Subject: [nfsv4] RE: Windows/NFSv4 ACL interoperability

From: [email-masked]
Date: Tue, 14 Mar 2006 06:36:10 -0500

I totally agree with Tridge, it is the client which is doing the propagation
down the tree not the server.
Windows server is doing it only for file/directory creation.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: mardi 14 mars 2006 12:32
To: Christoph Klein
Cc: J. Bruce Fields; Gardere, Daniel; [email-masked];
[email-masked]; Roche, Francois
Subject: Re: Windows/NFSv4 ACL interoperability

Christoph,

 > I think you are missing one distinctive difference in the semantics of
 > nfsv4 and windows acl: inheritance! afaik nfsv4 uses static inheritance
 > (acls are inherited only at file creationt time) and windows uses a
 > semi-dynamic model (acls are inherited at the time they are set).
 > Applications that rely on one behaviour may do strange things!

I am a little skeptical about this. I know that Microsoft docs talk
about this type of dynamic inheritance, but when I went to implement
it in Samba4 I failed to reproduce it in windows->windows testing
(using win2003). What I saw instead was that the windows client would
walk the file tree under the directory and update the ACLs manually
guided by the various inheritance flags.

Try as I might to make windows do true dynamic inheritance, where an
update to a directory acl is immediately visible elements within the
directory without a tree walk I didn't see it.

Some people have said they just don't believe me, but I would
appreciate it if someone who has seen real dynamic inheritance in
action could send me a sniff demonstrating it.

Also note that (from the users point of view) Samba4 does implement
dynamic inheritance, its just that what happens is the client
transparently walks the tree and updates it for us, so I have a
working implementation to backup the above :-)

Cheers, Tridge

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Michael B Allen <[email-masked]>
Date: Tue, 14 Mar 2006 11:37:56 -0500

> Windows server is doing it only for file/directory creation.

Because security descriptors are not NDR encoded in various RPCs
I strongly suspect that they are not interpreted at all when simply
getting or setting them. They are just binary blobs. You get out
what you put in.

Mike

---

From: [email-masked]
Date: Thu, 16 Mar 2006 17:22:58 +1100

Michael,

 > getting or setting them. They are just binary blobs. You get out

no, they are interpreted. The mapping of the generic bits to the
object specific bits happens on store as you can tell if you store
with generic bits and then fetch it back. See for example the RAW-ACLS
test in the Samba4 smbtorture, which sets an ACE on a file with
SEC_GENERIC_READ | SEC_STD_ALL and checks that when you read it back
it is given as SEC_RIGHTS_FILE_READ | SEC_STD_ALL.

Also, the "not NDR encoded" is perhaps a bit misleading. Windows has
functions that map an ACL between "self relative" format and unpacked
structure format. The "self relative" format is a linearisation that
is based loosely on NDR. In Samba4 we use our IDL/NDR framework to do
this linearisation, with a small tweak to NDR to allow for the self
relative method of handling pointers. I suspect in windows this is
hand-coded, but it is so close to NDR that it doesn't really matter.

Cheers, Tridge