[jira] [Created] (HDDS-17361) S3 Gateway can set another user as the owner of a new key

["Chu Cheng Li (Jira)" <ji...@apache.org>]

Chu Cheng Li created HDDS-17361:
-----------------------------------

             Summary: S3 Gateway can set another user as the owner of a new key
                 Key: HDDS-17361
                 URL: https://issues.apache.org/jira/browse/HDDS-17361
             Project: Apache Ozone
          Issue Type: Bug
          Components: s3gateway
    Affects Versions: 2.2.1, 2.0.0, 2.1.0, 2.1.1, 2.2.0
            Reporter: Chu Cheng Li


*Problem*

The S3 Gateway uses one {{RpcClient}} for the requests of all users. Each request thread keeps its {{S3Auth}} in a thread-local variable.

{{RpcClient#setThreadLocalS3Auth}} also writes the S3 user to the field {{s3gUgi}}. All request threads share this field. HDDS-7791 added it.

{{RpcClient#getRealUserInfo}} returns {{s3gUgi}} when the current thread has an {{S3Auth}}. These calls use the result as the owner of the new key:
* {{createKey}} and {{createStreamKey}}
* {{createFile}}, {{createStreamFile}} and {{createDirectory}}
* {{initiateMultipartUpload}}, {{createMultipartKey}} and {{completeMultipartUpload}}

OM stores the owner from the request as it is.

Thus, a request from user B can change the owner of a key that user A writes at the same time. The request from B can be of any type, for example {{ListObjects}}.

*Effect*
* S3 {{ListObjects}}, {{ozone sh key info}}, ofs and o3fs show the wrong owner. The parent directories that OM creates for the key also get this owner.
* Test on master with one S3 Gateway: users alice and bob write with 8 threads each. User mallory only lists objects with 2 threads. 330 of 960 new keys get the wrong owner. 236 of them get mallory as the owner.
* Access checks do not use the key owner. Thus, the wrong owner does not give or remove access.

*Fix*

Remove the field {{s3gUgi}}. {{getRealUserInfo}} creates the {{UserGroupInformation}} from the {{S3Auth}} of the current thread. {{createBucket}} and {{getDEK}} already do this.



--
This message was sent by Atlassian Jira
(v10.3.26#10030026)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org