[
https://issues.apache.org/jira/browse/HDDS-16842?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-16842:
------------------------------
Attachment: CR-7-check-admin-rights-in-om-bootstrap-rpc.patch
> Check admin rights in the OM bootstrap RPC handler, consistent with
> decommission and getOMConfiguration
> -------------------------------------------------------------------------------------------------------
>
> Key: HDDS-16842
> URL: https://issues.apache.org/jira/browse/HDDS-16842
> Project: Apache Ozone
> Issue Type: Bug
> Reporter: Siyao Meng
> Priority: Minor
> Attachments: CR-7-check-admin-rights-in-om-bootstrap-rpc.patch
>
>
> h3. Mechanism
> {{OMAdminProtocolServerSideImpl.decommission}} and
> {{OMAdminProtocolServerSideImpl.getOMConfiguration}} check
> {{isAdminAuthorizationEnabled() && !isAdmin(getRemoteUser())}} before they
> act. {{OMInterServiceProtocolServerSideImpl.bootstrap}}, the other membership
> call of the OM, checks {{OzoneManagerRatisUtils.checkLeaderStatus}} only. The
> attached patch adds the same check to it, so that the three calls are
> consistent.
> h3. Impact
> A consistency gap between the handlers. This is not a report of a reproduced
> failure.
> A new OM sends the bootstrap request as the user that runs the OMs, which is
> an administrator. A normal bootstrap already depends on that, because it
> calls {{getOMConfiguration}} on every existing OM first. A bootstrap that
> works today is therefore not affected (code reading, and
> {{TestAddRemoveOzoneManager.testBootstrap}} with admin authorization
> enabled). With admin authorization disabled the new check does nothing.
> h3. Reproduction
> There is no separate reproduction. The regression test in the patch is the
> evidence.
> h3. Patch
> [^CR-7-check-admin-rights-in-om-bootstrap-rpc.patch], against
> 7fcf31294859d5d31163e016b5a9a63f21c6edd2. It also applies to master at
> 1cc6423590f (not built there).
> {{OMInterServiceProtocolServerSideImpl.bootstrap}} throws {{OMException}}
> with {{PERMISSION_DENIED}} and "Only administrators are authorized to perform
> bootstrap." inside its existing try block when
> {{isAdminAuthorizationEnabled() && !isAdmin(getRemoteUser())}}. The existing
> catch returns it as a {{RATIS_BOOTSTRAP_ERROR}} response. No config, request
> or proto change.
> Covered by {{bootstrapNonAdminIsDenied}} in the existing
> {{TestOMAdminRpcAuthorization}}, which expects that message for a caller
> without admin rights and fails on the unfixed commit.
> {{TestAddRemoveOzoneManager.testBootstrap}} now runs with admin authorization
> enabled, so real OMs join through the new check. With the patch
> {{TestOMAdminRpcAuthorization}} (5 tests),
> {{TestOMAdminProtocolServerSideImpl}} (1 test),
> {{TestOMInstallSnapshotDuringBootstrapping}} (1 test) and
> {{TestAddRemoveOzoneManager}} (8 tests) pass, and checkstyle is clean on both
> modules.
> Found by code review of the OM HA membership change paths (bootstrap,
> decommission and leader transfer), as part of the TLA+ verification effort
> under HDDS-15926, on commit 7fcf31294859d5d31163e016b5a9a63f21c6edd2. Checked
> against HDDS issues and apache/ozone pull requests for duplicates before
> filing. The attached patch is a proposal for review. Generated with Specula
> (Claude Opus 5.5).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
