[hal0x9000]

Warning

The commit has no Signed-off-by: trailer because no sign-off was requested for this run. The DCO check will fail until a human signs off.

Closes #4298.

What was wrong

An eACL table attached to Container.PutRequest was stored without checking who signed it. The same table and signature sent later as a standalone SetExtendedACL was correctly rejected.

The cause is a regression from 1f53dc2. Since that commit the storage node always forwards the original API request, so in processCreateContainerRequest the call

cp.checkSetEACL(*req.EACLTable, table, id, cnr, req.OriginalRequest == nil)

always passed checkSig == false, and checkSetEACL returned before reaching its signature check. Nothing else covered the eACL signer: checkOriginalRequest authenticates the container signature (API < 2.29) or the whole request signature (API >= 2.29), never eacl_signature, and on the storage node Server.Put only checks that the signature is present.

What this changes

The checkSig bypass is removed, so both paths converge on one rule: the eACL must be signed by the container owner, or by a key authorized through an owner-issued session for SetEACL on that container — the same rule standalone SetExtendedACL already applies.

Behaviour change. Container creation with an attached eACL is now rejected when it is covered only by:

• a V1 session token without CONTAINER_SETEACL, or
• a V2 session token without SetEACL authority for the eACL signer.

This is a restoration, not a new restriction: before 1f53dc2 checkSetEACL required VerbContainerSetEACL with the Put token as well, and it matches the SDK's documented contract for WithEACL.

Verification

• The new negative cases in process_container_test.go fail on master and pass here: an eACL signed by a foreign key, a V2 session without SetEACL, and a V2 session whose eACL signer differs from the session subject. The positive cases pass on both, as they should.
• go build, golangci-lint (0 issues) and go test -race -shuffle=on ./... pass.

Open for reviewers

The test drives processCreateContainerRequest end to end with a zero FS chain client, so approval always fails and the test asserts on the logged outcome rather than a returned error. Extracting the eACL block into a separately testable function would allow direct assertions; that seemed larger than this fix warranted, but say if you would prefer it.

Implements proposal v1 (option A), with no deviation in approach.

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 33.15%. Comparing base (b9c6b05) to head (b0f4dc1).

Files with missing lines	Patch %	Lines
pkg/innerring/processors/container/process_eacl.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4304      +/-   ##
==========================================
+ Coverage   32.83%   33.15%   +0.32%     
==========================================
  Files         673      673              
  Lines       41706    41704       -2     
==========================================
+ Hits        13694    13829     +135     
+ Misses      28012    27875     -137     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.