Skip to content

rgw: ListRoles returns "Access Denied" for a regular user with valid allow policy#66923

Merged
cbodley merged 1 commit intoceph:mainfrom
thmour:main
Mar 19, 2026
Merged

rgw: ListRoles returns "Access Denied" for a regular user with valid allow policy#66923
cbodley merged 1 commit intoceph:mainfrom
thmour:main

Conversation

@thmour
Copy link
Copy Markdown
Contributor

@thmour thmour commented Jan 14, 2026 •
edited
Loading

The ListRoles method doesn't initialise the arn resource, so a user that is allowed to call this method only via policies gets "Access Denied"

tracker ticket: https://tracker.ceph.com/issues/74399

Contribution Guidelines

  • To sign and title your commits, please refer to Submitting Patches to Ceph.

  • If you are submitting a fix for a stable branch (e.g. "quincy"), please refer to Submitting Patches to Ceph - Backports for the proper workflow.

  • When filling out the below checklist, you may click boxes directly in the GitHub web UI. When entering or editing the entire PR message in the GitHub web UI editor, you may also select a checklist item by adding an x between the brackets: [x]. Spaces and capitalization matter when checking off items this way.

Checklist

  • Tracker (select at least one)
    • References tracker ticket
    • Very recent bug; references commit where it was introduced
    • New feature (ticket optional)
    • Doc update (no ticket needed)
    • Code cleanup (no ticket needed)
  • Component impact
    • Affects Dashboard, opened tracker ticket
    • Affects Orchestrator, opened tracker ticket
    • No impact that needs to be tracked
  • Documentation (select at least one)
    • Updates relevant documentation
    • No doc update is appropriate
  • Tests (select at least one)
Show available Jenkins commands

You must only issue one Jenkins command per-comment. Jenkins does not understand
comments with more than one command.

@thmour thmour requested a review from a team as a code owner January 14, 2026 09:23
@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

14 similar comments
@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Jan 14, 2026

Can one of the admins verify this patch?

@github-actions github-actions bot added the rgw label Jan 14, 2026
@thmour thmour changed the title ListRoles returns "Access Denied" for a regular user with valid allow policy rgw: ListRoles returns "Access Denied" for a regular user with valid allow policy Jan 14, 2026
@thmour
rgw: ListRoles returns "Access Denied" for a regular user with valid …
6594f6c 
…allow policy

The ListRoles method doesn't initialise the arn resource, so a user that is allowed to call this method only via policies gets "Access Denied"

Signed-off-by: Theofilos Mouratidis <mtheofilos@gmail.com>
@cbodley cbodley mentioned this pull request Jan 15, 2026
Merged
cbodley
cbodley approved these changes Jan 15, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@cbodley cbodley left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks, looks correct

@cbodley
Copy link
Copy Markdown
Contributor

cbodley commented Jan 15, 2026

i wrote a test case for this in ceph/s3-tests#722. as expected, it fails against main but passes with the changes in this pull request 👍

@cbodley cbodley added the needs-separate-s3tests-qa This is a PR to RGW that, at present, needs to be QA'd against is own s3tests branch before merge. label Jan 15, 2026
@github-actions
Copy link
Copy Markdown

github-actions bot commented Mar 16, 2026

This pull request has been automatically marked as stale because it has not had any activity for 60 days. It will be closed if no further activity occurs for another 30 days.
If you are a maintainer or core committer, please follow-up on this pull request to identify what steps should be taken by the author to move this proposed change forward.
If you are the author of this pull request, thank you for your proposed contribution. If you believe this change is still appropriate, please ensure that any feedback has been addressed and ask for a code review.

@github-actions github-actions bot added the stale label Mar 16, 2026
@thmour
Copy link
Copy Markdown
Contributor Author

thmour commented Mar 17, 2026

@cbodley any progress on this? I was waiting for the test case ceph/s3-tests#722 to be merged so we can merge this as well?

@github-actions github-actions bot removed the stale label Mar 17, 2026
@cbodley
Copy link
Copy Markdown
Contributor

cbodley commented Mar 18, 2026

@thmour sorry for the delay, i'll start qa against the test cases

@cbodley
Copy link
Copy Markdown
Contributor

cbodley commented Mar 18, 2026

ok to test

@cbodley
Copy link
Copy Markdown
Contributor

cbodley commented Mar 19, 2026

jenkins test windows

@ceph-jenkins
Copy link
Copy Markdown
Collaborator

ceph-jenkins commented Mar 19, 2026

Thank you for your contribution. Since you, the author, are not a member of the Ceph GitHub Org yet, our CI will not automatically run. Any member of the Ceph Org may comment "ok to test" to allow the Jenkins jobs to run.

@cbodley
Copy link
Copy Markdown
Contributor

cbodley commented Mar 19, 2026

qa passed in https://pulpito.ceph.com/cbodley-2026-03-19_03:33:47-rgw-wip-cbodley-testing-distro-default-trial/ with a few known issues, mostly valgrind errors. new test case is passing:

:s3tests/functional/test_iam.py::test_account_role_list_permission PASSED [ 7%]

@cbodley cbodley added TESTED ready-to-merge and removed wip-cbodley-testing needs-separate-s3tests-qa This is a PR to RGW that, at present, needs to be QA'd against is own s3tests branch before merge. labels Mar 19, 2026
@cbodley
Copy link
Copy Markdown
Contributor

cbodley commented Mar 19, 2026

https://jenkins.ceph.com/job/ceph-pull-requests-arm64/89319/

The following tests FAILED:
264 - unittest_posix_bucket_cache (Timeout)

tracked in https://tracker.ceph.com/issues/75601

@cbodley
Copy link
Copy Markdown
Contributor

cbodley commented Mar 19, 2026

jenkins test make check arm64

@cbodley cbodley merged commit b49bd22 into ceph:main Mar 19, 2026
13 checks passed
@BoleynSu
Copy link
Copy Markdown

BoleynSu commented Mar 27, 2026

Thanks for fixing! Will this be backported to 19?

@cbodley
Copy link
Copy Markdown
Contributor

cbodley commented Mar 27, 2026

Thanks for fixing! Will this be backported to 19?

yes, squid backport is prepared in #68027 for https://tracker.ceph.com/issues/75623

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cbodley cbodley cbodley approved these changes

Assignees

No one assigned

Labels

ready-to-merge rgw TESTED

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@thmour @ceph-jenkins @cbodley @BoleynSu