Subject: [nfsv4] draft-ietf-nfsv4-acls-00 acl inheritance question

From: Andreas Gruenbacher <[email-masked]>
Date: Mon, 3 Jul 2006 02:41:10 +0200

Sam and Lisa,

section 5.2 of draft-ietf-nfsv4-acls-00 reads:

--------------------------- 8< ---------------------------
5.2.  How should a mode given in the arguments to CREATE or OPEN affect
      an inherited ACL?

   The goal of implementing ACL inheritance is for newly created objects
   to inherit the ACLs they were intended to inherit, but without
   disregarding the mode that is given with the arguments to the CREATE
   or OPEN operations.  The general algorithm is as follows:

   1.  Form an ACL on the newly created object that is the concatenation
       of all inheritable ACEs from its parent directory.  Note that
       there may be zero inheritable ACEs; thus, an object may start
       with an empty ACL.

       This is self explanatory.  If, for example, a new non-directory
       file is being created, ACEs with the flag of
       ACE4_FILE_INHERIT_ACE will be considered inheritable.

   2.  For each ACE in the new ACL, adjust its flags if necessary, and
       possibly create two ACEs in place of one.

       This will be discussed in detail below.

   3.  Apply the algorithm for applying a mode to a file/directory with
       an existing ACL on the new object as described in Section 5.3,
       using the mode that is to be used for file creation.

       This ensures that the mode is honored.

   Step 2 above is necessary to honor the intent of the inheritance-
   related flags.  It also is intended to preserve information about the
   original inheritable ACEs in the case that they will be modified by
   other steps.  Paragraph 2 is detailed in the following algorithm:

   1.  If the ACE4_NO_PROPAGATE_INHERIT_ACE is set, or the type of the
       file is something other than "directory", then clear the
       following flags:

          ACE4_NO_PROPAGATE_INHERIT_ACE

          ACE4_FILE_INHERIT_ACE

Falkner & Week           Expires August 19, 2006               [Page 11]
 
Internet-Draft             NFS Version 4 ACLs              February 2006

          ACE4_DIRECTORY_INHERIT_ACE

          ACE4_INHERIT_ONLY_ACE

       Continue on to the next ACE.

   2.  If the type of file is "directory" and ACE4_FILE_INHERIT_ACE is
       set and ACE4_DIRECTORY_INHERIT_ACE is NOT set, then we ensure
       that ACE4_INHERIT_ONLY_ACE is set.  Continue on to the next ACE.
       Otherwise:

   3.  If the type of the ACE is neither ALLOW nor DENY, then continue
       on to the next ACE.

   4.  Copy the original ACE into a second, adjacent ACE.

   5.  On the first ACE, ensure that ACE4_INHERIT_ONLY_ACE is set.

   6.  On the second ACE, clear the following flags:

          ACE4_NO_PROPAGATE_INHERIT_ACE

          ACE4_FILE_INHERIT_ACE

          ACE4_DIRECTORY_INHERIT_ACE

          ACE4_INHERIT_ONLY_ACE

   7.  On the second ACE, if the type field is ALLOW, an implementation
       MAY clear the following mask bits:

          ACE4_WRITE_ACL

          ACE4_WRITE_OWNER
--------------------------- 8< ---------------------------

I don't think this description is quite right: the algorithm described fails 
to clear the ACE4_INHERIT_ONLY_ACE flag for ACEs that are neither ALLOW nor 
DENY. This can be fixed by inserting step 0 at the top:

0. Clear the ACE4_INHERIT_ONLY_ACE flag.

Then, the flag can be removed from the descriptions of steps 1 and 6.

Next, as far as I can see, the only reason for steps 4 to 7 is that an 
implementation may choose to clear mask bits in step 7. So, can step 3 be 
changed to something like this?

3a. If the type of the ACE is ALLOW, an implementation may choose to clear the 
ACE4_WRITE_ACL and ACE4_WRITE_OWNER mask bits. Otherwise, continue to the 
next ACE.

Step 7 can then be adjusted as well.

Thanks,
Andreas

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4