api: Enable container ACL

Signed-off-by: Evgenii Baidakov <[email protected]>
nspcc-dev · Nov 1, 2024 · 729dee0 · 729dee0
1 parent 73e4f54
commit 729dee0
Show file tree

Hide file tree

Showing 3 changed files with 47 additions and 0 deletions.
diff --git a/api/handler/acl.go b/api/handler/acl.go
@@ -991,6 +991,11 @@ func formRecords(resource *astResource) ([]*eacl.Record, error) {
 		return res, nil
 	}
 
+	if resource.Version == aclEnabledObjectWriter && resource.Object == aclEnabledObjectWriter {
+		res = append(res, bucketACLObjectWriterRecord())
+		return res, nil
+	}
+
 	for i := len(resource.Operations) - 1; i >= 0; i-- {
 		astOp := resource.Operations[i]
 		record := eacl.NewRecord()
@@ -1113,6 +1118,20 @@ func policyToAst(bktPolicy *bucketPolicy) (*ast, error) {
 			return nil, fmt.Errorf("unsupported ownership: %v", state.Principal)
 		}
 
+		if state.Sid == "BucketEnableACL" &&
+			state.Action.Equal(stringOrSlice{values: []string{"s3:PutObject"}}) &&
+			state.Effect == "Allow" &&
+			state.Resource.Equal(stringOrSlice{values: []string{"*"}}) {
+			rr[aclEnabledObjectWriter] = &astResource{
+				resourceInfo: resourceInfo{
+					Version: aclEnabledObjectWriter,
+					Object:  aclEnabledObjectWriter,
+				},
+			}
+
+			continue
+		}
+
 		if state.Principal.AWS != "" && state.Principal.AWS != allUsersWildcard ||
 			state.Principal.AWS == "" && state.Principal.CanonicalUser == "" {
 			return nil, fmt.Errorf("unsupported principal: %v", state.Principal)
@@ -1718,6 +1737,18 @@ func bucketOwnerPreferredRecord() *eacl.Record {
 	return markerRecord
 }
 
+func bucketACLObjectWriterRecord() *eacl.Record {
+	var markerRecord = eacl.CreateRecord(eacl.ActionAllow, eacl.OperationPut)
+	markerRecord.AddFilter(
+		eacl.HeaderFromRequest,
+		eacl.MatchStringEqual,
+		amzBucketOwnerField,
+		aclEnabledObjectWriter,
+	)
+
+	return markerRecord
+}
+
 func checkACLRestrictions(table *eacl.Table) error {
 	if table == nil {
 		return nil

diff --git a/api/handler/put.go b/api/handler/put.go
@@ -172,6 +172,8 @@ const (
 
 	amzBucketOwnerField    = "BucketOwnerEnforcedField"
 	amzBucketOwnerEnforced = "BucketOwnerEnforced"
+
+	aclEnabledObjectWriter = "ObjectWriter"
 )
 
 type createBucketParams struct {

diff --git a/docs/aws_s3_compat.md b/docs/aws_s3_compat.md
@@ -329,6 +329,20 @@ If case you need to enable ACLs with `Bucket owner preferred` option you should
     ]
 }
 ```
+If case you need to enable ACLs (not recommended) option you should use `PutBucketPolicy` command with the next policy:
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "BucketEnableACL",
+            "Action": "s3:PutObject",
+            "Effect": "Allow",
+            "Resource": "*"
+        }
+    ]
+}
+```
 
 ## Request payment