Implement OSD-side authorization for operations

2026-05-19 17:19:47 +03:00
parent 9db0980fc1
commit b21c92cb7a
25 changed files with 305 additions and 101 deletions
@@ -91,6 +91,21 @@ static void scan_lists(std::vector<unclean_list_t> & lists, uint64_t limit, desc
 // Describe unclean objects
 void osd_t::continue_primary_describe(osd_op_t *cur_op)
 {
+    if (use_auth)
+    {
+        osd_client_t *cl = msgr.clients.at(cur_op->client_id);
+        if (cl->hs_result.peer_is_osd)
+        {
+            // OSDs are not allowed to execute "primary" operations
+            finish_op(cur_op, -EPERM);
+            return;
+        }
+        if (cl->user_info->type != user_type_t::ADMIN)
+        {
+            finish_op(cur_op, -EPERM);
+            return;
+        }
+    }
    auto & desc = cur_op->req.describe;
    if (!desc.object_state)
        desc.object_state = ~desc.object_state;