[GitHub] [ozone] kerneltime commented on a diff in pull request #3553: HDDS-6942. Ozone Vols/Buckets/Objects created via S3 should not allow group access

[GitBox <gi...@apache.org>]

kerneltime commented on code in PR #3553:
URL: https://github.com/apache/ozone/pull/3553#discussion_r907578624


##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/EndpointBase.java:
##########
@@ -98,6 +101,7 @@ protected OzoneBucket getBucket(OzoneVolume volume, String bucketName)
   @PostConstruct
   public void initialization() {
     LOG.debug("S3 access id: {}", s3Auth.getAccessID());
+    ozoneConfiguration.setIfUnset("ozone.om.group.rights", "NONE");

Review Comment:
   The config is defined in https://github.com/apache/ozone/blob/master/hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/security/acl/OzoneAclConfig.java#L42-L48
   
   Which is used by the Rpc Client. https://github.com/apache/ozone/blob/master/hadoop-ozone/client/src/main/java/org/apache/hadoop/ozone/client/rpc/RpcClient.java#L221
   
   This is a bit awkward for 2 reasons, the actual string for configuration cannot be searched as plain text as the configuration splits it into 2 parts. Also, the defaults are set deep inside RpcClient vs being set close to the business logic in s3g. Ideally the group security setting should have been part of the Bucket Endpoint processing itself.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org