Subject: RE: [nfsv4] ACCESS and the SYNCHRONIZE bit

From: Peter Varga <[email-masked]>
Date: Wed, 3 May 2006 10:44:28 -0400

No, our client does not evaluate ACLs.

ACCESS is really an optimization in order to prevent the client from having
to "attempt" operations. Does the RFC say that a client MUST send ACCESS ?
Is it not still ultimately the server's job to check access for a given user
on any given operation?

CIFS/SMB need only check permissions on their NT_Create_AndX_Request calls
since all operations are performed under a state handle. NFS needs to do it
everywhere since clients don't HAVE TO send ACCESS (aside from delegation).

As far as SYNCHRONIZE goes, it's meaningless over NFS. Look at 5.11.2 in the
NFSv4 RFC:
 SYNCHRONIZE            Permission to access file locally at the
                          server with synchronous reads and writes
So, NFS just needs to save this bit when reading/writing ACLs, it never
needs to evaluate the bit.

Peter

> -----Original Message-----
> From: J. Bruce Fields [mailto:[email-masked]] 
> Sent: Wednesday, May 03, 2006 9:47 AM
> To: Peter Varga
> Cc: 'Yoder, Alan'; Lisa Week; [email-masked]
> Subject: Re: [nfsv4] ACCESS and the SYNCHRONIZE bit
> 
> 
> On Fri, Apr 28, 2006 at 04:17:22PM -0400, Peter Varga wrote:
> > The full list of the bits in an the Access Mask field of an SMB
> > NT_Create_AndX_Request packet (which contains the 
> functionality of ACCESS in
> > NFS):
> > 
> > Generic Read
> > Generic Write
> > Generic Execute
> > Generic All
> > Maximum Allowed
> > System Security
> > Synchronize
> > Write Owner
> > Write DAC
> > Read Control
> > Delete
> > Write Attributes
> > Read Attributes
> > Delete Child
> > Execute
> > Write EA
> > Read EA
> > Append
> > Write
> > Read
> > 
> > 
> > I imagine this list may vary with the particular SMB dialog 
> /version, but
> > it's not as limited as the NFSv4 ACCESS4_* bits.
> 
> So how are you handling the bits (like synchronize) that you can't do
> access checks for?  Are you trying to evaluate the ACL on the client
> side?
> 
> --b.
> 

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: "J. Bruce Fields" <[email-masked]>
Date: Wed, 3 May 2006 10:42:04 -0400

> needs to evaluate the bit.

So no client *ever* needs to know whether the bit is permitted or not?
Why are we bothering with it at all?

--b.