Subject: RE: [nfsv4] ACL discussion wrapup

From: "Yoder, Alan" <[email-masked]>
Date: Sat, 11 Nov 2006 16:14:10 -0800

I have the same question as Saadia's first,
and further would like the spec to use
normative language to enforce this behavior
if this is deemed correct.  Otherwise, if
the server--a Windows server say--can place 
an acl at its discretion, then I think we 
need the "defaulted" bit. 

Alan

> -----Original Message-----
> From: Khan, Saadia 
> Sent: Saturday, November 11, 2006 12:59 PM
> To: 'J. Bruce Fields'; Andreas Gruenbacher
> Cc: Yoder, Alan; [email-masked]
> Subject: RE: [nfsv4] ACL discussion wrapup
> 
> Just to confirm, in case there is no acl on the dir and no 
> acl is being passed into the create/mkdir call, then the new 
> file/dir will only contain mode bits and not an acl, right?
> 
> The other thing I want to clarify is what happens if a dir 
> has an OWNER@ ace that is directory inherit and now a new dir 
> gets created, do we set an OWNER@ ace on the new dir (with 
> the inherit flags) as well as a user ace that maps to the 
> owner (without the inherit flags) or do we just set an OWNER@ 
> ace with the inherit flags on the new dir?
> 
> My apologies if this has been clarified in the new draft 
> and/or previous emails.
> 
> Thanks.
> Saadia 
> 
> -----Original Message-----
> From: J. Bruce Fields [mailto:[email-masked]] 
> Sent: Friday, November 10, 2006 2:59 PM
> To: Andreas Gruenbacher
> Cc: Yoder, Alan; [email-masked]
> Subject: Re: [nfsv4] ACL discussion wrapup
> 
> On Thu, Nov 09, 2006 at 02:10:03AM +0100, Andreas Gruenbacher wrote:
> > Hello,
> > 
> > On Thursday 09 November 2006 01:45, Yoder, Alan wrote:
> > > Hi,
> > >
> > >    Attached is the Word doc I put together in the process of 
> > > clarifying my thinking on the attributes proposed by 
> Bruce.  Per the 
> > > discussion today, it seems we should also add an optional 
> > > ACL4_DEFAULTED flag, to indicate that the ACL was ginned 
> up based on 
> > > a file creator's credentials, because the parent directory didn't 
> > > have an ACL at the time of creation.  It would indicate 
> to a client 
> > > doing auto inheritance that it is okay to blow away the defaulted 
> > > acl and replace it with an inherited one descending from above.
> > 
> > is there any more information available on this proposed flag? It's 
> > not clear to me that SE_DACL_DEFAULTED applies to file 
> system objects 
> > at all under Windows; it could also be an Active Directory 
> only thing 
> > from my reading of MS docs.
> 
> Just googling around....  From
> 
> http://technet2.microsoft.com/WindowsServer/en/library/9c7bc92
> 1-2517-4e7a-ba39-d37c8b8202e31033.mspx?mfr=true
> 
> it does look like DEFAULTED is set in the case above.  But 
> the real test would be for someone to actually experiment 
> with a Windows system.
> 
> In NFSv4 there are two possible sources that determine the 
> ACL on a new
> object: the ACL (and/or mode) attributes sent with the OPEN 
> or CREATE call, and the inheritable ACLs on the parent.
> 
> In Windows there appear to be three:
> 	- inheritable ACLs on the parent
> 	- ACLs included with the create (actually with the security
> 	  descriptor included in the create)
> 	- a default ACL associated with a given "access token"; I don't
> 	  understand what that is, but it's apparently some
> 	  representation of the user.
> 
> The DEFAULTED flag is set in the third case, and only when 
> the first two are absent.  Since we don't this 
> default-ACL-for-a-user notion in NFSv4, I don't believe we 
> can take advantage of the DEFAULTED flag.
> 
> --b.
> 
> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/nfsv4
> 

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: "J. Bruce Fields" <[email-masked]>
Date: Sat, 11 Nov 2006 20:46:56 -0500

> need the "defaulted" bit. 

So if we need the defaulted bit, then I think we could say something
like:

	In the case where the request that creates a new file or
	directory does not also set permissions for that file or
	directory, and there are also no ACEs inherited from the
	parent's directory, then the server's choice of ACL for the new
	object is implementation-dependent.  In this case, the server
	should set the DEFAULTED flag on the ACL it chooses for the new
	object.  An application performing automatic inheritance takes
	the DEFAULTED flag as a sign that the ACL should be completely
	replaced by any auto-inherited ACEs.

Setting the DEFAULTED flag on an ACL is then effectively equivalent to
setting the INHERITED bit on every ACE in the ACL.  So it doesn't look
terifically useful to me.

Can someone at least confirm that they've seen Windows actually set this
flag on filesystem objects?

--b.