From 4785555d34a6a481ed9247e25e560585216b73fe Mon Sep 17 00:00:00 2001 From: Harshavardhana Date: Sun, 23 Jul 2017 19:35:18 -0700 Subject: [PATCH] api: Upon bucket delete remove in-memory state properly. (#4716) This PR fixes the issue of cleaning up in-memory state properly. Without this PR we can lead to security situations where new bucket would inherit wrong permissions on bucket and expose objects erroneously. Fixes #4714 --- cmd/bucket-handlers.go | 9 +++++++++ cmd/event-notifier.go | 10 ++++------ 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/cmd/bucket-handlers.go b/cmd/bucket-handlers.go index ea64530bc..e6945331c 100644 --- a/cmd/bucket-handlers.go +++ b/cmd/bucket-handlers.go @@ -653,12 +653,21 @@ func (api objectAPIHandlers) DeleteBucketHandler(w http.ResponseWriter, r *http. // Delete bucket access policy, if present - ignore any errors. _ = removeBucketPolicy(bucket, objectAPI) + // Notify all peers (including self) to update in-memory state + S3PeersUpdateBucketPolicy(bucket, policyChange{true, nil}) + // Delete notification config, if present - ignore any errors. _ = removeNotificationConfig(bucket, objectAPI) + // Notify all peers (including self) to update in-memory state + S3PeersUpdateBucketNotification(bucket, nil) + // Delete listener config, if present - ignore any errors. _ = removeListenerConfig(bucket, objectAPI) + // Notify all peers (including self) to update in-memory state + S3PeersUpdateBucketListener(bucket, []listenerConfig{}) + // Write success response. writeSuccessNoContent(w) } diff --git a/cmd/event-notifier.go b/cmd/event-notifier.go index 54897d498..5ae28fa0d 100644 --- a/cmd/event-notifier.go +++ b/cmd/event-notifier.go @@ -503,9 +503,8 @@ func removeNotificationConfig(bucket string, objAPI ObjectLayer) error { // Acquire a write lock on notification config before modifying. objLock := globalNSMutex.NewNSLock(minioMetaBucket, ncPath) objLock.Lock() - err := objAPI.DeleteObject(minioMetaBucket, ncPath) - objLock.Unlock() - return err + defer objLock.Unlock() + return objAPI.DeleteObject(minioMetaBucket, ncPath) } // Remove listener configuration from storage layer. Used when a bucket is deleted. @@ -516,9 +515,8 @@ func removeListenerConfig(bucket string, objAPI ObjectLayer) error { // Acquire a write lock on notification config before modifying. objLock := globalNSMutex.NewNSLock(minioMetaBucket, lcPath) objLock.Lock() - err := objAPI.DeleteObject(minioMetaBucket, lcPath) - objLock.Unlock() - return err + defer objLock.Unlock() + return objAPI.DeleteObject(minioMetaBucket, lcPath) } // Loads both notification and listener config.