[jira] [Updated] (HDDS-16842) Check admin rights in the OM bootstrap RPC handler, consistent with decommission and getOMConfiguration

["Siyao Meng (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/HDDS-16842?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Siyao Meng updated HDDS-16842:
------------------------------
    Attachment: CR-7-check-admin-rights-in-om-bootstrap-rpc.patch

> Check admin rights in the OM bootstrap RPC handler, consistent with decommission and getOMConfiguration
> -------------------------------------------------------------------------------------------------------
>
>                 Key: HDDS-16842
>                 URL: https://issues.apache.org/jira/browse/HDDS-16842
>             Project: Apache Ozone
>          Issue Type: Bug
>            Reporter: Siyao Meng
>            Priority: Minor
>         Attachments: CR-7-check-admin-rights-in-om-bootstrap-rpc.patch
>
>
> h3. Mechanism
> {{OMAdminProtocolServerSideImpl.decommission}} and {{OMAdminProtocolServerSideImpl.getOMConfiguration}} check {{isAdminAuthorizationEnabled() && !isAdmin(getRemoteUser())}} before they act. {{OMInterServiceProtocolServerSideImpl.bootstrap}}, the other membership call of the OM, checks {{OzoneManagerRatisUtils.checkLeaderStatus}} only. The attached patch adds the same check to it, so that the three calls are consistent.
> h3. Impact
> A consistency gap between the handlers. This is not a report of a reproduced failure.
> A new OM sends the bootstrap request as the user that runs the OMs, which is an administrator. A normal bootstrap already depends on that, because it calls {{getOMConfiguration}} on every existing OM first. A bootstrap that works today is therefore not affected (code reading, and {{TestAddRemoveOzoneManager.testBootstrap}} with admin authorization enabled). With admin authorization disabled the new check does nothing.
> h3. Reproduction
> There is no separate reproduction. The regression test in the patch is the evidence.
> h3. Patch
> [^CR-7-check-admin-rights-in-om-bootstrap-rpc.patch], against 7fcf31294859d5d31163e016b5a9a63f21c6edd2. It also applies to master at 1cc6423590f (not built there).
> {{OMInterServiceProtocolServerSideImpl.bootstrap}} throws {{OMException}} with {{PERMISSION_DENIED}} and "Only administrators are authorized to perform bootstrap." inside its existing try block when {{isAdminAuthorizationEnabled() && !isAdmin(getRemoteUser())}}. The existing catch returns it as a {{RATIS_BOOTSTRAP_ERROR}} response. No config, request or proto change.
> Covered by {{bootstrapNonAdminIsDenied}} in the existing {{TestOMAdminRpcAuthorization}}, which expects that message for a caller without admin rights and fails on the unfixed commit. {{TestAddRemoveOzoneManager.testBootstrap}} now runs with admin authorization enabled, so real OMs join through the new check. With the patch {{TestOMAdminRpcAuthorization}} (5 tests), {{TestOMAdminProtocolServerSideImpl}} (1 test), {{TestOMInstallSnapshotDuringBootstrapping}} (1 test) and {{TestAddRemoveOzoneManager}} (8 tests) pass, and checkstyle is clean on both modules.
> Found by code review of the OM HA membership change paths (bootstrap, decommission and leader transfer), as part of the TLA+ verification effort under HDDS-15926, on commit 7fcf31294859d5d31163e016b5a9a63f21c6edd2. Checked against HDDS issues and apache/ozone pull requests for duplicates before filing. The attached patch is a proposal for review. Generated with Specula (Claude Opus 5.5).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org