rm/Do not apply system role access modifications (#515)

See nspcc-dev/neofs-node#2531.

eacl/validator.go

@@ -100,6 +100,11 @@ func matchFilters(hdrSrc TypedHeaderSource, filters []Filter) int {
 // suitable target OR suitable public key.
 func targetMatches(unit *ValidationUnit, record *Record) bool {
 	for _, target := range record.Targets() {
+		if target.Role() == RoleSystem {
+			// system role access modifications have been deprecated
+			continue
+		}
+
 		// check public key match
 		if pubs := target.BinaryKeys(); len(pubs) != 0 {
 			for _, key := range pubs {

eacl/validator_test.go

@@ -7,6 +7,12 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func checkIgnoredAction(t *testing.T, expected Action, v *Validator, vu *ValidationUnit) {
+	action, ok := v.CalculateAction(vu)
+	require.False(t, ok)
+	require.Equal(t, expected, action)
+}
+
 func checkAction(t *testing.T, expected Action, v *Validator, vu *ValidationUnit) {
 	action, ok := v.CalculateAction(vu)
 	require.True(t, ok)
@@ -191,6 +197,33 @@ func TestTargetMatches(t *testing.T) {
 	require.False(t, targetMatches(u, r))
 }
 
+func TestSystemRoleModificationIgnored(t *testing.T) {
+	tgt := *NewTarget()
+	tgt.SetRole(RoleSystem)
+
+	operations := []Operation{
+		OperationPut,
+		OperationGet,
+		OperationDelete,
+		OperationHead,
+		OperationRange,
+		OperationRangeHash,
+	}
+
+	tb := NewTable()
+	for _, operation := range operations {
+		tb.AddRecord(newRecord(ActionDeny, operation, tgt))
+	}
+
+	v := NewValidator()
+	vu := newValidationUnit(RoleSystem, nil, tb)
+
+	for _, operation := range operations {
+		vu.op = operation
+		checkIgnoredAction(t, ActionAllow, v, vu)
+	}
+}
+
 func makeKeys(t *testing.T, n int) [][]byte {
 	pubs := make([][]byte, n)
 	for i := range pubs {