Merge pull request #18002 from adamemerson/wip-21582

rgw: Check bucket GetBucketLocation in policy
ceph · Sep 28, 2017 · f337bb9 · f337bb9
2 parents 764e0dd + 79188d6
commit f337bb9
Showing 1 changed file with 9 additions and 4 deletions.
diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
@@ -2318,11 +2318,16 @@ int RGWGetBucketLogging::verify_permission()
 
 int RGWGetBucketLocation::verify_permission()
 {
-  if (false == s->auth.identity->is_owner_of(s->bucket_owner.get_id())) {
-    return -EACCES;
+  if (s->iam_policy) {
+    if (s->iam_policy->eval(s->env, *s->auth.identity,
+			    rgw::IAM::s3GetBucketLocation,
+			    ARN(s->bucket)) == Effect::Allow) {
+      return 0;
+    }
+  } else if (s->auth.identity->is_owner_of(s->bucket_owner.get_id())) {
+    return 0;
   }
-
-  return 0;
+  return -EACCES;
 }
 
 int RGWCreateBucket::verify_permission()