Subject: RE: [nfsv4] ACL discussion wrapup

From: "Yoder, Alan" <[email-masked]>
Date: Wed, 8 Nov 2006 23:12:27 -0800

In discussions today folks appeared to agree that

  * In many--or even most--NFSv4 cases parent directories  
    will not have ACLs set, so the need to gin up "defaulted"
    ACLS for new children is real.

  * Clients attempting to propagate inherited ACLs
    from directories above newly created objects with
    currently defaulted ACLs can use information about 
    whether a directory's ACL is a default one or not to 
    determine whether to override defaulted ACEs with 
    inherited ones.

Does this work for you?  

Alan  

> -----Original Message-----
> From: Andreas Gruenbacher [mailto:[email-masked]] 
> Sent: Wednesday, November 08, 2006 5:10 PM
> To: Yoder, Alan
> Cc: [email-masked]
> Subject: Re: [nfsv4] ACL discussion wrapup
> 
> Hello,
> 
> On Thursday 09 November 2006 01:45, Yoder, Alan wrote:
> > Hi,
> >
> >    Attached is the Word doc I put together in the process
> > of clarifying my thinking on the attributes proposed by
> > Bruce.  Per the discussion today, it seems we should also
> > add an optional ACL4_DEFAULTED flag, to indicate that the
> > ACL was ginned up based on a file creator's credentials,
> > because the parent directory didn't have an ACL at the
> > time of creation.  It would indicate to a client doing auto
> > inheritance that it is okay to blow away the defaulted acl
> > and replace it with an inherited one descending from above.
> 
> is there any more information available on this proposed 
> flag? It's not clear 
> to me that SE_DACL_DEFAULTED applies to file system objects 
> at all under 
> Windows; it could also be an Active Directory only thing from 
> my reading of 
> MS docs.
> 
> Do you have a particular use case in mind?
> 
> Thanks,
> Andreas
> 

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: "J. Bruce Fields" <[email-masked]>
Date: Fri, 10 Nov 2006 17:14:56 -0500

>     determine whether to override defaulted ACEs with 

I'm probably just having a bad day, but I don't understand the above.
Maybe an example would help?

--b.