Subject: [nfsv4] zapping an ACL

From: Rick Macklem <[email-masked]>
Date: Fri, 28 Nov 2008 16:23:26 -0500 (EST)

I've been working on adding ACL support to my Mac OS X client and I've 
just noticed that their VFS specifies deletion of an ACL for a file at
times. Now, looking at RFC3530, it's not obvious how this is done for
NFSv4.

The most obvious way is to do a Setattr Op with an ACL that has a zero
length ACE list.

Is this correct, or does a zero length ACE list mean something other than
"get rid of the ACL"?

Thanks in advance for any help, rick

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nfsv4

---

From: Benny Halevy <[email-masked]>
Date: Sun, 30 Nov 2008 08:35:27 +0200

> Is this correct, or does a zero length ACE list mean something other than

Rick, is there (or should the be) any noticeable difference
for the client between a deleted ACL and an empty one?
Assuming there isn't any, I see no issue with deleting the ACL
by sending a setattr for an empty ACL.

Benny

---

From: "Peter Varga" <[email-masked]>
Date: Sun, 30 Nov 2008 09:38:54 -0500

In Windows, an empty ACL means no one has access. No ACL means everyone
has access.

http://msdn.microsoft.com/en-us/library/aa446597(VS.85).aspx

"If a Windows object does not have a discretionary access control list
(DACL), the system allows everyone full access to it. If an object has a
DACL, the system allows only the access that is explicitly allowed by
the access control entries (ACEs) in the DACL. If there are no ACEs in
the DACL, the system does not allow access to anyone."

NFSv4.1 seems to confirm this semantic for NFS as well:
"For example, an empty ACL denies all permissions, but the server should
allow the owner's SETATTR to succeed even though WRITE_ACL is implicitly
denied."

It appears to me there is no way to delete an ACL in NFSv4 or 4.1 - but
since the ultimate goal is to establish some permissions on the object,
perhaps it's sufficient for the client to simply issue a SETATTR with
the desired mode bits in order to get the desired effect.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Benny Halevy
Sent: Sunday, November 30, 2008 1:35 AM
To: Rick Macklem
Cc: [email-masked]
Subject: Re: [nfsv4] zapping an ACL

Benny