[jira] [Created] (HDDS-16842) Check admin rights in the OM bootstrap RPC handler, consistent with decommission and getOMConfiguration

["Siyao Meng (Jira)" <ji...@apache.org>]

Siyao Meng created HDDS-16842:
---------------------------------

             Summary: Check admin rights in the OM bootstrap RPC handler, consistent with decommission and getOMConfiguration
                 Key: HDDS-16842
                 URL: https://issues.apache.org/jira/browse/HDDS-16842
             Project: Apache Ozone
          Issue Type: Bug
            Reporter: Siyao Meng
         Attachments: CR-7-check-admin-rights-in-om-bootstrap-rpc.patch

h3. Mechanism
{{OMAdminProtocolServerSideImpl.decommission}} and {{OMAdminProtocolServerSideImpl.getOMConfiguration}} check {{isAdminAuthorizationEnabled() && !isAdmin(getRemoteUser())}} before they act. {{OMInterServiceProtocolServerSideImpl.bootstrap}}, the other membership call of the OM, checks {{OzoneManagerRatisUtils.checkLeaderStatus}} only. The attached patch adds the same check to it, so that the three calls are consistent.

h3. Impact
A consistency gap between the handlers. This is not a report of a reproduced failure.

A new OM sends the bootstrap request as the user that runs the OMs, which is an administrator. A normal bootstrap already depends on that, because it calls {{getOMConfiguration}} on every existing OM first. A bootstrap that works today is therefore not affected (code reading, and {{TestAddRemoveOzoneManager.testBootstrap}} with admin authorization enabled). With admin authorization disabled the new check does nothing.

h3. Reproduction
There is no separate reproduction. The regression test in the patch is the evidence.

h3. Patch
[^CR-7-check-admin-rights-in-om-bootstrap-rpc.patch], against 7fcf31294859d5d31163e016b5a9a63f21c6edd2. It also applies to master at 1cc6423590f (not built there).

{{OMInterServiceProtocolServerSideImpl.bootstrap}} throws {{OMException}} with {{PERMISSION_DENIED}} and "Only administrators are authorized to perform bootstrap." inside its existing try block when {{isAdminAuthorizationEnabled() && !isAdmin(getRemoteUser())}}. The existing catch returns it as a {{RATIS_BOOTSTRAP_ERROR}} response. No config, request or proto change.

Covered by {{bootstrapNonAdminIsDenied}} in the existing {{TestOMAdminRpcAuthorization}}, which expects that message for a caller without admin rights and fails on the unfixed commit. {{TestAddRemoveOzoneManager.testBootstrap}} now runs with admin authorization enabled, so real OMs join through the new check. With the patch {{TestOMAdminRpcAuthorization}} (5 tests), {{TestOMAdminProtocolServerSideImpl}} (1 test), {{TestOMInstallSnapshotDuringBootstrapping}} (1 test) and {{TestAddRemoveOzoneManager}} (8 tests) pass, and checkstyle is clean on both modules.

Found by code review of the OM HA membership change paths (bootstrap, decommission and leader transfer), as part of the TLA+ verification effort under HDDS-15926, on commit 7fcf31294859d5d31163e016b5a9a63f21c6edd2. Checked against HDDS issues and apache/ozone pull requests for duplicates before filing. The attached patch is a proposal for review. Generated with Specula (Claude Opus 5.5).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org