR # 20257 . I'll pull that out and make a version of that for master too.