Subject: Re: [nfsv4] ACL discussion wrapup

From: "J. Bruce Fields" <[email-masked]>
Date: Thu, 16 Nov 2006 11:51:35 -0500

On Thu, Nov 16, 2006 at 08:35:15AM -0800, Khan, Saadia wrote:
> One more thing (not related to inheritance) that would be good to
> clarify. If a file does not contain an acl and the client queries the
> acl attribute, the server can return an acl constructed from the mode
> bits. Right? Even though that acl has not really been set on the file.

Yes.  The ACL and mode bit represent different views into a single
object, and querying one should also see the results of setting the
other.  We want the spec to make this requirement as clear as possible
without (for now) requiring a particular mapping between the two.  I'm
sure any suggestions for making this clearer would be welcomed....

> What if the client takes that acl and sets it on the file. And then
> queries the acl attribute. Again the same acl will be returned, only now
> this will be whats actually set on the file. Is there a way to
> distinguish these two acls from each other? In other words, is there a
> flag that would do that or there is no way for the client to figure out
> whether the acl being returned is constructed from the mode or not?

No.  Do you have a need for such a flag?

--b.

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: "Khan, Saadia" <[email-masked]>
Date: Thu, 16 Nov 2006 08:35:15 -0800

Bruce,

Thanks.
Saadia 

-----Original Message-----
From: J. Bruce Fields [mailto:[email-masked]] 
Sent: Monday, November 13, 2006 9:06 AM
To: Yoder, Alan
Cc: Khan, Saadia; [email-masked]; Andreas Gruenbacher
Subject: Re: [nfsv4] ACL discussion wrapup

On Sun, Nov 12, 2006 at 04:09:18PM -0800, Yoder, Alan wrote:
> Yeah, it's fine with me, with a couple twiddles:
> 
> 	In the case where the request that creates a new file or
> 	directory does not also set permissions for that file or
> 	directory, and there are also no ACEs inherited from the
> 	parent's directory, then the server's choice of ACL for the new
> 	object is implementation-dependent.  In this case, the server
> 	SHOULD set the DEFAULTED flag on the ACL it chooses for the new
> 	object.  An application performing automatic inheritance takes
> 	the DEFAULTED flag as a sign that the ACL should be completely
> 	replaced by one generated using the auto inheritance rules.
> 
> (changed should to SHOULD, changed last line).

OK.  I'll wait for any more feedback, then try to put out an updated
version of the proposed automatic inheritance language next week, with
the addition of this flag.

And thanks for the review.

The one last thing I really wish someone could do would be to run some
tests on a recent version of Windows to make sure it actually behaves as
documented.  I'm probably not going to have the chance any time soon.

--b.

---

From: [email-masked]
Date: Thu, 16 Nov 2006 12:04:36 -0500

>> From: Khan, Saadia [mailto:[email-masked]] 
>> Sent: Thursday, November 16, 2006 11:35
>> To: J. Bruce Fields; Yoder, Alan
>> Cc: [email-masked]; Andreas Gruenbacher
>> Subject: RE: [nfsv4] ACL discussion wrapup
>> 
>> Bruce,
>> 
Does it really matter. NFS v4.0 already states that if a server supports
 both ACL and mode-bits, then the mode-bits have to be in sync. With the
 three UNIX ACEs. Which for me means that if a client creates a file
 and does not set the ACL, and there is no inheritance, from the client
 standpoint there is still an implicit ACL. How the server built that
 ACL I believe should be transparent to the client