Implement support for deny ACLs #1798

glpatcern · 2021-06-16T12:45:45Z

This is still work in progress, but we thought to expose it earlier to gather feedback. Fixes #1792.

The important aspect especially for ownCloud is that now an empty permission set (equivalent to '' in WebDAV terms, and 0 for the integer representation) is considered valid. So the introduced change does not break the existing APIs but does represent a breaking change from a semantic point of view.

EDIT: to avoid breaking any existing assumption, the denial permission gets for now a different bit, PermissionNone. PermissionInvalid is still defined as 0.

update-docs · 2021-06-16T12:45:48Z

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

pkg/eosclient/eosbinary/eosbinary.go

pkg/eosclient/eosclient.go

pkg/eosclient/eosgrpc/eosgrpc.go

lgtm-com · 2021-06-23T09:19:09Z

This pull request fixes 20 alerts when merging 532ae59 into b54b159 - view on LGTM.com

fixed alerts:

20 for Uncontrolled data used in path expression

internal/http/services/owncloud/ocs/conversions/permissions.go

pkg/storage/utils/eosfs/eosfs.go

… an invalid permission, though its value does correspond to no permissions.

…y all" ResourcePermissions

…not atomically)

…ests

cmd/reva/common.go

labkode · 2021-07-01T13:12:49Z

@glpatcern @gmgigi96 I'm looking for a better alternative for GetOwners.
This new method sets a new dependency with the gateway service that was not there before.
With this change the storage providers needs to know where the gateway service is to query group information.
This means to also add this configuration change to our deployment in every storage provider.
We can do better.

While I'm looking how to add this logic into gateway layer reusing the permission set from the FileInfo and pass it down from the gateway to the storage provider you can replicate this PR against https://github.com/cernbox/reva@qa so we can merge it there and deploy it in our QA infra.

EDIT: just did cernbox#3
I'll merge it, but please do a quick review (nothing changes compared to this one)

…initions are refactored and consolidated in a single place

Stll to do the implementation

hound · 2021-07-06T09:50:51Z

pkg/storage/utils/decomposedfs/decomposedfs.go

@@ -234,6 +236,10 @@ func (fs *Decomposedfs) GetPathByID(ctx context.Context, id *provider.ResourceId
 	return fs.lu.Path(ctx, node)
 }

+func (fs *Decomposedfs) GetOwners(ctx context.Context, ref *provider.Reference) (*grouppb.Group, error) {


exported method Decomposedfs.GetOwners should have comment or be unexported

hound · 2021-07-06T09:50:52Z

pkg/storage/utils/decomposedfs/decomposedfs.go

@@ -234,6 +236,10 @@ func (fs *Decomposedfs) GetPathByID(ctx context.Context, id *provider.ResourceId
 	return fs.lu.Path(ctx, node)
 }

+func (fs *Decomposedfs) GetOwners(ctx context.Context, ref *provider.Reference) (*grouppb.Group, error) {


exported method Decomposedfs.GetOwners should have comment or be unexported

labkode · 2021-07-19T07:48:31Z

Superseded by #1856

glpatcern added the feature New feature label Jun 16, 2021

glpatcern requested a review from labkode as a code owner June 16, 2021 12:45

glpatcern marked this pull request as draft June 16, 2021 12:45

glpatcern assigned glpatcern and gmgigi96 Jun 16, 2021

labkode reviewed Jun 21, 2021

View reviewed changes

pkg/eosclient/eosbinary/eosbinary.go Outdated Show resolved Hide resolved

labkode reviewed Jun 21, 2021

View reviewed changes

pkg/eosclient/eosclient.go Outdated Show resolved Hide resolved

labkode reviewed Jun 21, 2021

View reviewed changes

pkg/eosclient/eosgrpc/eosgrpc.go Outdated Show resolved Hide resolved

glpatcern force-pushed the denyacl branch 2 times, most recently from cd8764b to 7842ce6 Compare June 23, 2021 08:04

labkode reviewed Jun 23, 2021

View reviewed changes

internal/http/services/owncloud/ocs/conversions/permissions.go Outdated Show resolved Hide resolved

labkode reviewed Jun 23, 2021

View reviewed changes

pkg/storage/utils/eosfs/eosfs.go Show resolved Hide resolved

glpatcern and others added 15 commits June 24, 2021 14:11

Add PermissionNone as a full deny ACL. PermissionInvalid represents…

65877bc

… an invalid permission, though its value does correspond to no permissions.

GetACLPerm provide a string of all permission set to deny with a "den…

55406d3

…y all" ResourcePermissions

Add cmp package

d9056ad

Add methods to manage list of grants

39724c8

Add SetACLs method to add (not) atomically a list of acls

1cb02e6

Modified behaviour of eosfs.AddGrant, to support denial permissions (…

0e060dc

…not atomically)

Add some tests for denial ACLs

e6303ab

Add dependency for tests

d97fe82

Add directory for tests in homecanary

b585ecc

Add error check for AddGrant method and add user in context in ACLs t…

b412ab9

…ests

Added changelog

53c477e

Fix for AddGrant when adding a grant for an existing grantee

2fc45ab

Add Grants tests

2183872

Add deepcopy dependency for test

1608328

Fix eosfs with new changes in Grants

0968c63

glpatcern force-pushed the denyacl branch from cb53c8b to 902bb8e Compare June 24, 2021 14:33

glpatcern commented Jul 1, 2021

View reviewed changes

cmd/reva/common.go Outdated Show resolved Hide resolved

eos: use correct sudo identity for privileged commands

80fe16c

labkode and others added 18 commits July 1, 2021 15:51

eos: do not hardcode eos binary location

8adb70a

eos: revert me later: force eos set attr for acls

f9a2ddd

CI: fix the path for the reva Dockerfile on .drone.star (cs3org#1843)

e016d78

CI: use golang:alpine3.13 as builder/base to prevent make errors (cs3…

eb6460e

…org#1844)

[tests-only] Bump core commit id for tests (cs3org#1840)

dc58ab6

[Build-deps]: Bump google.golang.org/grpc from 1.38.0 to 1.39.0 (cs3o…

6887833

…rg#1845)

adjust expectedfailues for remaining closed issues (cs3org#1823)

01e8b2a

[Build-deps]: Bump google.golang.org/protobuf from 1.27.0 to 1.27.1 (c…

68262a3

…s3org#1839)

Add API key to Mentix GOCDB connector (cs3org#1834)

924602b

Use golang:alpine3.13 for revad-eos docker image (cs3org#1847)

8a28d0b

[docs-only] Some more details about the tests system, fix cs3org#1836 (…

8634a12

…cs3org#1837)

LDAP: numeric uid/gid fallback to nobody(99) (cs3org#1848)

79694d1

[Build-deps]: Bump github.com/rs/cors from 1.7.0 to 1.8.0 (cs3org#1851)

cd34c57

[Build-deps]: Bump github.com/minio/minio-go/v7 from 7.0.11 to 7.0.12 (…

91e6fcc

…cs3org#1853)

Wrap ref to have full path

0459330

Add status check to group response

a8d9d26

Fix EOS attr deserialization

37656bf

Renamed "coowner" to "collaborator". To be reviewed once the role def…

2187419

…initions are refactored and consolidated in a single place

glpatcern force-pushed the denyacl branch from 7ffee4a to 2187419 Compare July 6, 2021 08:29

gmgigi96 added 4 commits July 6, 2021 11:41

Add position to AddACL's EOSClient interface

efe1bfb

Update method in EOSgrpc to accept a position parameter.

816dc57

Stll to do the implementation

Implement position logic in EOS binary

7e1d80b

Atomic implementation of denials

e41a558

hound bot reviewed Jul 6, 2021

View reviewed changes

labkode closed this Jul 19, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement support for deny ACLs #1798

Implement support for deny ACLs #1798

glpatcern commented Jun 16, 2021 •

edited

update-docs bot commented Jun 16, 2021

lgtm-com bot commented Jun 23, 2021

labkode commented Jul 1, 2021 •

edited

hound bot Jul 6, 2021

hound bot Jul 6, 2021

labkode commented Jul 19, 2021

Implement support for deny ACLs #1798

Implement support for deny ACLs #1798

Conversation

glpatcern commented Jun 16, 2021 • edited

update-docs bot commented Jun 16, 2021

lgtm-com bot commented Jun 23, 2021

labkode commented Jul 1, 2021 • edited

hound bot Jul 6, 2021

Choose a reason for hiding this comment

hound bot Jul 6, 2021

Choose a reason for hiding this comment

labkode commented Jul 19, 2021

glpatcern commented Jun 16, 2021 •

edited

labkode commented Jul 1, 2021 •

edited