Subject: Re: [netconf] NACM read access for actions

From: Kent Watsen <[email-masked]>
Date: Wed, 24 Feb 2021 23:51:23 +0000

Hi Christofer,

Looking at unread email, I noticed your message didn't receive any responses.

Could someone with familiarity with this NACM-question reply?

Thanks,
Kent

> On Dec 4, 2020, at 3:40 AM, Christofer Tornkvist (ctornkvi) <ctornkvi=[email-masked]> wrote:
> 
> Hi,
>  
> I read in the NACM RFC 8341 that for actions to not be rejected
> they both must have execute access and also read access
> for all its parent (instance) nodes along the node hierarchy
> up to the top node -described by the path for the action node.
>  
> The read access property, is that equivalent of having NACM rules
> stating read access for all parent (instance) nodes?
>  
> If that is the case, does not that open up the node tree
> structure unnecessarily much?
>  
>  
> I support the idea of just having to state one NACM rule
> containing read and execute access for the action node itself for it
> to be able to be run,
> and also that all the parent (instance) nodes
> will be readable only along the path up to the action node without
> any additional NACM rules.
> And if there is a read access deny rule on any parent (instance) node
> the action will be rejected.
>  
>  
> Would appreciate a clarification.
>  
> Below are references to RFC 8341.
>  
> Regards
> /Christofer Tornkvist
>  
>  
> References in RFC 8341 are:
> Ch. 3.1.3 s.3
>    The new "pre-read data node acc. ctl" boxes in the diagram below
>    refer to group read access as it relates to data node ancestors of an
>    action or notification.  As an example, if an action is defined as
>    /interfaces/interface/reset-interface, the group must be authorized
>    to (1) read /interfaces and /interfaces/interface and (2) execute on
>    /interfaces/interface/reset-interface.
>  
> Ch. 3.1.3 p.12 bullet 2
>    o  If the <action> operation defined in [RFC7950] is invoked, then
>       read access is required for all instances in the hierarchy of data
>       nodes that identifies the specific action in the datastore, and
>       execute access is required for the action node.  If the user is
>       not authorized to read all the specified data nodes and execute
>       the action, then the request is rejected with an "access-denied"
>       error.
>  
>  
> _______________________________________________
> netconf mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/netconf <https://www.ietf.org/mailman/listinfo/netconf>

---

From: Andy Bierman <[email-masked]>
Date: Wed, 24 Feb 2021 17:34:34 -0800

> Could someone with familiarity with this NACM-question reply?
I think the question is whether the read access required for exec access
exposes
too much data.

I think the original intent of the text is that read access to the
container or list
element is required, not the entire subtree.  It could be argued that read
access to the
key leafs within a list entry is also required.

Thanks,
> Kent
Andy

>
> On Dec 4, 2020, at 3:40 AM, Christofer Tornkvist (ctornkvi) <
> ctornkvi=[email-masked]> wrote:
>
> Hi,
>
> I read in the *NACM* RFC 8341 that for actions to not be rejected
> The read access property, is that equivalent of having *NACM* rules
> I support the idea of just having to state one *NACM* rule
> any additional *NACM* rules.
> /*Christofer* *Tornkvist*
>
>
>    The new "*pre*-read data node acc. ctl" boxes in the diagram below
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf
>
>
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf
>

---

From: Johan Vikman Lundström (jvikman) <[email-masked]>
Date: Fri, 26 Feb 2021 07:35:31 +0000

On Wed, Feb 24, 2021 at 3:52 PM Kent Watsen <[email-masked]<mailto:[email-masked]>> wrote:
Hi Christofer,

I think the question is whether the read access required for exec access exposes
too much data.

I think the original intent of the text is that read access to the container or list
element is required, not the entire subtree.  It could be argued that read access to the
key leafs within a list entry is also required.

JV: I agree with your interpretation of the question. Looking at the RFC and the default read being “permit” I think the paragraphs makes sense, reusing the /interfaces/interface/reset-interface example an admin could for instance add a deny on /interfaces for the group and thus stopping the operator from using the action.

When it gets interesting is when the the default read setting is “deny”, it’s not unreasonable to think that the admin wants to deny everything and only open up what is needed. But then adding an explicit rule permit read on /interfaces /interfaces/interface would open up a lot.

Interpreting your thought on original intent, it would be enough to have read access on /interfaces/interface[name=’if0’] OR /interfaces/interface, even if the default read permission was ‘deny’ (which would affect /interface), right?

/Johan

Thanks,
Kent

Andy

On Dec 4, 2020, at 3:40 AM, Christofer Tornkvist (ctornkvi) <ctornkvi=[email-masked]<mailto:ctornkvi=[email-masked]>> wrote:

Hi,

Regards
/Christofer Tornkvist

Ch. 3.1.3 p.12 bullet 2

_______________________________________________
netconf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/netconf

_______________________________________________
netconf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/netconf