Gargi-jais11 commented on code in PR #11759:
URL: https://github.com/apache/ozone/pull/11759#discussion_r4385614586
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyRenameRequest.java:
##########
@@ -89,8 +89,25 @@ public OMRequest preExecute(OzoneManager ozoneManager)
throws IOException {
KeyArgs.Builder newKeyArgs = renameKeyArgs.toBuilder()
.setModificationTime(Time.now()).setKeyName(srcKey);
- KeyArgs resolvedArgs = resolveBucketAndCheckAcls(newKeyArgs.build(),
- ozoneManager, srcKey, dstKey);
+ KeyArgs auditArgs = newKeyArgs.build();
+ try {
+ auditArgs = resolveBucketLink(ozoneManager, auditArgs);
+ } catch (IOException ignored) {
+ }
+
+ KeyArgs resolvedArgs;
+ try {
+ resolvedArgs = resolveBucketAndCheckAcls(newKeyArgs.build(),
+ ozoneManager, srcKey, dstKey);
+ } catch (IOException ex) {
+ // Ensure audit log captures preExecute failures
+ markForAudit(ozoneManager.getAuditLogger(),
+ buildAuditMessage(OMAction.RENAME_KEY,
+ buildAuditMap(auditArgs,
+ renameKeyRequest.toBuilder().setToKeyName(dstKey).build()),
+ ex, getOmRequest().getUserInfo()));
+ throw ex;
+ }
Review Comment:
similar to `OMKeyDeleteRequest.java`
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyDeleteRequest.java:
##########
@@ -88,7 +88,23 @@ public OMRequest preExecute(OzoneManager ozoneManager)
throws IOException {
OzoneManagerProtocolProtos.KeyArgs.Builder newKeyArgs =
keyArgs.toBuilder().setModificationTime(Time.now()).setKeyName(keyPath);
- KeyArgs resolvedArgs = resolveBucketAndCheckAcls(ozoneManager, newKeyArgs);
+ KeyArgs auditArgs = newKeyArgs.build();
+ try {
+ auditArgs = resolveBucketLink(ozoneManager, auditArgs);
Review Comment:
I agree with @yandrey321 , resolving the link up front adds a second bucket
lookup, and with ACLs on a second permission check per link, to every delete
and rename, while the result is only used when the ACL check fails.
@aayush2761 please move it into the catch, for example with a helper that
falls back to the requested KeyArgs if resolution fails, and drop the empty
catch (IOException ignored).
```
KeyArgs resolvedArgs;
try {
resolvedArgs = resolveBucketAndCheckAcls(ozoneManager, newKeyArgs);
} catch (IOException ex) {
markForAudit(ozoneManager.getAuditLogger(),
buildAuditMessage(OMAction.DELETE_KEY,
buildLightKeyArgsAuditMap(resolveBucketLinkForAudit(ozoneManager,
newKeyArgs.build())), ex,
getOmRequest().getUserInfo()));
throw ex;
}
```
can add this shared helper in `OMKeyRequest`
```
/** Resolves the bucket link of keyArgs for an audit entry, or returns
keyArgs if it cannot be resolved. */
protected KeyArgs resolveBucketLinkForAudit(OzoneManager ozoneManager,
KeyArgs keyArgs) {
try {
return resolveBucketLink(ozoneManager, keyArgs);
} catch (IOException e) {
return keyArgs;
}
}
```
The same applies to `OMKeyRenameRequest`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
