From 373287b7755e280bab585e6716ef9e35228adc2a Mon Sep 17 00:00:00 2001 From: Jesse Geens Date: Tue, 26 Nov 2024 14:31:21 +0100 Subject: [PATCH 1/4] No more root in eos-grpc * We now do not use root anymore in eos-grpc, but use the user, daemon or cbox * Bugfix: when EOS token is provided, pass this on in the gRPC request * For creating version folders, we impersonate the owner * Some restructuring --- changelog/unreleased/rootless-auth.md | 10 + pkg/eosclient/eosgrpc/eosgrpc.go | 191 +++++++++++------- pkg/storage/utils/eosfs/eosfs.go | 272 +++++++------------------- pkg/utils/utils.go | 17 +- 4 files changed, 211 insertions(+), 279 deletions(-) create mode 100644 changelog/unreleased/rootless-auth.md diff --git a/changelog/unreleased/rootless-auth.md b/changelog/unreleased/rootless-auth.md new file mode 100644 index 0000000000..09a907f62d --- /dev/null +++ b/changelog/unreleased/rootless-auth.md @@ -0,0 +1,10 @@ +Enhancement: do not use root on EOS + +Currently, the EOS drivers use root authentication for many different operations. This has now been changed to use one of the following: +* cbox, which is a sudo'er +* daemon, for read-only operations +* the user himselft + +Note that home creation is excluded here as this will be tackled in a different PR. + +https://github.com/cs3org/reva/pull/4977/ \ No newline at end of file diff --git a/pkg/eosclient/eosgrpc/eosgrpc.go b/pkg/eosclient/eosgrpc/eosgrpc.go index fb867c5a95..73a2df2eda 100644 --- a/pkg/eosclient/eosgrpc/eosgrpc.go +++ b/pkg/eosclient/eosgrpc/eosgrpc.go @@ -39,6 +39,7 @@ import ( "github.com/cs3org/reva/pkg/eosclient" "github.com/cs3org/reva/pkg/errtypes" "github.com/cs3org/reva/pkg/storage/utils/acl" + "github.com/cs3org/reva/pkg/utils" "github.com/google/uuid" "github.com/pkg/errors" "github.com/rs/zerolog" @@ -58,27 +59,12 @@ const ( UserAttr ) -func serializeAttribute(a *eosclient.Attribute) string { - return fmt.Sprintf("%s.%s=%s", attrTypeToString(a.Type), a.Key, a.Val) -} - -func attrTypeToString(at eosclient.AttrType) string { - switch at { - case eosclient.SystemAttr: - return "sys" - case eosclient.UserAttr: - return "user" - default: - return "invalid" - } -} - -func isValidAttribute(a *eosclient.Attribute) bool { - // validate that an attribute is correct. - if (a.Type != eosclient.SystemAttr && a.Type != eosclient.UserAttr) || a.Key == "" { - return false - } - return true +// Client performs actions against a EOS management node (MGM) +// using the EOS GRPC interface. +type Client struct { + opt *Options + httpcl *EOSHTTPClient + cl erpc.EosClient } // Options to configure the Client. @@ -131,15 +117,6 @@ type Options struct { TokenExpiry int } -func getUser(ctx context.Context) (*userpb.User, error) { - u, ok := appctx.ContextGetUser(ctx) - if !ok { - err := errors.Wrap(errtypes.UserRequired(""), "eosfs: error getting user from ctx") - return nil, err - } - return u, nil -} - func (opt *Options) init() { if opt.XrdcopyBinary == "" { opt.XrdcopyBinary = "/opt/eos/xrootd/bin/xrdcopy" @@ -154,12 +131,36 @@ func (opt *Options) init() { } } -// Client performs actions against a EOS management node (MGM) -// using the EOS GRPC interface. -type Client struct { - opt *Options - httpcl *EOSHTTPClient - cl erpc.EosClient +func getUser(ctx context.Context) (*userpb.User, error) { + u, ok := appctx.ContextGetUser(ctx) + if !ok { + err := errors.Wrap(errtypes.UserRequired(""), "eosfs: error getting user from ctx") + return nil, err + } + return u, nil +} + +func serializeAttribute(a *eosclient.Attribute) string { + return fmt.Sprintf("%s.%s=%s", attrTypeToString(a.Type), a.Key, a.Val) +} + +func attrTypeToString(at eosclient.AttrType) string { + switch at { + case eosclient.SystemAttr: + return "sys" + case eosclient.UserAttr: + return "user" + default: + return "invalid" + } +} + +func isValidAttribute(a *eosclient.Attribute) bool { + // validate that an attribute is correct. + if (a.Type != eosclient.SystemAttr && a.Type != eosclient.UserAttr) || a.Key == "" { + return false + } + return true } // Create and connect a grpc eos Client. @@ -230,28 +231,40 @@ func (c *Client) getRespError(rsp *erpc.NSResponse, err error) error { // Common code to create and initialize a NSRequest. func (c *Client) initNSRequest(ctx context.Context, auth eosclient.Authorization, app string) (*erpc.NSRequest, error) { - // Stuff filename, uid, gid into the MDRequest type - log := appctx.GetLogger(ctx) log.Debug().Str("(uid,gid)", "("+auth.Role.UID+","+auth.Role.GID+")").Msg("New grpcNS req") rq := new(erpc.NSRequest) rq.Role = new(erpc.RoleId) - uidInt, err := strconv.ParseUint(auth.Role.UID, 10, 64) - if err != nil { - return nil, err - } - gidInt, err := strconv.ParseUint(auth.Role.GID, 10, 64) - if err != nil { - return nil, err + // Let's put in the authentication info + if auth.Token != "" { + // Map to owner using EOSAUTHZ token + // We do not become cbox + rq.Authkey = auth.Token + } else { + // We take the secret key from the config, which maps on EOS to cbox + // cbox is a sudo'er, so we become the user specified in UID/GID, if it is set + rq.Authkey = c.opt.Authkey + + if auth.Role.UID != "" && auth.Role.GID != "" { + uidInt, err := strconv.ParseUint(auth.Role.UID, 10, 64) + if err != nil { + return nil, err + } + gidInt, err := strconv.ParseUint(auth.Role.GID, 10, 64) + if err != nil { + return nil, err + } + rq.Role.Uid = uidInt + rq.Role.Gid = gidInt + } } - rq.Role.Uid = uidInt - rq.Role.Gid = gidInt + + // For NS operations, specifically for locking, we also need to provide the app if app != "" { rq.Role.App = app } - rq.Authkey = c.opt.Authkey return rq, nil } @@ -263,23 +276,33 @@ func (c *Client) initMDRequest(ctx context.Context, auth eosclient.Authorization log := appctx.GetLogger(ctx) log.Debug().Str("(uid,gid)", "("+auth.Role.UID+","+auth.Role.GID+")").Msg("New grpcMD req") - mdrq := new(erpc.MDRequest) - mdrq.Role = new(erpc.RoleId) + rq := new(erpc.MDRequest) + rq.Role = new(erpc.RoleId) - uidInt, err := strconv.ParseUint(auth.Role.UID, 10, 64) - if err != nil { - return nil, err - } - gidInt, err := strconv.ParseUint(auth.Role.GID, 10, 64) - if err != nil { - return nil, err - } - mdrq.Role.Uid = uidInt - mdrq.Role.Gid = gidInt + if auth.Token != "" { + // Map to owner using EOSAUTHZ token + // We do not become cbox + rq.Authkey = auth.Token + } else { + // We take the secret key from the config, which maps on EOS to cbox + // cbox is a sudo'er, so we become the user specified in UID/GID, if it is set + rq.Authkey = c.opt.Authkey - mdrq.Authkey = c.opt.Authkey + if auth.Role.UID != "" && auth.Role.GID != "" { + uidInt, err := strconv.ParseUint(auth.Role.UID, 10, 64) + if err != nil { + return nil, err + } + gidInt, err := strconv.ParseUint(auth.Role.GID, 10, 64) + if err != nil { + return nil, err + } + rq.Role.Uid = uidInt + rq.Role.Gid = gidInt + } + } - return mdrq, nil + return rq, nil } // AddACL adds an new acl to EOS with the given aclType. @@ -711,12 +734,16 @@ func getAttribute(key, val string) (*eosclient.Attribute, error) { } // GetFileInfoByPath returns the FilInfo at the given path. -func (c *Client) GetFileInfoByPath(ctx context.Context, auth eosclient.Authorization, path string) (*eosclient.FileInfo, error) { +func (c *Client) GetFileInfoByPath(ctx context.Context, userAuth eosclient.Authorization, path string) (*eosclient.FileInfo, error) { log := appctx.GetLogger(ctx) - log.Debug().Str("func", "GetFileInfoByPath").Str("uid,gid", auth.Role.UID+","+auth.Role.GID).Str("path", path).Msg("entering") + log.Debug().Str("func", "GetFileInfoByPath").Str("uid,gid", userAuth.Role.UID+","+userAuth.Role.GID).Str("path", path).Msg("entering") + + daemonAuth := utils.GetDaemonAuth() // Initialize the common fields of the MDReq - mdrq, err := c.initMDRequest(ctx, auth) + // We do this as the daemon account, because the user may not have access to the file + // e.g. in the case of a guest account + mdrq, err := c.initMDRequest(ctx, daemonAuth) if err != nil { return nil, err } @@ -756,7 +783,16 @@ func (c *Client) GetFileInfoByPath(ctx context.Context, auth eosclient.Authoriza } if c.opt.VersionInvariant && !isVersionFolder(path) && !info.IsDir { - inode, err := c.getVersionFolderInode(ctx, auth, path) + // Here we have to create a missing version folder, irrespective from the user (that could be a sharee, or a lw account, or...) + // Therefore, we impersonate the owner of the file + ownerAuth := eosclient.Authorization{ + Role: eosclient.Role{ + UID: strconv.FormatUint(info.UID, 10), + GID: strconv.FormatUint(info.GID, 10), + }, + } + + inode, err := c.getOrCreateVersionFolderInode(ctx, ownerAuth, path) if err != nil { return nil, err } @@ -764,7 +800,7 @@ func (c *Client) GetFileInfoByPath(ctx context.Context, auth eosclient.Authoriza } log.Info().Str("func", "GetFileInfoByPath").Str("path", path).Uint64("info.Inode", info.Inode).Uint64("size", info.Size).Str("etag", info.ETag).Msg("result") - return c.fixupACLs(ctx, auth, info), nil + return c.fixupACLs(ctx, daemonAuth, info), nil } // GetFileInfoByFXID returns the FileInfo by the given file id in hexadecimal. @@ -1193,9 +1229,9 @@ func (c *Client) Rename(ctx context.Context, auth eosclient.Authorization, oldPa } // List the contents of the directory given by path. -func (c *Client) List(ctx context.Context, auth eosclient.Authorization, dpath string) ([]*eosclient.FileInfo, error) { +func (c *Client) List(ctx context.Context, userAuth eosclient.Authorization, dpath string) ([]*eosclient.FileInfo, error) { log := appctx.GetLogger(ctx) - log.Info().Str("func", "List").Str("uid,gid", auth.Role.UID+","+auth.Role.GID).Str("dpath", dpath).Msg("") + log.Info().Str("func", "List").Str("uid,gid", userAuth.Role.UID+","+userAuth.Role.GID).Str("dpath", dpath).Msg("") // Stuff filename, uid, gid into the FindRequest type fdrq := new(erpc.FindRequest) @@ -1206,6 +1242,13 @@ func (c *Client) List(ctx context.Context, auth eosclient.Authorization, dpath s fdrq.Role = new(erpc.RoleId) + var auth eosclient.Authorization + if userAuth.Role.UID == "" || userAuth.Role.GID == "" { + auth = utils.GetDaemonAuth() + } else { + auth = userAuth + } + uidInt, err := strconv.ParseUint(auth.Role.UID, 10, 64) if err != nil { return nil, err @@ -1661,17 +1704,17 @@ func (c *Client) GenerateToken(ctx context.Context, auth eosclient.Authorization return "", err } -func (c *Client) getVersionFolderInode(ctx context.Context, auth eosclient.Authorization, p string) (uint64, error) { +func (c *Client) getOrCreateVersionFolderInode(ctx context.Context, ownerAuth eosclient.Authorization, p string) (uint64, error) { log := appctx.GetLogger(ctx) - log.Info().Str("func", "getVersionFolderInode").Str("uid,gid", auth.Role.UID+","+auth.Role.GID).Str("p", p).Msg("") + log.Info().Str("func", "getOrCreateVersionFolderInode").Str("uid,gid", ownerAuth.Role.UID+","+ownerAuth.Role.GID).Str("p", p).Msg("") versionFolder := getVersionFolder(p) - md, err := c.GetFileInfoByPath(ctx, auth, versionFolder) + md, err := c.GetFileInfoByPath(ctx, ownerAuth, versionFolder) if err != nil { - if err = c.CreateDir(ctx, auth, versionFolder); err != nil { + if err = c.CreateDir(ctx, ownerAuth, versionFolder); err != nil { return 0, err } - md, err = c.GetFileInfoByPath(ctx, auth, versionFolder) + md, err = c.GetFileInfoByPath(ctx, ownerAuth, versionFolder) if err != nil { return 0, err } diff --git a/pkg/storage/utils/eosfs/eosfs.go b/pkg/storage/utils/eosfs/eosfs.go index d231224756..98076f3cfe 100644 --- a/pkg/storage/utils/eosfs/eosfs.go +++ b/pkg/storage/utils/eosfs/eosfs.go @@ -257,12 +257,11 @@ func (fs *eosfs) userIDcacheWarmup() { time.Sleep(2 * time.Second) ctx := context.Background() paths := []string{fs.wrap(ctx, "/")} - auth, _ := fs.getRootAuth(ctx) for i := 0; i < fs.conf.UserIDCacheWarmupDepth; i++ { var newPaths []string for _, fn := range paths { - if eosFileInfos, err := fs.c.List(ctx, auth, fn); err == nil { + if eosFileInfos, err := fs.c.List(ctx, utils.GetEmptyAuth(), fn); err == nil { for _, f := range eosFileInfos { _, _ = fs.getUserIDGateway(ctx, strconv.FormatUint(f.UID, 10)) newPaths = append(newPaths, f.File) @@ -454,10 +453,7 @@ func (fs *eosfs) getPath(ctx context.Context, id *provider.ResourceId) (string, return "", fmt.Errorf("error converting string to int for eos fileid: %s", id.OpaqueId) } - auth, err := fs.getRootAuth(ctx) - if err != nil { - return "", err - } + auth := utils.GetDaemonAuth() eosFileInfo, err := fs.c.GetFileInfoByInode(ctx, auth, fid) if err != nil { @@ -491,24 +487,15 @@ func (fs *eosfs) GetPathByID(ctx context.Context, id *provider.ResourceId) (stri if err != nil { return "", errors.Wrap(err, "eosfs: no user in ctx") } - if u.Id.Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT || u.Id.Type == userpb.UserType_USER_TYPE_FEDERATED { - auth, err := fs.getRootAuth(ctx) + + var auth eosclient.Authorization + if utils.IsLightweightUser(u) { + auth = utils.GetDaemonAuth() + } else { + auth, err = fs.getUserAuth(ctx, u, "") if err != nil { return "", err } - eosFileInfo, err := fs.c.GetFileInfoByInode(ctx, auth, fid) - if err != nil { - return "", errors.Wrap(err, "eosfs: error getting file info by inode") - } - if perm := fs.permissionSet(ctx, eosFileInfo, nil); perm.GetPath { - return fs.unwrap(ctx, eosFileInfo.File) - } - return "", errtypes.PermissionDenied("eosfs: getting path for id not allowed") - } - - auth, err := fs.getUserAuth(ctx, u, "") - if err != nil { - return "", err } eosFileInfo, err := fs.c.GetFileInfoByInode(ctx, auth, fid) @@ -516,6 +503,10 @@ func (fs *eosfs) GetPathByID(ctx context.Context, id *provider.ResourceId) (stri return "", errors.Wrap(err, "eosfs: error getting file info by inode") } + if perm := fs.permissionSet(ctx, eosFileInfo, nil); !perm.GetPath { + return "", errtypes.PermissionDenied("eosfs: getting path for id not allowed") + } + return fs.unwrap(ctx, eosFileInfo.File) } @@ -529,10 +520,7 @@ func (fs *eosfs) SetArbitraryMetadata(ctx context.Context, ref *provider.Referen return err } - rootAuth, err := fs.getRootAuth(ctx) - if err != nil { - return err - } + cboxAuth := utils.GetEmptyAuth() for k, v := range md.Metadata { if k == "" || v == "" { @@ -552,7 +540,7 @@ func (fs *eosfs) SetArbitraryMetadata(ctx context.Context, ref *provider.Referen // TODO(labkode): SetArbitraryMetadata does not have semantics for recursivity. // We set it to false - err := fs.c.SetAttr(ctx, rootAuth, attr, false, false, fn, "") + err := fs.c.SetAttr(ctx, cboxAuth, attr, false, false, fn, "") if err != nil { return errors.Wrap(err, "eosfs: error setting xattr in eos driver") } @@ -570,10 +558,7 @@ func (fs *eosfs) UnsetArbitraryMetadata(ctx context.Context, ref *provider.Refer return err } - rootAuth, err := fs.getRootAuth(ctx) - if err != nil { - return err - } + cboxAuth := utils.GetEmptyAuth() for _, k := range keys { if k == "" { @@ -585,7 +570,7 @@ func (fs *eosfs) UnsetArbitraryMetadata(ctx context.Context, ref *provider.Refer Key: k, } - err := fs.c.UnsetAttr(ctx, rootAuth, attr, false, fn, "") + err := fs.c.UnsetAttr(ctx, cboxAuth, attr, false, fn, "") if err != nil { if errors.Is(err, eosclient.AttrNotExistsError) { continue @@ -606,16 +591,14 @@ func (fs *eosfs) EncodeAppName(a string) string { func (fs *eosfs) getLockPayloads(ctx context.Context, path string) (string, string, error) { // sys attributes want root auth, buddy - rootauth, err := fs.getRootAuth(ctx) - if err != nil { - return "", "", err - } - data, err := fs.c.GetAttr(ctx, rootauth, "sys."+lockPayloadKey, path) + cboxAuth := utils.GetEmptyAuth() + + data, err := fs.c.GetAttr(ctx, cboxAuth, "sys."+lockPayloadKey, path) if err != nil { return "", "", err } - eoslock, err := fs.c.GetAttr(ctx, rootauth, "sys."+eosLockKey, path) + eoslock, err := fs.c.GetAttr(ctx, cboxAuth, "sys."+eosLockKey, path) if err != nil { return "", "", err } @@ -624,12 +607,9 @@ func (fs *eosfs) getLockPayloads(ctx context.Context, path string) (string, stri } func (fs *eosfs) removeLockAttrs(ctx context.Context, path, app string) error { - rootAuth, err := fs.getRootAuth(ctx) - if err != nil { - return err - } + cboxAuth := utils.GetEmptyAuth() - err = fs.c.UnsetAttr(ctx, rootAuth, &eosclient.Attribute{ + err := fs.c.UnsetAttr(ctx, cboxAuth, &eosclient.Attribute{ Type: SystemAttr, Key: eosLockKey, }, false, path, app) @@ -637,7 +617,7 @@ func (fs *eosfs) removeLockAttrs(ctx context.Context, path, app string) error { return errors.Wrap(err, "eosfs: error unsetting the eos lock") } - err = fs.c.UnsetAttr(ctx, rootAuth, &eosclient.Attribute{ + err = fs.c.UnsetAttr(ctx, cboxAuth, &eosclient.Attribute{ Type: SystemAttr, Key: lockPayloadKey, }, false, path, app) @@ -709,10 +689,7 @@ func (fs *eosfs) GetLock(ctx context.Context, ref *provider.Reference) (*provide } func (fs *eosfs) setLock(ctx context.Context, lock *provider.Lock, path string) error { - auth, err := fs.getRootAuth(ctx) - if err != nil { - return err - } + cboxAuth := utils.GetEmptyAuth() encodedLock, eosLock, err := fs.encodeLock(lock) if err != nil { @@ -720,7 +697,7 @@ func (fs *eosfs) setLock(ctx context.Context, lock *provider.Lock, path string) } // set eos lock - err = fs.c.SetAttr(ctx, auth, &eosclient.Attribute{ + err = fs.c.SetAttr(ctx, cboxAuth, &eosclient.Attribute{ Type: SystemAttr, Key: eosLockKey, Val: eosLock, @@ -733,7 +710,7 @@ func (fs *eosfs) setLock(ctx context.Context, lock *provider.Lock, path string) } // set payload - err = fs.c.SetAttr(ctx, auth, &eosclient.Attribute{ + err = fs.c.SetAttr(ctx, cboxAuth, &eosclient.Attribute{ Type: SystemAttr, Key: lockPayloadKey, Val: encodedLock, @@ -990,10 +967,7 @@ func (fs *eosfs) AddGrant(ctx context.Context, ref *provider.Reference, g *provi return err } - rootAuth, err := fs.getRootAuth(ctx) - if err != nil { - return err - } + cboxAuth := utils.GetEmptyAuth() eosACL, err := fs.getEosACL(ctx, g) if err != nil { @@ -1010,13 +984,13 @@ func (fs *eosfs) AddGrant(ctx context.Context, ref *provider.Reference, g *provi Key: fmt.Sprintf("%s.%s", lwShareAttrKey, eosACL.Qualifier), Val: eosACL.Permissions, } - if err := fs.c.SetAttr(ctx, rootAuth, attr, false, true, fn, ""); err != nil { + if err := fs.c.SetAttr(ctx, cboxAuth, attr, false, true, fn, ""); err != nil { return errors.Wrap(err, "eosfs: error adding acl for lightweight account") } return nil } - err = fs.c.AddACL(ctx, auth, rootAuth, fn, eosclient.StartPosition, eosACL) + err = fs.c.AddACL(ctx, auth, cboxAuth, fn, eosclient.StartPosition, eosACL) if err != nil { return errors.Wrap(err, "eosfs: error adding acl") } @@ -1031,10 +1005,7 @@ func (fs *eosfs) DenyGrant(ctx context.Context, ref *provider.Reference, g *prov position := eosclient.EndPosition - rootAuth, err := fs.getRootAuth(ctx) - if err != nil { - return err - } + cboxAuth := utils.GetEmptyAuth() // empty permissions => deny grant := &provider.Grant{ @@ -1047,7 +1018,7 @@ func (fs *eosfs) DenyGrant(ctx context.Context, ref *provider.Reference, g *prov return err } - err = fs.c.AddACL(ctx, auth, rootAuth, fn, position, eosACL) + err = fs.c.AddACL(ctx, auth, cboxAuth, fn, position, eosACL) if err != nil { return errors.Wrap(err, "eosfs: error adding acl") } @@ -1098,10 +1069,7 @@ func (fs *eosfs) RemoveGrant(ctx context.Context, ref *provider.Reference, g *pr return err } - rootAuth, err := fs.getRootAuth(ctx) - if err != nil { - return err - } + cboxAuth := utils.GetEmptyAuth() eosACL, err := fs.getEosACL(ctx, g) if err != nil { @@ -1113,13 +1081,13 @@ func (fs *eosfs) RemoveGrant(ctx context.Context, ref *provider.Reference, g *pr Type: SystemAttr, Key: fmt.Sprintf("%s.%s", lwShareAttrKey, eosACL.Qualifier), } - if err := fs.c.UnsetAttr(ctx, rootAuth, attr, true, fn, ""); err != nil { + if err := fs.c.UnsetAttr(ctx, cboxAuth, attr, true, fn, ""); err != nil { return errors.Wrap(err, "eosfs: error removing acl for lightweight account") } return nil } - err = fs.c.RemoveACL(ctx, auth, rootAuth, fn, eosACL) + err = fs.c.RemoveACL(ctx, auth, cboxAuth, fn, eosACL) if err != nil { return errors.Wrap(err, "eosfs: error removing acl") } @@ -1198,11 +1166,9 @@ func (fs *eosfs) ListGrants(ctx context.Context, ref *provider.Reference) ([]*pr } // Now we get the real info, I know, it's ugly - auth, err = fs.getRootAuth(ctx) - if err != nil { - return nil, err - } - attrs, err := fs.c.GetAttrs(ctx, auth, fn) + cboxAuth := utils.GetEmptyAuth() + + attrs, err := fs.c.GetAttrs(ctx, cboxAuth, fn) if err != nil { return nil, err } @@ -1233,15 +1199,13 @@ func (fs *eosfs) GetMD(ctx context.Context, ref *provider.Reference, mdKeys []st log := appctx.GetLogger(ctx) log.Info().Msg("eosfs: get md for ref:" + ref.String()) - _, err := getUser(ctx) - if err != nil { - return nil, err - } + p := ref.Path + fn := fs.wrap(ctx, p) - auth, err := fs.getRootAuth(ctx) - if err != nil { - return nil, err - } + // We use daemon for auth because we need access to the file in order to stat it + // We cannot use the current user, because the file may be a shared file + // and lightweight accounts don't have a uid + auth := utils.GetDaemonAuth() if ref.ResourceId != nil { fid, err := strconv.ParseUint(ref.ResourceId.OpaqueId, 10, 64) @@ -1263,8 +1227,6 @@ func (fs *eosfs) GetMD(ctx context.Context, ref *provider.Reference, mdKeys []st return fs.convertToResourceInfo(ctx, eosFileInfo) } - p := ref.Path - // if path is home we need to add in the response any shadow folder in the shadow homedirectory. if fs.conf.EnableHome { if fs.isShareFolder(ctx, p) { @@ -1272,7 +1234,6 @@ func (fs *eosfs) GetMD(ctx context.Context, ref *provider.Reference, mdKeys []st } } - fn := fs.wrap(ctx, p) eosFileInfo, err := fs.c.GetFileInfoByPath(ctx, auth, fn) if err != nil { return nil, err @@ -1284,10 +1245,7 @@ func (fs *eosfs) GetMD(ctx context.Context, ref *provider.Reference, mdKeys []st func (fs *eosfs) getMDShareFolder(ctx context.Context, p string, mdKeys []string) (*provider.ResourceInfo, error) { fn := fs.wrapShadow(ctx, p) - auth, err := fs.getRootAuth(ctx) - if err != nil { - return nil, err - } + auth := utils.GetDaemonAuth() eosFileInfo, err := fs.c.GetFileInfoByPath(ctx, auth, fn) if err != nil { @@ -1415,12 +1373,9 @@ func (fs *eosfs) GetQuota(ctx context.Context, ref *provider.Reference) (uint64, return 0, 0, err } - rootAuth, err := fs.getRootAuth(ctx) - if err != nil { - return 0, 0, err - } + cboxAuth := utils.GetEmptyAuth() - qi, err := fs.c.GetQuota(ctx, auth.Role.UID, rootAuth, fs.conf.QuotaNode) + qi, err := fs.c.GetQuota(ctx, auth.Role.UID, cboxAuth, fs.conf.QuotaNode) if err != nil { err := errors.Wrap(err, "eosfs: error getting quota") return 0, 0, err @@ -1443,16 +1398,15 @@ func (fs *eosfs) createShadowHome(ctx context.Context) error { if err != nil { return errors.Wrap(err, "eosfs: no user in ctx") } - rootAuth, err := fs.getRootAuth(ctx) - if err != nil { - return nil - } + + daemonAuth := utils.GetDaemonAuth() + home := fs.wrapShadow(ctx, "/") shadowFolders := []string{fs.conf.ShareFolder} for _, sf := range shadowFolders { fn := path.Join(home, sf) - _, err = fs.c.GetFileInfoByPath(ctx, rootAuth, fn) + _, err = fs.c.GetFileInfoByPath(ctx, daemonAuth, fn) if err != nil { if _, ok := err.(errtypes.IsNotFound); !ok { return errors.Wrap(err, "eosfs: error verifying if shadow directory exists") @@ -1672,10 +1626,7 @@ func (fs *eosfs) CreateReference(ctx context.Context, p string, targetURI *url.U // Current mechanism is: touch to hidden dir, set xattr, rename. dir, base := path.Split(fn) tmp := path.Join(dir, fmt.Sprintf(".sys.reva#.%s", base)) - rootAuth, err := fs.getRootAuth(ctx) - if err != nil { - return nil - } + cboxAuth := utils.GetEmptyAuth() if err := fs.createUserDir(ctx, u, tmp, false); err != nil { err = errors.Wrapf(err, "eosfs: error creating temporary ref file") @@ -1689,13 +1640,13 @@ func (fs *eosfs) CreateReference(ctx context.Context, p string, targetURI *url.U Val: targetURI.String(), } - if err := fs.c.SetAttr(ctx, rootAuth, attr, false, false, tmp, ""); err != nil { + if err := fs.c.SetAttr(ctx, cboxAuth, attr, false, false, tmp, ""); err != nil { err = errors.Wrapf(err, "eosfs: error setting reva.ref attr on file: %q", tmp) return err } // rename to have the file visible in user space. - if err := fs.c.Rename(ctx, rootAuth, tmp, fn); err != nil { + if err := fs.c.Rename(ctx, cboxAuth, tmp, fn); err != nil { err = errors.Wrapf(err, "eosfs: error renaming from: %q to %q", tmp, fn) return err } @@ -2174,7 +2125,7 @@ func (fs *eosfs) permissionSet(ctx context.Context, eosFileInfo *eosclient.FileI // from the parent folder, as these, when creating a new // file are not inherited - if utils.UserIsLightweight(u) && !eosFileInfo.IsDir { + if utils.IsLightweightUser(u) && !eosFileInfo.IsDir { if parentPath, err := fs.unwrap(ctx, filepath.Dir(eosFileInfo.File)); err == nil { if parent, err := fs.GetMD(ctx, &provider.Reference{Path: parentPath}, nil); err == nil { mergePermissions(&perm, parent.PermissionSet) @@ -2417,8 +2368,7 @@ func (fs *eosfs) getUserAuth(ctx context.Context, u *userpb.User, fn string) (eo return fs.singleUserAuth, err } - if u.Id.Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT || - u.Id.Type == userpb.UserType_USER_TYPE_FEDERATED { + if utils.IsLightweightUser(u) { return fs.getEOSToken(ctx, u, fn) } @@ -2430,11 +2380,8 @@ func (fs *eosfs) getEOSToken(ctx context.Context, u *userpb.User, fn string) (eo return eosclient.Authorization{}, errtypes.BadRequest("eosfs: path cannot be empty") } - rootAuth, err := fs.getRootAuth(ctx) - if err != nil { - return eosclient.Authorization{}, err - } - info, err := fs.c.GetFileInfoByPath(ctx, rootAuth, fn) + daemonAuth := utils.GetDaemonAuth() + info, err := fs.c.GetFileInfoByPath(ctx, daemonAuth, fn) if err != nil { return eosclient.Authorization{}, err } @@ -2489,6 +2436,18 @@ func (fs *eosfs) getRootAuth(ctx context.Context) (eosclient.Authorization, erro return eosclient.Authorization{Role: eosclient.Role{UID: "0", GID: "0"}}, nil } +func (fs *eosfs) getDaemonAuth(ctx context.Context) (eosclient.Authorization, error) { + if fs.conf.ForceSingleUserMode { + if fs.singleUserAuth.Role.UID != "" && fs.singleUserAuth.Role.GID != "" { + return fs.singleUserAuth, nil + } + var err error + fs.singleUserAuth, err = fs.getUIDGateway(ctx, &userpb.UserId{OpaqueId: fs.conf.SingleUsername}) + return fs.singleUserAuth, err + } + return utils.GetDaemonAuth(), nil +} + type eosSysMetadata struct { TreeSize uint64 `json:"tree_size"` TreeCount uint64 `json:"tree_count"` @@ -2533,96 +2492,3 @@ func parseAndSetFavoriteAttr(ctx context.Context, attrs map[string]string) { // Delete the favorite attr from the response delete(attrs, FavoritesKey) } - -/* - Merge shadow on requests for /home ? - - No - GetHome(ctx context.Context) (string, error) - No -CreateHome(ctx context.Context) error - No - CreateDir(ctx context.Context, fn string) error - No -Delete(ctx context.Context, ref *provider.Reference) error - No -Move(ctx context.Context, oldRef, newRef *provider.Reference) error - No -GetMD(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) - Yes -ListFolder(ctx context.Context, ref *provider.Reference) ([]*provider.ResourceInfo, error) - No -Upload(ctx context.Context, ref *provider.Reference, r io.ReadCloser) error - No -Download(ctx context.Context, ref *provider.Reference) (io.ReadCloser, error) - No -ListRevisions(ctx context.Context, ref *provider.Reference) ([]*provider.FileVersion, error) - No -DownloadRevision(ctx context.Context, ref *provider.Reference, key string) (io.ReadCloser, error) - No -RestoreRevision(ctx context.Context, ref *provider.Reference, key string) error - No ListRecycle(ctx context.Context) ([]*provider.RecycleItem, error) - No RestoreRecycleItem(ctx context.Context, key string) error - No PurgeRecycleItem(ctx context.Context, key string) error - No EmptyRecycle(ctx context.Context) error - ? GetPathByID(ctx context.Context, id *provider.Reference) (string, error) - No AddGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error - No RemoveGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error - No UpdateGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error - No ListGrants(ctx context.Context, ref *provider.Reference) ([]*provider.Grant, error) - No GetQuota(ctx context.Context) (int, int, error) - No CreateReference(ctx context.Context, path string, targetURI *url.URL) error - No Shutdown(ctx context.Context) error - No SetArbitraryMetadata(ctx context.Context, ref *provider.Reference, md *provider.ArbitraryMetadata) error - No UnsetArbitraryMetadata(ctx context.Context, ref *provider.Reference, keys []string) error -*/ - -/* - Merge shadow on requests for /home/MyShares ? - - No - GetHome(ctx context.Context) (string, error) - No -CreateHome(ctx context.Context) error - No - CreateDir(ctx context.Context, fn string) error - Maybe -Delete(ctx context.Context, ref *provider.Reference) error - No -Move(ctx context.Context, oldRef, newRef *provider.Reference) error - Yes -GetMD(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) - Yes -ListFolder(ctx context.Context, ref *provider.Reference) ([]*provider.ResourceInfo, error) - No -Upload(ctx context.Context, ref *provider.Reference, r io.ReadCloser) error - No -Download(ctx context.Context, ref *provider.Reference) (io.ReadCloser, error) - No -ListRevisions(ctx context.Context, ref *provider.Reference) ([]*provider.FileVersion, error) - No -DownloadRevision(ctx context.Context, ref *provider.Reference, key string) (io.ReadCloser, error) - No -RestoreRevision(ctx context.Context, ref *provider.Reference, key string) error - No ListRecycle(ctx context.Context) ([]*provider.RecycleItem, error) - No RestoreRecycleItem(ctx context.Context, key string) error - No PurgeRecycleItem(ctx context.Context, key string) error - No EmptyRecycle(ctx context.Context) error - ? GetPathByID(ctx context.Context, id *provider.Reference) (string, error) - No AddGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error - No RemoveGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error - No UpdateGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error - No ListGrants(ctx context.Context, ref *provider.Reference) ([]*provider.Grant, error) - No GetQuota(ctx context.Context) (int, int, error) - No CreateReference(ctx context.Context, path string, targetURI *url.URL) error - No Shutdown(ctx context.Context) error - No SetArbitraryMetadata(ctx context.Context, ref *provider.Reference, md *provider.ArbitraryMetadata) error - No UnsetArbitraryMetadata(ctx context.Context, ref *provider.Reference, keys []string) error -*/ - -/* - Merge shadow on requests for /home/MyShares/file-reference ? - - No - GetHome(ctx context.Context) (string, error) - No -CreateHome(ctx context.Context) error - No - CreateDir(ctx context.Context, fn string) error - Maybe -Delete(ctx context.Context, ref *provider.Reference) error - Yes -Move(ctx context.Context, oldRef, newRef *provider.Reference) error - Yes -GetMD(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) - No -ListFolder(ctx context.Context, ref *provider.Reference) ([]*provider.ResourceInfo, error) - No -Upload(ctx context.Context, ref *provider.Reference, r io.ReadCloser) error - No -Download(ctx context.Context, ref *provider.Reference) (io.ReadCloser, error) - No -ListRevisions(ctx context.Context, ref *provider.Reference) ([]*provider.FileVersion, error) - No -DownloadRevision(ctx context.Context, ref *provider.Reference, key string) (io.ReadCloser, error) - No -RestoreRevision(ctx context.Context, ref *provider.Reference, key string) error - No ListRecycle(ctx context.Context) ([]*provider.RecycleItem, error) - No RestoreRecycleItem(ctx context.Context, key string) error - No PurgeRecycleItem(ctx context.Context, key string) error - No EmptyRecycle(ctx context.Context) error - ? GetPathByID(ctx context.Context, id *provider.Reference) (string, error) - No AddGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error - No RemoveGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error - No UpdateGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error - No ListGrants(ctx context.Context, ref *provider.Reference) ([]*provider.Grant, error) - No GetQuota(ctx context.Context) (int, int, error) - No CreateReference(ctx context.Context, path string, targetURI *url.URL) error - No Shutdown(ctx context.Context) error - Maybe SetArbitraryMetadata(ctx context.Context, ref *provider.Reference, md *provider.ArbitraryMetadata) error - Maybe UnsetArbitraryMetadata(ctx context.Context, ref *provider.Reference, keys []string) error -*/ diff --git a/pkg/utils/utils.go b/pkg/utils/utils.go index 20b69847c0..1ce62e4e06 100644 --- a/pkg/utils/utils.go +++ b/pkg/utils/utils.go @@ -37,6 +37,7 @@ import ( userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1" provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1" types "github.com/cs3org/go-cs3apis/cs3/types/v1beta1" + "github.com/cs3org/reva/pkg/eosclient" "github.com/cs3org/reva/pkg/registry" "github.com/cs3org/reva/pkg/registry/memory" "go.step.sm/crypto/randutil" @@ -423,9 +424,9 @@ func HasPermissions(target, toCheck *provider.ResourcePermissions) bool { return true } -// UserIsLightweight returns true if the user is a lightweight +// IsLightweightUser returns true if the user is a lightweight // or federated account. -func UserIsLightweight(u *userpb.User) bool { +func IsLightweightUser(u *userpb.User) bool { return u.Id.Type == userpb.UserType_USER_TYPE_FEDERATED || u.Id.Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT } @@ -443,3 +444,15 @@ func Cast(v any, to any) { toVal = toVal.Elem() toVal.Set(reflect.ValueOf(v)) } + +func GetDaemonAuth() eosclient.Authorization { + return eosclient.Authorization{Role: eosclient.Role{UID: "2", GID: "2"}} +} + +// This function is used when we don't want to pass any additional auth info. +// Because we later populate the secret key for gRPC, we will be automatically +// mapped to cbox. +// So, in other words, use this function if you want to use the cbox account. +func GetEmptyAuth() eosclient.Authorization { + return eosclient.Authorization{} +} From d463add0861ab0a2b78e8a79a40a22f5a1c5deb3 Mon Sep 17 00:00:00 2001 From: Jesse Geens Date: Mon, 9 Dec 2024 14:19:31 +0100 Subject: [PATCH 2/4] Remove duplicate code in EOS http --- pkg/eosclient/eosgrpc/eoshttp.go | 8 -------- 1 file changed, 8 deletions(-) diff --git a/pkg/eosclient/eosgrpc/eoshttp.go b/pkg/eosclient/eosgrpc/eoshttp.go index bab34cf5b5..c69c069241 100644 --- a/pkg/eosclient/eosgrpc/eoshttp.go +++ b/pkg/eosclient/eosgrpc/eoshttp.go @@ -429,14 +429,6 @@ func (c *EOSHTTPClient) PUTFile(ctx context.Context, remoteuser string, auth eos log.Debug().Str("func", "PUTFile").Int64("Content-Length", length).Msg("setting header") req.Header.Set("Content-Length", strconv.FormatInt(length, 10)) } - if err != nil { - log.Error().Str("func", "PUTFile").Str("url", loc.String()).Str("err", err.Error()).Msg("can't create redirected request") - return err - } - if length >= 0 { - log.Debug().Str("func", "PUTFile").Int64("Content-Length", length).Msg("setting header") - req.Header.Set("Content-Length", strconv.FormatInt(length, 10)) - } log.Debug().Str("func", "PUTFile").Str("location", loc.String()).Msg("redirection") nredirs++ From 97288a4ea99d96f97c58b3bc643d568f6e11163f Mon Sep 17 00:00:00 2001 From: Giuseppe Lo Presti Date: Mon, 2 Dec 2024 15:32:43 +0100 Subject: [PATCH 3/4] Remove shadow namespace and externalize create_home and user quota logic to script * Replaced home creation function with external script * Removed shadow namespace and related code * eosfs: also removed user quota logic, externalized to the create_home_hook script --- pkg/eosclient/eosgrpc/eosgrpc.go | 6 +- pkg/storage/utils/eosfs/config.go | 27 +-- pkg/storage/utils/eosfs/eosfs.go | 368 ++++-------------------------- pkg/storage/utils/eosfs/upload.go | 4 - 4 files changed, 44 insertions(+), 361 deletions(-) diff --git a/pkg/eosclient/eosgrpc/eosgrpc.go b/pkg/eosclient/eosgrpc/eosgrpc.go index 73a2df2eda..296289f75b 100644 --- a/pkg/eosclient/eosgrpc/eosgrpc.go +++ b/pkg/eosclient/eosgrpc/eosgrpc.go @@ -853,13 +853,9 @@ func (c *Client) GetQuota(ctx context.Context, username string, rootAuth eosclie return nil, errtypes.InternalError(fmt.Sprintf("Quota error from eos. info: '%#v'", resp.Quota)) } - qi := new(eosclient.QuotaInfo) - if resp == nil { - return nil, errtypes.InternalError("Out of memory") - } - // Let's loop on all the quotas that match this uid (apparently there can be many) // If there are many for this node, we sum them up + qi := new(eosclient.QuotaInfo) for i := 0; i < len(resp.Quota.Quotanode); i++ { log.Debug().Str("func", "GetQuota").Str("quotanode:", fmt.Sprintf("%d: %#v", i, resp.Quota.Quotanode[i])).Msg("") diff --git a/pkg/storage/utils/eosfs/config.go b/pkg/storage/utils/eosfs/config.go index 6017edf671..86b54c7496 100644 --- a/pkg/storage/utils/eosfs/config.go +++ b/pkg/storage/utils/eosfs/config.go @@ -26,25 +26,6 @@ type Config struct { // QuotaNode for storing quota information QuotaNode string `mapstructure:"quota_node"` - // DefaultQuotaBytes sets the default maximum bytes available for a user - DefaultQuotaBytes uint64 `mapstructure:"default_quota_bytes"` - - // DefaultSecondaryQuotaBytes sets the default maximum bytes available for a secondary user - DefaultSecondaryQuotaBytes uint64 `mapstructure:"default_secondary_quota_bytes"` - - // DefaultQuotaFiles sets the default maximum files available for a user - DefaultQuotaFiles uint64 `mapstructure:"default_quota_files"` - - // ShadowNamespace for storing shadow data - ShadowNamespace string `mapstructure:"shadow_namespace"` - - // UploadsNamespace for storing upload data - UploadsNamespace string `mapstructure:"uploads_namespace"` - - // ShareFolder defines the name of the folder in the - // shadowed namespace. Ex: /eos/user/.shadow/h/hugo/MyShares - ShareFolder string `mapstructure:"share_folder"` - // Location of the eos binary. // Default is /usr/bin/eos. EosBinary string `mapstructure:"eos_binary"` @@ -149,9 +130,6 @@ type Config struct { // revisions-related operations. ImpersonateOwnerforRevisions bool `mapstructure:"impersonate_owner_for_revisions"` - // Whether to enable the post create home hook - EnablePostCreateHomeHook bool `mapstructure:"enable_post_create_home_hook"` - // HTTP connections to EOS: max number of idle conns MaxIdleConns int `mapstructure:"max_idle_conns"` @@ -177,8 +155,9 @@ type Config struct { // Default is 3600 TokenExpiry int - // Path of the script to run after an user home folder has been created - OnPostCreateHomeHook string `mapstructure:"on_post_create_home_hook"` + // Path of the script to run in order to create a user home folder + // TODO(lopresti): to be replaced by a call to the Resource Lifecycle API being developed + CreateHomeHook string `mapstructure:"create_home_hook"` // Maximum entries count a ListRecycle call may return: if exceeded, ListRecycle // will return a BadRequest error diff --git a/pkg/storage/utils/eosfs/eosfs.go b/pkg/storage/utils/eosfs/eosfs.go index 98076f3cfe..0ad876fd2c 100644 --- a/pkg/storage/utils/eosfs/eosfs.go +++ b/pkg/storage/utils/eosfs/eosfs.go @@ -86,31 +86,11 @@ func (c *Config) ApplyDefaults() { c.Namespace = "/" } - if c.ShadowNamespace == "" { - c.ShadowNamespace = path.Join(c.Namespace, ".shadow") - } - // Quota node defaults to namespace if empty if c.QuotaNode == "" { c.QuotaNode = c.Namespace } - if c.DefaultQuotaBytes == 0 { - c.DefaultQuotaBytes = 2000000000000 // 1 TB logical - } - if c.DefaultSecondaryQuotaBytes == 0 { - c.DefaultSecondaryQuotaBytes = c.DefaultQuotaBytes - } - if c.DefaultQuotaFiles == 0 { - c.DefaultQuotaFiles = 1000000 // 1 Million - } - - if c.ShareFolder == "" { - c.ShareFolder = "/MyShares" - } - // ensure share folder always starts with slash - c.ShareFolder = path.Join("/", c.ShareFolder) - if c.EosBinary == "" { c.EosBinary = "/usr/bin/eos" } @@ -289,50 +269,27 @@ func getUser(ctx context.Context) (*userpb.User, error) { func (fs *eosfs) getLayout(ctx context.Context) (layout string) { if fs.conf.EnableHome { - u, err := getUser(ctx) - if err != nil { - panic(err) - } + u := appctx.ContextMustGetUser(ctx) layout = templates.WithUser(u, fs.conf.UserLayout) } return } -func (fs *eosfs) getInternalHome(ctx context.Context) (string, error) { +func (fs *eosfs) getInternalHome(ctx context.Context) string { if !fs.conf.EnableHome { - return "", errtypes.NotSupported("eos: get home not supported") - } - - u, err := getUser(ctx) - if err != nil { - err = errors.Wrap(err, "eosfs: wrap: no user in ctx and home is enabled") - return "", err + // TODO(lopresti): this is to be removed as we always want to support home, + // cf. https://github.com/cs3org/reva/pull/4940 + return "/" } + u := appctx.ContextMustGetUser(ctx) relativeHome := templates.WithUser(u, fs.conf.UserLayout) - return relativeHome, nil -} - -func (fs *eosfs) wrapShadow(ctx context.Context, fn string) (internal string) { - if fs.conf.EnableHome { - layout, err := fs.getInternalHome(ctx) - if err != nil { - panic(err) - } - internal = path.Join(fs.conf.ShadowNamespace, layout, fn) - } else { - internal = path.Join(fs.conf.ShadowNamespace, fn) - } - return + return relativeHome } func (fs *eosfs) wrap(ctx context.Context, fn string) (internal string) { if fs.conf.EnableHome { - layout, err := fs.getInternalHome(ctx) - if err != nil { - panic(err) - } - internal = path.Join(fs.conf.Namespace, layout, fn) + internal = path.Join(fs.conf.Namespace, fs.getInternalHome(ctx), fn) } else { internal = path.Join(fs.conf.Namespace, fn) } @@ -344,7 +301,7 @@ func (fs *eosfs) wrap(ctx context.Context, fn string) (internal string) { func (fs *eosfs) unwrap(ctx context.Context, internal string) (string, error) { log := appctx.GetLogger(ctx) layout := fs.getLayout(ctx) - ns, err := fs.getNsMatch(internal, []string{fs.conf.Namespace, fs.conf.ShadowNamespace}) + ns, err := fs.getNsMatch(internal, []string{fs.conf.Namespace}) if err != nil { return "", err } @@ -388,39 +345,17 @@ func (fs *eosfs) unwrapInternal(ctx context.Context, ns, np, layout string) (str return external, nil } -func (fs *eosfs) resolveRefForbidShareFolder(ctx context.Context, ref *provider.Reference) (string, eosclient.Authorization, error) { - p, err := fs.resolve(ctx, ref) - if err != nil { - return "", eosclient.Authorization{}, errors.Wrap(err, "eosfs: error resolving reference") - } - if fs.isShareFolder(ctx, p) { - return "", eosclient.Authorization{}, errtypes.PermissionDenied("eosfs: cannot perform operation under the virtual share folder") - } - fn := fs.wrap(ctx, p) - - u, err := getUser(ctx) - if err != nil { - return "", eosclient.Authorization{}, errors.Wrap(err, "eosfs: no user in ctx") - } - auth, err := fs.getUserAuth(ctx, u, fn) - if err != nil { - return "", eosclient.Authorization{}, err - } - - return fn, auth, nil -} - func (fs *eosfs) resolveRefAndGetAuth(ctx context.Context, ref *provider.Reference) (string, eosclient.Authorization, error) { p, err := fs.resolve(ctx, ref) if err != nil { return "", eosclient.Authorization{}, errors.Wrap(err, "eosfs: error resolving reference") } - fn := fs.wrap(ctx, p) u, err := getUser(ctx) if err != nil { return "", eosclient.Authorization{}, errors.Wrap(err, "eosfs: no user in ctx") } + fn := fs.wrap(ctx, p) auth, err := fs.getUserAuth(ctx, u, fn) if err != nil { return "", eosclient.Authorization{}, err @@ -463,20 +398,6 @@ func (fs *eosfs) getPath(ctx context.Context, id *provider.ResourceId) (string, return fs.unwrap(ctx, eosFileInfo.File) } -func (fs *eosfs) isShareFolder(ctx context.Context, p string) bool { - return strings.HasPrefix(p, fs.conf.ShareFolder) -} - -func (fs *eosfs) isShareFolderRoot(ctx context.Context, p string) bool { - return path.Clean(p) == fs.conf.ShareFolder -} - -func (fs *eosfs) isShareFolderChild(ctx context.Context, p string) bool { - p = path.Clean(p) - vals := strings.Split(p, fs.conf.ShareFolder+"/") - return len(vals) > 1 && vals[1] != "" -} - func (fs *eosfs) GetPathByID(ctx context.Context, id *provider.ResourceId) (string, error) { fid, err := strconv.ParseUint(id.OpaqueId, 10, 64) if err != nil { @@ -668,8 +589,6 @@ func (fs *eosfs) GetLock(ctx context.Context, ref *provider.Reference) (*provide if err != nil { return nil, errors.Wrap(err, "eosfs: error resolving reference") } - path = fs.wrap(ctx, path) - user, err := getUser(ctx) if err != nil { return nil, errors.Wrap(err, "eosfs: no user in ctx") @@ -685,6 +604,7 @@ func (fs *eosfs) GetLock(ctx context.Context, ref *provider.Reference) (*provide return nil, errtypes.BadRequest("user has no read access on resource") } + path = fs.wrap(ctx, path) return fs.getLock(ctx, user, path, ref) } @@ -731,7 +651,6 @@ func (fs *eosfs) SetLock(ctx context.Context, ref *provider.Reference, l *provid if err != nil { return errors.Wrap(err, "eosfs: error resolving reference") } - path = fs.wrap(ctx, path) user, err := getUser(ctx) if err != nil { @@ -762,6 +681,7 @@ func (fs *eosfs) SetLock(ctx context.Context, ref *provider.Reference, l *provid } } + path = fs.wrap(ctx, path) return fs.setLock(ctx, l, path) } @@ -1227,13 +1147,6 @@ func (fs *eosfs) GetMD(ctx context.Context, ref *provider.Reference, mdKeys []st return fs.convertToResourceInfo(ctx, eosFileInfo) } - // if path is home we need to add in the response any shadow folder in the shadow homedirectory. - if fs.conf.EnableHome { - if fs.isShareFolder(ctx, p) { - return fs.getMDShareFolder(ctx, p, mdKeys) - } - } - eosFileInfo, err := fs.c.GetFileInfoByPath(ctx, auth, fn) if err != nil { return nil, err @@ -1242,45 +1155,12 @@ func (fs *eosfs) GetMD(ctx context.Context, ref *provider.Reference, mdKeys []st return fs.convertToResourceInfo(ctx, eosFileInfo) } -func (fs *eosfs) getMDShareFolder(ctx context.Context, p string, mdKeys []string) (*provider.ResourceInfo, error) { - fn := fs.wrapShadow(ctx, p) - - auth := utils.GetDaemonAuth() - - eosFileInfo, err := fs.c.GetFileInfoByPath(ctx, auth, fn) - if err != nil { - return nil, err - } - - if fs.isShareFolderRoot(ctx, p) { - return fs.convertToResourceInfo(ctx, eosFileInfo) - } - return fs.convertToFileReference(ctx, eosFileInfo) -} - func (fs *eosfs) ListFolder(ctx context.Context, ref *provider.Reference, mdKeys []string) ([]*provider.ResourceInfo, error) { p, err := fs.resolve(ctx, ref) if err != nil { return nil, errors.Wrap(err, "eosfs: error resolving reference") } - if fs.conf.EnableHome { - return fs.listWithHome(ctx, p) - } - - return fs.listWithNominalHome(ctx, p) -} - -func (fs *eosfs) listWithHome(ctx context.Context, p string) ([]*provider.ResourceInfo, error) { - if fs.isShareFolderRoot(ctx, p) { - return fs.listShareFolderRoot(ctx, p) - } - - if fs.isShareFolderChild(ctx, p) { - return nil, errtypes.PermissionDenied("eos: error listing folders inside the shared folder, only file references are stored inside") - } - - // path points to a resource in the nominal home return fs.listWithNominalHome(ctx, p) } @@ -1322,41 +1202,6 @@ func (fs *eosfs) listWithNominalHome(ctx context.Context, p string) (finfos []*p return finfos, nil } -func (fs *eosfs) listShareFolderRoot(ctx context.Context, p string) (finfos []*provider.ResourceInfo, err error) { - fn := fs.wrapShadow(ctx, p) - - u, err := getUser(ctx) - if err != nil { - return nil, errors.Wrap(err, "eosfs: no user in ctx") - } - // lightweight accounts don't have share folders, so we're passing an empty string as path - auth, err := fs.getUserAuth(ctx, u, "") - if err != nil { - return nil, err - } - - eosFileInfos, err := fs.c.List(ctx, auth, fn) - if err != nil { - return nil, errors.Wrap(err, "eosfs: error listing") - } - - for _, eosFileInfo := range eosFileInfos { - // filter out sys files - if !fs.conf.ShowHiddenSysFiles { - base := path.Base(eosFileInfo.File) - if hiddenReg.MatchString(base) { - continue - } - } - - if finfo, err := fs.convertToFileReference(ctx, eosFileInfo); err == nil { - finfos = append(finfos, finfo) - } - } - - return finfos, nil -} - // CreateStorageSpace creates a storage space. func (fs *eosfs) CreateStorageSpace(ctx context.Context, req *provider.CreateStorageSpaceRequest) (*provider.CreateStorageSpaceResponse, error) { return nil, fmt.Errorf("unimplemented: CreateStorageSpace") @@ -1393,37 +1238,6 @@ func (fs *eosfs) GetHome(ctx context.Context) (string, error) { return "/", nil } -func (fs *eosfs) createShadowHome(ctx context.Context) error { - u, err := getUser(ctx) - if err != nil { - return errors.Wrap(err, "eosfs: no user in ctx") - } - - daemonAuth := utils.GetDaemonAuth() - - home := fs.wrapShadow(ctx, "/") - shadowFolders := []string{fs.conf.ShareFolder} - - for _, sf := range shadowFolders { - fn := path.Join(home, sf) - _, err = fs.c.GetFileInfoByPath(ctx, daemonAuth, fn) - if err != nil { - if _, ok := err.(errtypes.IsNotFound); !ok { - return errors.Wrap(err, "eosfs: error verifying if shadow directory exists") - } - err = fs.createUserDir(ctx, u, fn, false) - if err != nil { - return err - } - } - } - - log := appctx.GetLogger(ctx) - log.Info().Str("home", home).Interface("user", u.Id).Msg("created shadow home") - - return nil -} - func (fs *eosfs) createNominalHome(ctx context.Context) error { home := fs.wrap(ctx, "/") @@ -1431,17 +1245,13 @@ func (fs *eosfs) createNominalHome(ctx context.Context) error { if err != nil { return errors.Wrap(err, "eosfs: no user in ctx") } + auth, err := fs.getUserAuth(ctx, u, "") if err != nil { return err } - rootAuth, err := fs.getRootAuth(ctx) - if err != nil { - return nil - } - - _, err = fs.c.GetFileInfoByPath(ctx, rootAuth, home) + _, err = fs.c.GetFileInfoByPath(ctx, auth, home) if err == nil { // home already exists return nil } @@ -1450,41 +1260,21 @@ func (fs *eosfs) createNominalHome(ctx context.Context) error { return errors.Wrap(err, "eosfs: error verifying if user home directory exists") } - err = fs.createUserDir(ctx, u, home, false) - if err != nil { - err := errors.Wrap(err, "eosfs: error creating user dir") - return err - } - - // set quota for user, depending on its type - quotaBytes := fs.conf.DefaultQuotaBytes - if u.Id.Type != userpb.UserType_USER_TYPE_PRIMARY { - quotaBytes = fs.conf.DefaultSecondaryQuotaBytes - } - quotaInfo := &eosclient.SetQuotaInfo{ - Username: u.Username, - UID: auth.Role.UID, - GID: auth.Role.GID, - MaxBytes: quotaBytes, - MaxFiles: fs.conf.DefaultQuotaFiles, - QuotaNode: fs.conf.QuotaNode, - } - - err = fs.c.SetQuota(ctx, rootAuth, quotaInfo) - if err != nil { - err := errors.Wrap(err, "eosfs: error setting quota") - return err - } + log := appctx.GetLogger(ctx) + log.Info().Interface("user", u.Id).Msg("creating user home") - if fs.conf.EnablePostCreateHomeHook { - if err := fs.runPostCreateHomeHook(ctx); err != nil { - return errors.Wrap(err, "eosfs: error running post create home hook") + if fs.conf.CreateHomeHook != "" { + hook := exec.Command(fs.conf.CreateHomeHook, u.Username, utils.UserTypeToString(u.Id.Type)) + err = hook.Run() + log.Info().Interface("output", hook.Stdout).Err(err).Msg("create_home_hook output") + if err != nil { + return errors.Wrap(err, "eosfs: error running create home hook") } + } else { + log.Fatal().Msg("create_home_hook not configured") + return errtypes.NotFound("eosfs: create home hook not configured") } - log := appctx.GetLogger(ctx) - log.Info().Interface("quotaInfo", quotaInfo).Interface("user", u.Id).Msg("created nominal home") - return nil } @@ -1497,18 +1287,9 @@ func (fs *eosfs) CreateHome(ctx context.Context) error { return errors.Wrap(err, "eosfs: error creating nominal home") } - if err := fs.createShadowHome(ctx); err != nil { - return errors.Wrap(err, "eosfs: error creating shadow home") - } - return nil } -func (fs *eosfs) runPostCreateHomeHook(ctx context.Context) error { - user := appctx.ContextMustGetUser(ctx) - return exec.Command(fs.conf.OnPostCreateHomeHook, user.Username).Run() -} - func (fs *eosfs) createUserDir(ctx context.Context, u *userpb.User, path string, recursiveAttr bool) error { rootAuth, err := fs.getRootAuth(ctx) if err != nil { @@ -1571,15 +1352,11 @@ func (fs *eosfs) createUserDir(ctx context.Context, u *userpb.User, path string, func (fs *eosfs) CreateDir(ctx context.Context, ref *provider.Reference) error { log := appctx.GetLogger(ctx) + p, err := fs.resolve(ctx, ref) if err != nil { return errors.Wrap(err, "eosfs: error resolving reference") } - if fs.isShareFolder(ctx, p) { - return errtypes.PermissionDenied("eosfs: cannot perform operation under the virtual share folder") - } - fn := fs.wrap(ctx, p) - u, err := getUser(ctx) if err != nil { return errors.Wrap(err, "eosfs: no user in ctx") @@ -1587,6 +1364,7 @@ func (fs *eosfs) CreateDir(ctx context.Context, ref *provider.Reference) error { // We need the auth corresponding to the parent directory // as the file might not exist at the moment + fn := fs.wrap(ctx, p) auth, err := fs.getUserAuth(ctx, u, path.Dir(fn)) if err != nil { return err @@ -1610,25 +1388,19 @@ func (fs *eosfs) TouchFile(ctx context.Context, ref *provider.Reference) error { } func (fs *eosfs) CreateReference(ctx context.Context, p string, targetURI *url.URL) error { - // TODO(labkode): for the time being we only allow creating references - // in the virtual share folder to not pollute the nominal user tree. - if !fs.isShareFolder(ctx, p) { - return errtypes.PermissionDenied("eosfs: cannot create references outside the share folder: share_folder=" + fs.conf.ShareFolder + " path=" + p) - } - u, err := getUser(ctx) + _, err := getUser(ctx) if err != nil { return errors.Wrap(err, "eosfs: no user in ctx") } - fn := fs.wrapShadow(ctx, p) - // TODO(labkode): with the grpc plugin we can create a file touching with xattrs. - // Current mechanism is: touch to hidden dir, set xattr, rename. + // Current mechanism is: touch to hidden location, set xattr, rename. + fn := fs.wrap(ctx, p) dir, base := path.Split(fn) tmp := path.Join(dir, fmt.Sprintf(".sys.reva#.%s", base)) cboxAuth := utils.GetEmptyAuth() - if err := fs.createUserDir(ctx, u, tmp, false); err != nil { + if err := fs.c.CreateDir(ctx, cboxAuth, tmp); err != nil { err = errors.Wrapf(err, "eosfs: error creating temporary ref file") return err } @@ -1659,17 +1431,12 @@ func (fs *eosfs) Delete(ctx context.Context, ref *provider.Reference) error { if err != nil { return errors.Wrap(err, "eosfs: error resolving reference") } - - if fs.isShareFolder(ctx, p) { - return fs.deleteShadow(ctx, p) - } - - fn := fs.wrap(ctx, p) - u, err := getUser(ctx) if err != nil { return errors.Wrap(err, "eosfs: no user in ctx") } + + fn := fs.wrap(ctx, p) auth, err := fs.getUserAuth(ctx, u, fn) if err != nil { return err @@ -1678,50 +1445,23 @@ func (fs *eosfs) Delete(ctx context.Context, ref *provider.Reference) error { return fs.c.Remove(ctx, auth, fn, false) } -func (fs *eosfs) deleteShadow(ctx context.Context, p string) error { - if fs.isShareFolderRoot(ctx, p) { - return errtypes.PermissionDenied("eosfs: cannot delete the virtual share folder") - } - - if fs.isShareFolderChild(ctx, p) { - fn := fs.wrapShadow(ctx, p) - - // in order to remove the folder or the file without - // moving it to the recycle bin, we should take - // the privileges of the root - auth, err := fs.getRootAuth(ctx) - if err != nil { - return err - } - - return fs.c.Remove(ctx, auth, fn, true) +func (fs *eosfs) Move(ctx context.Context, oldRef, newRef *provider.Reference) error { + u, err := getUser(ctx) + if err != nil { + return errors.Wrap(err, "eosfs: no user in ctx") } - return errors.New("eosfs: shadow delete of share folder that is neither root nor child. path=" + p) -} - -func (fs *eosfs) Move(ctx context.Context, oldRef, newRef *provider.Reference) error { oldPath, err := fs.resolve(ctx, oldRef) if err != nil { return errors.Wrap(err, "eosfs: error resolving reference") } - newPath, err := fs.resolve(ctx, newRef) if err != nil { return errors.Wrap(err, "eosfs: error resolving reference") } - if fs.isShareFolder(ctx, oldPath) || fs.isShareFolder(ctx, newPath) { - return fs.moveShadow(ctx, oldPath, newPath) - } - oldFn := fs.wrap(ctx, oldPath) newFn := fs.wrap(ctx, newPath) - - u, err := getUser(ctx) - if err != nil { - return errors.Wrap(err, "eosfs: no user in ctx") - } auth, err := fs.getUserAuth(ctx, u, oldFn) if err != nil { return err @@ -1730,36 +1470,8 @@ func (fs *eosfs) Move(ctx context.Context, oldRef, newRef *provider.Reference) e return fs.c.Rename(ctx, auth, oldFn, newFn) } -func (fs *eosfs) moveShadow(ctx context.Context, oldPath, newPath string) error { - if fs.isShareFolderRoot(ctx, oldPath) || fs.isShareFolderRoot(ctx, newPath) { - return errtypes.PermissionDenied("eosfs: cannot move/rename the virtual share folder") - } - - // only rename of the reference is allowed, hence having the same basedir - bold, _ := path.Split(oldPath) - bnew, _ := path.Split(newPath) - - if bold != bnew { - return errtypes.PermissionDenied("eosfs: cannot move references under the virtual share folder") - } - - oldfn := fs.wrapShadow(ctx, oldPath) - newfn := fs.wrapShadow(ctx, newPath) - - u, err := getUser(ctx) - if err != nil { - return errors.Wrap(err, "eosfs: no user in ctx") - } - auth, err := fs.getUserAuth(ctx, u, "") - if err != nil { - return err - } - - return fs.c.Rename(ctx, auth, oldfn, newfn) -} - func (fs *eosfs) Download(ctx context.Context, ref *provider.Reference) (io.ReadCloser, error) { - fn, auth, err := fs.resolveRefForbidShareFolder(ctx, ref) + fn, auth, err := fs.resolveRefAndGetAuth(ctx, ref) if err != nil { return nil, err } @@ -1834,7 +1546,7 @@ func (fs *eosfs) DownloadRevision(ctx context.Context, ref *provider.Reference, return nil, errtypes.PermissionDenied("eosfs: user doesn't have permissions to download revisions") } } else { - fn, auth, err = fs.resolveRefForbidShareFolder(ctx, ref) + fn, auth, err = fs.resolveRefAndGetAuth(ctx, ref) if err != nil { return nil, err } @@ -1867,7 +1579,7 @@ func (fs *eosfs) RestoreRevision(ctx context.Context, ref *provider.Reference, r return errtypes.PermissionDenied("eosfs: user doesn't have permissions to restore revisions") } } else { - fn, auth, err = fs.resolveRefForbidShareFolder(ctx, ref) + fn, auth, err = fs.resolveRefAndGetAuth(ctx, ref) if err != nil { return err } diff --git a/pkg/storage/utils/eosfs/upload.go b/pkg/storage/utils/eosfs/upload.go index fb46c2699d..5de666ae97 100644 --- a/pkg/storage/utils/eosfs/upload.go +++ b/pkg/storage/utils/eosfs/upload.go @@ -36,10 +36,6 @@ func (fs *eosfs) Upload(ctx context.Context, ref *provider.Reference, r io.ReadC return errors.Wrap(err, "eos: error resolving reference") } - if fs.isShareFolder(ctx, p) { - return errtypes.PermissionDenied("eos: cannot upload under the virtual share folder") - } - ok, err := chunking.IsChunked(p) if err != nil { return errors.Wrap(err, "eos: error checking path") From e172a77fdb9bf0d97adcd22a93eb4301f1b7c336 Mon Sep 17 00:00:00 2001 From: Jesse Geens Date: Mon, 9 Dec 2024 11:40:37 +0100 Subject: [PATCH 4/4] Wrote helper function for getting uid/gid, function for setting user or daemon auth --- changelog/unreleased/no-more-shadow-ns.md | 14 ++++ pkg/eosclient/eosgrpc/eosgrpc.go | 89 +++++++---------------- pkg/storage/utils/eosfs/eosfs.go | 69 +++++++++--------- pkg/storage/utils/eosfs/upload.go | 3 +- pkg/utils/utils.go | 43 +++++++++++ 5 files changed, 120 insertions(+), 98 deletions(-) create mode 100644 changelog/unreleased/no-more-shadow-ns.md diff --git a/changelog/unreleased/no-more-shadow-ns.md b/changelog/unreleased/no-more-shadow-ns.md new file mode 100644 index 0000000000..53ecff506e --- /dev/null +++ b/changelog/unreleased/no-more-shadow-ns.md @@ -0,0 +1,14 @@ +Enhancement: drop shadow namespaces + +This comes as part of the effort to operate EOS without being root, see https://github.com/cs3org/reva/pull/4977 + +In this PR the post-home creation hook (and corresponding flag) is replaced by a create_home_hook, and the following configuration parameters are suppressed: + + shadow_namespace + share_folder + default_quota_bytes + default_secondary_quota_bytes + default_quota_files + uploads_namespace (unused) + +https://github.com/cs3org/reva/pull/4984 \ No newline at end of file diff --git a/pkg/eosclient/eosgrpc/eosgrpc.go b/pkg/eosclient/eosgrpc/eosgrpc.go index 296289f75b..c2ca7a8d78 100644 --- a/pkg/eosclient/eosgrpc/eosgrpc.go +++ b/pkg/eosclient/eosgrpc/eosgrpc.go @@ -34,7 +34,6 @@ import ( "time" erpc "github.com/cern-eos/go-eosgrpc" - userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1" "github.com/cs3org/reva/pkg/appctx" "github.com/cs3org/reva/pkg/eosclient" "github.com/cs3org/reva/pkg/errtypes" @@ -131,15 +130,6 @@ func (opt *Options) init() { } } -func getUser(ctx context.Context) (*userpb.User, error) { - u, ok := appctx.ContextGetUser(ctx) - if !ok { - err := errors.Wrap(errtypes.UserRequired(""), "eosfs: error getting user from ctx") - return nil, err - } - return u, nil -} - func serializeAttribute(a *eosclient.Attribute) string { return fmt.Sprintf("%s.%s=%s", attrTypeToString(a.Type), a.Key, a.Val) } @@ -247,17 +237,10 @@ func (c *Client) initNSRequest(ctx context.Context, auth eosclient.Authorization // cbox is a sudo'er, so we become the user specified in UID/GID, if it is set rq.Authkey = c.opt.Authkey - if auth.Role.UID != "" && auth.Role.GID != "" { - uidInt, err := strconv.ParseUint(auth.Role.UID, 10, 64) - if err != nil { - return nil, err - } - gidInt, err := strconv.ParseUint(auth.Role.GID, 10, 64) - if err != nil { - return nil, err - } - rq.Role.Uid = uidInt - rq.Role.Gid = gidInt + uid, gid, err := utils.ExtractUidGid(auth) + if err == nil { + rq.Role.Uid = uid + rq.Role.Gid = gid } } @@ -288,17 +271,10 @@ func (c *Client) initMDRequest(ctx context.Context, auth eosclient.Authorization // cbox is a sudo'er, so we become the user specified in UID/GID, if it is set rq.Authkey = c.opt.Authkey - if auth.Role.UID != "" && auth.Role.GID != "" { - uidInt, err := strconv.ParseUint(auth.Role.UID, 10, 64) - if err != nil { - return nil, err - } - gidInt, err := strconv.ParseUint(auth.Role.GID, 10, 64) - if err != nil { - return nil, err - } - rq.Role.Uid = uidInt - rq.Role.Gid = gidInt + uid, gid, err := utils.ExtractUidGid(auth) + if err == nil { + rq.Role.Uid = uid + rq.Role.Gid = gid } } @@ -738,12 +714,13 @@ func (c *Client) GetFileInfoByPath(ctx context.Context, userAuth eosclient.Autho log := appctx.GetLogger(ctx) log.Debug().Str("func", "GetFileInfoByPath").Str("uid,gid", userAuth.Role.UID+","+userAuth.Role.GID).Str("path", path).Msg("entering") - daemonAuth := utils.GetDaemonAuth() + // UserAuth may not be sufficient, because the user may not have access to the file + // e.g. in the case of a guest account. So we check if a uid/gid is set, and if not, + // revert to the daemon account + auth := utils.GetUserOrDaemonAuth(userAuth) // Initialize the common fields of the MDReq - // We do this as the daemon account, because the user may not have access to the file - // e.g. in the case of a guest account - mdrq, err := c.initMDRequest(ctx, daemonAuth) + mdrq, err := c.initMDRequest(ctx, auth) if err != nil { return nil, err } @@ -800,7 +777,7 @@ func (c *Client) GetFileInfoByPath(ctx context.Context, userAuth eosclient.Autho } log.Info().Str("func", "GetFileInfoByPath").Str("path", path).Uint64("info.Inode", info.Inode).Uint64("size", info.Size).Str("etag", info.ETag).Msg("result") - return c.fixupACLs(ctx, daemonAuth, info), nil + return c.fixupACLs(ctx, auth, info), nil } // GetFileInfoByFXID returns the FileInfo by the given file id in hexadecimal. @@ -986,13 +963,11 @@ func (c *Client) Chown(ctx context.Context, auth, chownAuth eosclient.Authorizat msg := new(erpc.NSRequest_ChownRequest) msg.Owner = new(erpc.RoleId) - msg.Owner.Uid, err = strconv.ParseUint(chownAuth.Role.UID, 10, 64) - if err != nil { - return err - } - msg.Owner.Gid, err = strconv.ParseUint(chownAuth.Role.GID, 10, 64) - if err != nil { - return err + + uid, gid, err := utils.ExtractUidGid(chownAuth) + if err == nil { + msg.Owner.Uid = uid + msg.Owner.Gid = gid } msg.Id = new(erpc.MDId) @@ -1225,9 +1200,8 @@ func (c *Client) Rename(ctx context.Context, auth eosclient.Authorization, oldPa } // List the contents of the directory given by path. -func (c *Client) List(ctx context.Context, userAuth eosclient.Authorization, dpath string) ([]*eosclient.FileInfo, error) { +func (c *Client) List(ctx context.Context, auth eosclient.Authorization, dpath string) ([]*eosclient.FileInfo, error) { log := appctx.GetLogger(ctx) - log.Info().Str("func", "List").Str("uid,gid", userAuth.Role.UID+","+userAuth.Role.GID).Str("dpath", dpath).Msg("") // Stuff filename, uid, gid into the FindRequest type fdrq := new(erpc.FindRequest) @@ -1238,23 +1212,12 @@ func (c *Client) List(ctx context.Context, userAuth eosclient.Authorization, dpa fdrq.Role = new(erpc.RoleId) - var auth eosclient.Authorization - if userAuth.Role.UID == "" || userAuth.Role.GID == "" { - auth = utils.GetDaemonAuth() - } else { - auth = userAuth - } - - uidInt, err := strconv.ParseUint(auth.Role.UID, 10, 64) + uid, gid, err := utils.ExtractUidGid(auth) if err != nil { - return nil, err - } - gidInt, err := strconv.ParseUint(auth.Role.GID, 10, 64) - if err != nil { - return nil, err + return nil, errors.Wrap(err, "Failed to extract uid/gid from auth") } - fdrq.Role.Uid = uidInt - fdrq.Role.Gid = gidInt + fdrq.Role.Uid = uid + fdrq.Role.Gid = gid fdrq.Authkey = c.opt.Authkey @@ -1386,7 +1349,7 @@ func (c *Client) Read(ctx context.Context, auth eosclient.Authorization, path st var localfile io.WriteCloser localfile = nil - u, err := getUser(ctx) + u, err := utils.GetUser(ctx) if err != nil { return nil, errors.Wrap(err, "eos: no user in ctx") } @@ -1422,7 +1385,7 @@ func (c *Client) Write(ctx context.Context, auth eosclient.Authorization, path s var length int64 length = -1 - u, err := getUser(ctx) + u, err := utils.GetUser(ctx) if err != nil { return errors.Wrap(err, "eos: no user in ctx") } diff --git a/pkg/storage/utils/eosfs/eosfs.go b/pkg/storage/utils/eosfs/eosfs.go index 0ad876fd2c..8267b671b7 100644 --- a/pkg/storage/utils/eosfs/eosfs.go +++ b/pkg/storage/utils/eosfs/eosfs.go @@ -258,15 +258,6 @@ func (fs *eosfs) Shutdown(ctx context.Context) error { return nil } -func getUser(ctx context.Context) (*userpb.User, error) { - u, ok := appctx.ContextGetUser(ctx) - if !ok { - err := errors.Wrap(errtypes.UserRequired(""), "eosfs: error getting user from ctx") - return nil, err - } - return u, nil -} - func (fs *eosfs) getLayout(ctx context.Context) (layout string) { if fs.conf.EnableHome { u := appctx.ContextMustGetUser(ctx) @@ -351,7 +342,7 @@ func (fs *eosfs) resolveRefAndGetAuth(ctx context.Context, ref *provider.Referen return "", eosclient.Authorization{}, errors.Wrap(err, "eosfs: error resolving reference") } - u, err := getUser(ctx) + u, err := utils.GetUser(ctx) if err != nil { return "", eosclient.Authorization{}, errors.Wrap(err, "eosfs: no user in ctx") } @@ -388,7 +379,10 @@ func (fs *eosfs) getPath(ctx context.Context, id *provider.ResourceId) (string, return "", fmt.Errorf("error converting string to int for eos fileid: %s", id.OpaqueId) } - auth := utils.GetDaemonAuth() + auth, err := fs.getDaemonAuth(ctx) + if err != nil { + return "", err + } eosFileInfo, err := fs.c.GetFileInfoByInode(ctx, auth, fid) if err != nil { @@ -404,19 +398,19 @@ func (fs *eosfs) GetPathByID(ctx context.Context, id *provider.ResourceId) (stri return "", errors.Wrap(err, "eosfs: error parsing fileid string") } - u, err := getUser(ctx) + u, err := utils.GetUser(ctx) if err != nil { return "", errors.Wrap(err, "eosfs: no user in ctx") } var auth eosclient.Authorization if utils.IsLightweightUser(u) { - auth = utils.GetDaemonAuth() + auth, err = fs.getDaemonAuth(ctx) } else { auth, err = fs.getUserAuth(ctx, u, "") - if err != nil { - return "", err - } + } + if err != nil { + return "", err } eosFileInfo, err := fs.c.GetFileInfoByInode(ctx, auth, fid) @@ -589,7 +583,7 @@ func (fs *eosfs) GetLock(ctx context.Context, ref *provider.Reference) (*provide if err != nil { return nil, errors.Wrap(err, "eosfs: error resolving reference") } - user, err := getUser(ctx) + user, err := utils.GetUser(ctx) if err != nil { return nil, errors.Wrap(err, "eosfs: no user in ctx") } @@ -652,7 +646,7 @@ func (fs *eosfs) SetLock(ctx context.Context, ref *provider.Reference, l *provid return errors.Wrap(err, "eosfs: error resolving reference") } - user, err := getUser(ctx) + user, err := utils.GetUser(ctx) if err != nil { return errors.Wrap(err, "eosfs: no user in ctx") } @@ -791,7 +785,7 @@ func (fs *eosfs) RefreshLock(ctx context.Context, ref *provider.Reference, newLo } } - user, err := getUser(ctx) + user, err := utils.GetUser(ctx) if err != nil { return errors.Wrap(err, "eosfs: error getting user") } @@ -857,7 +851,7 @@ func (fs *eosfs) Unlock(ctx context.Context, ref *provider.Reference, lock *prov return errtypes.BadRequest("caller does not hold the lock") } - user, err := getUser(ctx) + user, err := utils.GetUser(ctx) if err != nil { return errors.Wrap(err, "eosfs: error getting user") } @@ -1125,7 +1119,7 @@ func (fs *eosfs) GetMD(ctx context.Context, ref *provider.Reference, mdKeys []st // We use daemon for auth because we need access to the file in order to stat it // We cannot use the current user, because the file may be a shared file // and lightweight accounts don't have a uid - auth := utils.GetDaemonAuth() + auth, err := fs.getDaemonAuth(ctx) if ref.ResourceId != nil { fid, err := strconv.ParseUint(ref.ResourceId.OpaqueId, 10, 64) @@ -1168,14 +1162,15 @@ func (fs *eosfs) listWithNominalHome(ctx context.Context, p string) (finfos []*p log := appctx.GetLogger(ctx) fn := fs.wrap(ctx, p) - u, err := getUser(ctx) + u, err := utils.GetUser(ctx) if err != nil { return nil, errors.Wrap(err, "eosfs: no user in ctx") } - auth, err := fs.getUserAuth(ctx, u, fn) + userAuth, err := fs.getUserAuth(ctx, u, fn) if err != nil { return nil, err } + auth := utils.GetUserOrDaemonAuth(userAuth) eosFileInfos, err := fs.c.List(ctx, auth, fn) if err != nil { @@ -1208,7 +1203,7 @@ func (fs *eosfs) CreateStorageSpace(ctx context.Context, req *provider.CreateSto } func (fs *eosfs) GetQuota(ctx context.Context, ref *provider.Reference) (uint64, uint64, error) { - u, err := getUser(ctx) + u, err := utils.GetUser(ctx) if err != nil { return 0, 0, errors.Wrap(err, "eosfs: no user in ctx") } @@ -1241,7 +1236,7 @@ func (fs *eosfs) GetHome(ctx context.Context) (string, error) { func (fs *eosfs) createNominalHome(ctx context.Context) error { home := fs.wrap(ctx, "/") - u, err := getUser(ctx) + u, err := utils.GetUser(ctx) if err != nil { return errors.Wrap(err, "eosfs: no user in ctx") } @@ -1357,7 +1352,7 @@ func (fs *eosfs) CreateDir(ctx context.Context, ref *provider.Reference) error { if err != nil { return errors.Wrap(err, "eosfs: error resolving reference") } - u, err := getUser(ctx) + u, err := utils.GetUser(ctx) if err != nil { return errors.Wrap(err, "eosfs: no user in ctx") } @@ -1388,7 +1383,7 @@ func (fs *eosfs) TouchFile(ctx context.Context, ref *provider.Reference) error { } func (fs *eosfs) CreateReference(ctx context.Context, p string, targetURI *url.URL) error { - _, err := getUser(ctx) + _, err := utils.GetUser(ctx) if err != nil { return errors.Wrap(err, "eosfs: no user in ctx") } @@ -1431,7 +1426,7 @@ func (fs *eosfs) Delete(ctx context.Context, ref *provider.Reference) error { if err != nil { return errors.Wrap(err, "eosfs: error resolving reference") } - u, err := getUser(ctx) + u, err := utils.GetUser(ctx) if err != nil { return errors.Wrap(err, "eosfs: no user in ctx") } @@ -1446,7 +1441,7 @@ func (fs *eosfs) Delete(ctx context.Context, ref *provider.Reference) error { } func (fs *eosfs) Move(ctx context.Context, oldRef, newRef *provider.Reference) error { - u, err := getUser(ctx) + u, err := utils.GetUser(ctx) if err != nil { return errors.Wrap(err, "eosfs: no user in ctx") } @@ -1503,10 +1498,12 @@ func (fs *eosfs) ListRevisions(ctx context.Context, ref *provider.Reference) ([] return nil, errtypes.PermissionDenied("eosfs: user doesn't have permissions to list revisions") } } else { - fn, auth, err = fs.resolveRefForbidShareFolder(ctx, ref) + var userAuth eosclient.Authorization + fn, userAuth, err = fs.resolveRefAndGetAuth(ctx, ref) if err != nil { return nil, err } + auth = utils.GetUserOrDaemonAuth(userAuth) } eosRevisions, err := fs.c.ListVersions(ctx, auth, fn) @@ -1593,7 +1590,7 @@ func (fs *eosfs) PurgeRecycleItem(ctx context.Context, basePath, key, relativePa } func (fs *eosfs) EmptyRecycle(ctx context.Context) error { - u, err := getUser(ctx) + u, err := utils.GetUser(ctx) if err != nil { return errors.Wrap(err, "eosfs: no user in ctx") } @@ -1626,7 +1623,7 @@ func (fs *eosfs) ListRecycle(ctx context.Context, basePath, key, relativePath st } } else { // We just act on the logged-in user's recycle bin - u, err := getUser(ctx) + u, err := utils.GetUser(ctx) if err != nil { return nil, errors.Wrap(err, "eosfs: no user in ctx") } @@ -1696,7 +1693,7 @@ func (fs *eosfs) RestoreRecycleItem(ctx context.Context, basePath, key, relative } } else { // We just act on the logged-in user's recycle bin - u, err := getUser(ctx) + u, err := utils.GetUser(ctx) if err != nil { return errors.Wrap(err, "eosfs: no user in ctx") } @@ -2092,7 +2089,7 @@ func (fs *eosfs) getEOSToken(ctx context.Context, u *userpb.User, fn string) (eo return eosclient.Authorization{}, errtypes.BadRequest("eosfs: path cannot be empty") } - daemonAuth := utils.GetDaemonAuth() + daemonAuth, err := fs.getDaemonAuth(ctx) info, err := fs.c.GetFileInfoByPath(ctx, daemonAuth, fn) if err != nil { return eosclient.Authorization{}, err @@ -2148,6 +2145,10 @@ func (fs *eosfs) getRootAuth(ctx context.Context) (eosclient.Authorization, erro return eosclient.Authorization{Role: eosclient.Role{UID: "0", GID: "0"}}, nil } +// Returns an eosclient.Authorization object with the uid/gid of the daemon user +// This is a system user with read-only access to files. +// We use it e.g. when retrieving metadata from a file when accessing through a guest account, +// so we can look up which user to impersonate (i.e. the owner) func (fs *eosfs) getDaemonAuth(ctx context.Context) (eosclient.Authorization, error) { if fs.conf.ForceSingleUserMode { if fs.singleUserAuth.Role.UID != "" && fs.singleUserAuth.Role.GID != "" { diff --git a/pkg/storage/utils/eosfs/upload.go b/pkg/storage/utils/eosfs/upload.go index 5de666ae97..142ad779f4 100644 --- a/pkg/storage/utils/eosfs/upload.go +++ b/pkg/storage/utils/eosfs/upload.go @@ -27,6 +27,7 @@ import ( provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1" "github.com/cs3org/reva/pkg/errtypes" "github.com/cs3org/reva/pkg/storage/utils/chunking" + "github.com/cs3org/reva/pkg/utils" "github.com/pkg/errors" ) @@ -60,7 +61,7 @@ func (fs *eosfs) Upload(ctx context.Context, ref *provider.Reference, r io.ReadC fn := fs.wrap(ctx, p) - u, err := getUser(ctx) + u, err := utils.GetUser(ctx) if err != nil { return errors.Wrap(err, "eos: no user in ctx") } diff --git a/pkg/utils/utils.go b/pkg/utils/utils.go index 1ce62e4e06..d14551ba7b 100644 --- a/pkg/utils/utils.go +++ b/pkg/utils/utils.go @@ -19,6 +19,7 @@ package utils import ( + "context" "fmt" "net" "net/http" @@ -28,6 +29,7 @@ import ( "path/filepath" "reflect" "regexp" + "strconv" "strings" "time" @@ -37,9 +39,12 @@ import ( userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1" provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1" types "github.com/cs3org/go-cs3apis/cs3/types/v1beta1" + "github.com/cs3org/reva/pkg/appctx" "github.com/cs3org/reva/pkg/eosclient" + "github.com/cs3org/reva/pkg/errtypes" "github.com/cs3org/reva/pkg/registry" "github.com/cs3org/reva/pkg/registry/memory" + "github.com/pkg/errors" "go.step.sm/crypto/randutil" // gocritic is disabled because google.golang.org/protobuf/proto does not provide a method to convert MessageV1 to MessageV2. @@ -456,3 +461,41 @@ func GetDaemonAuth() eosclient.Authorization { func GetEmptyAuth() eosclient.Authorization { return eosclient.Authorization{} } + +// Returns the userAuth if this is a valid auth object, +// otherwise returns daemonAuth +func GetUserOrDaemonAuth(userAuth eosclient.Authorization) eosclient.Authorization { + if userAuth.Role.UID == "" || userAuth.Role.GID == "" { + return GetDaemonAuth() + } else { + return userAuth + } +} + +// Extract uid and gid from auth object +func ExtractUidGid(auth eosclient.Authorization) (uid, gid uint64, err error) { + // $ id nobody + // uid=65534(nobody) gid=65534(nobody) groups=65534(nobody) + nobody := uint64(65534) + + uid, err = strconv.ParseUint(auth.Role.UID, 10, 64) + if err != nil { + return nobody, nobody, err + } + gid, err = strconv.ParseUint(auth.Role.GID, 10, 64) + if err != nil { + return nobody, nobody, err + } + + return uid, gid, nil +} + +// Retrieve current user fromt he context +func GetUser(ctx context.Context) (*userpb.User, error) { + u, ok := appctx.ContextGetUser(ctx) + if !ok { + err := errors.Wrap(errtypes.UserRequired(""), "eosfs: error getting user from ctx") + return nil, err + } + return u, nil +}