[HDDS-7461] NativeACL: Require CREATE right on volume instead of WRITE for CREATE_BUCKET operation

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Implemented
• Fix Version/s: 1.4.0
• Labels: pull-request-available
• Assignee: Hongbing Wang
• Reporter: Hongbing Wang
• Created: 06/Nov/22 09:40
• Updated: 20/Mar/23 11:58
• Resolved: 17/Feb/23 21:17

Description

The current Native ACL has the problem of permission enlargement.

When we grant `user1` WRITE permission to `/vol1/buk1`, the permissions we must grant to `user1` are:

• WRITE permission for `vol1`
• WRITE permission for `buk1`

This allows `user1` to create other buckets on `vol1` at will, which is not what we expected.

It's better to check user1's CREATE permission on vol1 when `user1` wants to create buckets. 

Issue Links

• relates to: HDDS-7697 Restrict change of bucket properties to owner and admins in NativeACL
• links to: GitHub Pull Request #3938