[HDDS-2966] ACL checks should be done after acquiring lock

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Not A Problem
• Component/s: OM HA, Ozone Manager
• Target Version/s: 0.5.0
• Assignee: Unassigned
• Reporter: Hanisha Koneru
• Created: 31/Jan/20 18:12
• Updated: 04/Jun/20 20:16
• Resolved: 17/Apr/20 21:07

Description

Currently in OMClientRequests#validateAndUpdateCache, we perform ACL checks before acquiring the required object lock. This could lead to race condition. The ACL check should be done after acquiring the lock.
For example, in OMKeyCreateRequest:

      // check Acl
      checkKeyAcls(ozoneManager, volumeName, bucketName, keyName,
          IAccessAuthorizer.ACLType.CREATE, OzoneObj.ResourceType.KEY);

      acquireLock = omMetadataManager.getLock().acquireWriteLock(BUCKET_LOCK,
          volumeName, bucketName);