astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-08-09 07:43:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(iam): enforce the bucket/object resource boundary

Browse Source 
Upgrade directly to silo-pkg v3.11.0, the fork's first non-colliding release, and carry the completed minio/minio#20449 hardening without exposing the retired v3.7.0, v3.8.0, or v3.8.1 tags in the rewritten history.

Twelve sensitive bucket-level writes now require the bare bucket resource in addition to the historical bucket/ form, so an object-only bucket/* grant cannot delete a bucket or change protections. Read/list behavior, ordinary tenant self-service, Deny statements, and NotResource exclusions retain their compatible behavior; MINIO_API_LEGACY_BUCKET_RESOURCE_MATCH restores the old matcher when migration requires it.

End-to-end tests cover direct clients, session policies, service accounts, wildcard edge cases, compatible resource pairs, and real bucket deletion.

Co-authored-by: ChatGPT <noreply@openai.com>
Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Feng Ruohang
2026-08-04 13:22:20 +08:00
parent 22c1e41fd2
commit 97b7d28040
3 changed files with 412 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+13 -12
View File
@@ -9,10 +9,11 @@ replace github.com/minio/console => github.com/pgsty/silo-console v0.0.0-2026080
// Use Pigsty's maintained mc fork for Console's embedded client code.
replace github.com/minio/mc => github.com/pgsty/mc v0.0.0-20260801042411-ad10a2a10b76
// Fix LDAP TLS regression: DialURL() was not passing TLS config for ldaps:// connections,
// causing InsecureSkipVerify, RootCAs, and other TLS settings to be silently ignored.
// See: https://github.com/pgsty/minio/issues/15
replace github.com/minio/pkg/v3 => github.com/pgsty/minio-pkg/v3 v3.6.3
// Use Pigsty's maintained SILO package fork while preserving upstream import paths.
// This retains the LDAP TLS fix tracked in https://github.com/pgsty/minio/issues/15.
// v3.11.0 follows upstream minio/pkg's 3.11 line and carries the
// minio/minio#20449 bucket-write boundary hardening.
replace github.com/minio/pkg/v3 => github.com/pgsty/silo-pkg/v3 v3.11.0
// v22.7.0 does not compile on NetBSD because its unix implementation uses
// CLOCK_MONOTONIC, which is unavailable there. Keep the last portable release
@@ -47,7 +48,7 @@ require (
github.com/fatih/color v1.19.0
github.com/felixge/fgprof v0.9.5
github.com/fraugster/parquet-go v0.12.0
github.com/go-ldap/ldap/v3 v3.4.12
github.com/go-ldap/ldap/v3 v3.4.14
github.com/go-openapi/loads v0.23.3
github.com/go-sql-driver/mysql v1.9.3
github.com/gobwas/ws v1.4.0
@@ -103,7 +104,7 @@ require (
github.com/rs/cors v1.11.1
github.com/secure-io/sio-go v0.3.1
github.com/shirou/gopsutil/v3 v3.24.5
github.com/tinylib/msgp v1.6.3
github.com/tinylib/msgp v1.6.4
github.com/valyala/bytebufferpool v1.0.0
github.com/xdg/scram v1.0.5
github.com/zeebo/xxh3 v1.1.0
@@ -111,7 +112,7 @@ require (
go.etcd.io/etcd/client/v3 v3.6.9
go.uber.org/atomic v1.11.0
go.uber.org/zap v1.28.0
go.yaml.in/yaml/v3 v3.0.4
go.yaml.in/yaml/v3 v3.0.5
goftp.io/server/v2 v2.0.2
golang.org/x/crypto v0.54.0
golang.org/x/oauth2 v0.36.0
@@ -169,7 +170,7 @@ require (
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
github.com/fatih/structs v1.1.0 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
github.com/go-asn1-ber/asn1-ber v1.5.8 // indirect
github.com/go-ini/ini v1.67.0 // indirect
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
github.com/go-logr/logr v1.4.3 // indirect
@@ -184,7 +185,7 @@ require (
github.com/go-openapi/strfmt v0.26.2 // indirect
github.com/go-openapi/swag v0.25.5 // indirect
github.com/go-openapi/swag/cmdutils v0.25.5 // indirect
github.com/go-openapi/swag/conv v0.25.5 // indirect
github.com/go-openapi/swag/conv v0.28.0 // indirect
github.com/go-openapi/swag/fileutils v0.25.5 // indirect
github.com/go-openapi/swag/jsonname v0.26.0 // indirect
github.com/go-openapi/swag/jsonutils v0.25.5 // indirect
@@ -192,7 +193,7 @@ require (
github.com/go-openapi/swag/mangling v0.25.5 // indirect
github.com/go-openapi/swag/netutils v0.25.5 // indirect
github.com/go-openapi/swag/stringutils v0.25.5 // indirect
github.com/go-openapi/swag/typeutils v0.25.5 // indirect
github.com/go-openapi/swag/typeutils v0.28.0 // indirect
github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
github.com/go-openapi/validate v0.25.2 // indirect
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
@@ -238,9 +239,9 @@ require (
github.com/lestrrat-go/option/v2 v2.0.0 // indirect
github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88 // indirect
github.com/mattn/go-colorable v0.1.14 // indirect
github.com/mattn/go-colorable v0.1.15 // indirect
github.com/mattn/go-ieproxy v0.0.12 // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
github.com/mattn/go-isatty v0.0.24 // indirect
github.com/mattn/go-localereader v0.0.1 // indirect
github.com/mattn/go-runewidth v0.0.21 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect