Subject: RE: [nfsv4] ACL discussion wrapup

From: "Yoder, Alan" <[email-masked]>
Date: Sun, 12 Nov 2006 12:05:32 -0800

> Setting the DEFAULTED flag on an ACL is then effectively equivalent to
> setting the INHERITED bit on every ACE in the ACL. 

No it is not.  The INHERITED bit should only be set on ACEs
that are actually inherited when a client does an auto
inherit pass through the directory tree that includes
the file or directory in question.  E.g. an inherited
ACE might allow the group "wheel" full access.  No default
ACL is likely to contain an ACE like that.  

Alan 

> -----Original Message-----
> From: J. Bruce Fields [mailto:[email-masked]] 
> Sent: Saturday, November 11, 2006 5:47 PM
> To: Yoder, Alan
> Cc: Khan, Saadia; Andreas Gruenbacher; [email-masked]
> Subject: Re: [nfsv4] ACL discussion wrapup
> 
> On Sat, Nov 11, 2006 at 04:14:10PM -0800, Yoder, Alan wrote:
> > I have the same question as Saadia's first,
> > and further would like the spec to use
> > normative language to enforce this behavior
> > if this is deemed correct.  Otherwise, if
> > the server--a Windows server say--can place 
> > an acl at its discretion, then I think we 
> > need the "defaulted" bit. 
> 
> So if we need the defaulted bit, then I think we could say something
> like:
> 
> 	In the case where the request that creates a new file or
> 	directory does not also set permissions for that file or
> 	directory, and there are also no ACEs inherited from the
> 	parent's directory, then the server's choice of ACL for the new
> 	object is implementation-dependent.  In this case, the server
> 	should set the DEFAULTED flag on the ACL it chooses for the new
> 	object.  An application performing automatic inheritance takes
> 	the DEFAULTED flag as a sign that the ACL should be completely
> 	replaced by any auto-inherited ACEs.
> 
> Setting the DEFAULTED flag on an ACL is then effectively equivalent to
> setting the INHERITED bit on every ACE in the ACL.  So it doesn't look
> terifically useful to me.
> 
> Can someone at least confirm that they've seen Windows 
> actually set this
> flag on filesystem objects?
> 
> --b.
> 

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: "J. Bruce Fields" <[email-masked]>
Date: Sun, 12 Nov 2006 15:18:59 -0500

On Sun, Nov 12, 2006 at 12:05:32PM -0800, Yoder, Alan wrote:
> the file or directory in question.

Right.  But in terms of *effect*, the two situations are
identical--either way every ACE in the ACL is discarded when automatic
inheritance is performed.

--b.

---

From: "J. Bruce Fields" <[email-masked]>
Date: Sun, 12 Nov 2006 18:59:03 -0500

> inheritance is performed.

But I suppose that doesn't mean it couldn't be useful as some sort of
documentation of where the ACL came from?

I don't know.  Does the language I suggested sound OK?

--b.