Subject: [nfsv4] NFSv4 ACL semantics -- behavior for each RPC?

From: Robert Watson <[email-masked]>
Date: Sun, 16 Oct 2005 11:37:39 +0100 (BST)

I should perhaps introduce myself briefly before getting to the question: 
I'm a FreeBSD developer, and much of my recent work has been in the area 
of adding trusted operating system features to FreeBSD, and in our 
multi-processor network stack support.  As part of this work, I've spent 
time working on mandatory access control, audit, and access control lists.

One of the things that I did several years ago was add POSIX.1e ACL 
support to FreeBSD, and in the last few weeks, I've been reviewing the 
status of ACL support to try and decide on how well it's supporting our 
user community, and on future directions for it.  One obvious change in 
the last few years has been a change in ACL direction in the broader 
workstation community.  A few years ago, POSIX.1e-style ACLs were the 
obvious choice for adoption, as ACLs that are similar or identical are 
present in most UNIX operating systems.  Linux ACL support was developed 
along side FreeBSD support (and I think their man pages even come from our 
library), and seemed to confirm that direction.  However, in the last few 
years, NT (and offspring) deployment on desktops has increased 
dramatically, NFSv4 as adopted an NT-like ACL model, and Mac OS X has 
picked up an NT-like ACL model for compatibility with Windows systems.

I found the POSIX.1e ACL mapping draft a convincing argument for why not 
to try to map POSIX.1e ACLs into NFSv4 ACLs if avoidable, as it would 
appear to leave a very confused end-user, especially in the case where the 
user may see both client and server side versions of the ACLs via 
different interfaces, or where different client side views use different 
mappings (i.e., Samba and NFSv4).  It can be done, and should be done 
where it has to be, but it may or may not actually work well, assuming 
that NFSv4 becomes a significant market entity (and vendor involvement 
suggests this is not impossible).  The above changes in use and 
considerations of the poor mapping fomr POSIX.1e ACLs to the ACLs 
described in NFSv4 lead to evaluation of a new option: providing native 
support for NFSv4 ACLs in FreeBSD for local as well as the distributed 
file system.

I have recently spent some time putting together the beginnings of a 
sample implementation, but I immediately observed that while all the RPCs 
in NFSv4 are described with significant attention to semantic detail, not 
just syntax, ACLs are described only in terms of high level behavior and 
there is little actual specification tying together the RPCs and the ACLs 
that affect them.  It's not hard to guess at what is intended in most 
cases, but it's not really a specification as much as a declaration of 
intent when it comes to the specifics of the enforcement behavior. 
Description of some semantics, such as propagation to children nodes or 
evaluation of the ACL, on the other hand, seem clear.  It would appear, on 
face value, that the answer to any questions about ACL semantics would be 
"Look at NT".  I was wondering if any documentation currently exists that, 
for each RPC, identifies the proposed impact of specific defined ACL 
permissions for the involved objects -- i.e., says "When an unlink RPC is 
received, at minimum the following rights must appear in ACEs on the 
directory, file for the subject".  If such a document does not exist, I'm 
happy to spend some time throwing together a document with my expectations 
as to what they should be, and people are welcome to shoot it down.

Robert N M Watson

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Lisa Week <[email-masked]>
Date: Mon, 17 Oct 2005 09:47:51 -0600

Hi,

Sam Falkner and I have been working in this problem area and just
recently submitted a Internet Draft covering a lot of these types of issues.

The internet draft was submitted on October 14.  It hasn't been posted
yet, but look for draft-falkner-nfsv4-acl-00.txt in the near future.

We'd appreciate any feedback on the I-D that you may have.

Thanks,
Lisa