This PR introduces a lower-privileged versions of AOP_Insert
and AOP_Create
which do not permit overwriting / destroying existing data during rename
and open
operations, respectively. Through the use of the O_EXCL
flag in the filesystem, xrootd now refuses to overwrite data if a session has the lower-privileged version instead of the full-fledged authorization.
With this, the UPLOAD
Macaroon authorization and storage.create
SciToken authorization are correctly implemented.
Note one other fixup had to be included: for HTTP MOVE operations, we now append the token correctly to the destination as well as the source.
Finally, because #1644 iterates through the list of operations, I decided to apply this branch on top of #1644; please do not merge this PR until #1644 is across the finish line.
Fixes #1655
https://github.com/xrootd/xrootd/pull/1697
(9 files)
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you are subscribed to this thread.
Use REPLY-ALL to reply to list
To unsubscribe from the XROOTD-DEV list, click the following link:
https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1