Subject: RE: [nfsv4] Automatic inheritance of permissions

From: Peter Varga <[email-masked]>
Date: Wed, 2 Aug 2006 13:05:41 -0400

Andreas is correct that automatic inheritance (client sets inheritable ACEs
on all children when its own ACL is modified to change inheritable ACEs) can
not be implemented by the client without the additional flags he referred to
(especially to distinguish inherited vs. direct ACEs). However, ACE ordering
also comes into play with automatic inheritance, and this touches on the
POSIX vs. Windows ACL debate.

Peter

> -----Original Message-----
> From: Yoder, Alan [mailto:[email-masked]] 
> Sent: Wednesday, August 02, 2006 12:50 PM
> To: Andreas Gruenbacher
> Cc: [email-masked]
> Subject: RE: [nfsv4] Automatic inheritance of permissions
> 
> 
> They're copied and pasted out of RFC 3530.
> 
> Alan 
> 
> > -----Original Message-----
> > From: Andreas Gruenbacher [mailto:[email-masked]] 
> > Sent: Wednesday, August 02, 2006 9:39 AM
> > To: Yoder, Alan
> > Cc: [email-masked]
> > Subject: Re: [nfsv4] Automatic inheritance of permissions
> > 
> > On Wednesday, 02 August 2006 18:27, Yoder, Alan wrote:
> > > What I am saying is that I can't figure out why you think 
> > it is missing.
> > > The only other things you mention in your original post 
> are included
> > > in this list:
> > >
> > >    const ACE4_FILE_INHERIT_ACE             = 0x00000001;
> > >    const ACE4_DIRECTORY_INHERIT_ACE        = 0x00000002;
> > >    const ACE4_NO_PROPAGATE_INHERIT_ACE     = 0x00000004;
> > >    const ACE4_INHERIT_ONLY_ACE             = 0x00000008;
> > >    const ACE4_SUCCESSFUL_ACCESS_ACE_FLAG   = 0x00000010;
> > >    const ACE4_FAILED_ACCESS_ACE_FLAG       = 0x00000020;
> > >    const ACE4_IDENTIFIER_GROUP             = 0x00000040;
> > 
> > Huh? 
> > http://www1.ietf.org/mail-archive/web/nfsv4/current/msg03135.h
> > tml doesn't 
> > mention these flags at all.
> > 
> > > What exactly are you proposing to add?
> > 
> > So the posting I pointed you at mentions the INHERITED_ACE 
> > ACE flag, and the 
> > SE_DACL_PROTECTED ACL flag. They are not included in the 
> > NFSv4 or NFSv4.1 
> > draft specifications, but they are necessary parts of 
> > Automatic Inheritance, 
> > which we currently can't express or implement. Just read the 
> > thread; it 
> > should be all there.
> > 
> > Andreas
> > 
> 
> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/nfsv4
> 

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Andreas Gruenbacher <[email-masked]>
Date: Wed, 2 Aug 2006 19:10:30 +0200

On Wednesday, 02 August 2006 19:05, Peter Varga wrote:
> on all children when its own ACL is modified to change inheritable ACEs)
> can not be implemented by the client without the additional flags he
> referred to (especially to distinguish inherited vs. direct ACEs). However,
> ACE ordering also comes into play with automatic inheritance, and this
> touches on the POSIX vs. Windows ACL debate.

Good point, indeed.

Andreas