Ceph » rgw

This error can also be reproduced by attaching the above policy to a bucket, and then a user (not bucket owner )trying to get a non-existent object from the bucket. This happens even before the bucket policy rule is evaluated. It fails while reading permissions. (I think a non owner isn't allowed to Read permissions for the bucket). I need to dig deeper and will update when I find the reason.

I checked further and can see that while evaluating permissions, if the object is not found, the bucket acls are checked to see if there is any read acl set for the non owner user, and if it is not, then AccessDenied is returned. I also tried by setting a read acl on the bucket, and in that case the correct error 404 is returned. So we may need to modify code to return 404 when the object is not found, irrespective of whether a read acl is set on the bucket (for the non owner user) or not.

Pritha Srivastava wrote:

I checked further and can see that while evaluating permissions, if the object is not found, the bucket acls are checked to see if there is any read acl set for the non owner user, and if it is not, then AccessDenied is returned. I also tried by setting a read acl on the bucket, and in that case the correct error 404 is returned. So we may need to modify code to return 404 when the object is not found, irrespective of whether a read acl is set on the bucket (for the non owner user) or not.

On second thoughts,

RGW behaves correctly as far as acl evaluation is concerned and returns the correct error code (that is 404 when acl corresponding to ListBucket is set and 403 when that acl is not set), the correct way to solve this would be evaluate bucket policies as well after evaluating the ACLs.

We could add a special case to the permission check to return 404 if the object doesn't exist?

Adam Emerson wrote:

We could add a special case to the permission check to return 404 if the object doesn't exist?

Adam, this error is returned while reading the permissions while building object policies (before perm evaluation), it already has a special case for non-existent objects, where it checks for acls and if the correct acl is present on the bucket, then 404 is returned else 403 is returned (which is correct according to AWS spec). We need to evaluate bucket policies also in this place to be able to return the correct error code (may be just call the correct verify_permission method which takes both acls and bucket policies into account)

https://github.com/ceph/ceph/pull/27309