This PR introduces a lower-privileged versions of AOP_Insert and AOP_Create which do not permit overwriting / destroying existing data during rename and open operations, respectively. Through the use of the O_EXCL flag in the filesystem, xrootd now refuses to overwrite data if a session has the lower-privileged version instead of the full-fledged authorization.

With this, the UPLOAD Macaroon authorization and storage.create SciToken authorization are correctly implemented.

Note one other fixup had to be included: for HTTP MOVE operations, we now append the token correctly to the destination as well as the source.

Finally, because #1644 iterates through the list of operations, I decided to apply this branch on top of #1644; please do not merge this PR until #1644 is across the finish line.

Fixes #1655

You can view, comment on, or merge this pull request online at:

https://github.com/xrootd/xrootd/pull/1697

Commit Summary

43ecaea Populate XrdSciTokens with more detailed log messages.
9848531 Bump logging level of exceptions to warning.
ca700a5 Rework configuration to utilize new XrdOucGatherInfo class.
3f39b7e Ensure MOVE destination has any necessary CGI entries.
a626874 Ignore request.name if it is empty.
b7c0e45 Introduce 'exclusive' operations.
f28d563 [XrdSciTokens] Differentiate between WLCG tokens and SciTokens.

File Changes

(9 files)

M src/XrdAcc/XrdAccAccess.cc (4)
M src/XrdAcc/XrdAccAuthorize.hh (30)
M src/XrdApps/XrdAccTest.cc (3)
M src/XrdHttp/XrdHttpReq.cc (7)
M src/XrdMacaroons/XrdMacaroonsAuthz.cc (10)
M src/XrdOfs/XrdOfs.cc (55)
M src/XrdSciTokens/XrdSciTokensAccess.cc (250)
M src/XrdThrottle/XrdThrottleFile.cc (3)
M src/XrdXrootd/XrdXrootdXeq.cc (2)

Patch Links:

—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you are subscribed to this thread.

[ { "@context": "http://schema.org", "@type": "EmailMessage", "potentialAction": { "@type": "ViewAction", "target": "https://github.com/xrootd/xrootd/pull/1697", "url": "https://github.com/xrootd/xrootd/pull/1697", "name": "View Pull Request" }, "description": "View this Pull Request on GitHub", "publisher": { "@type": "Organization", "name": "GitHub", "url": "https://github.com" } } ]

Use REPLY-ALL to reply to list

To unsubscribe from the XROOTD-DEV list, click the following link:
https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1