Subject: Re: [nfsv4] server-side copy offload I-D

From: James Lentini <[email-masked]>
Date: Wed, 1 Apr 2009 09:46:14 -0400 (EDT)

Tom,

I see answers to your questions later in the thread except for:

> James Lentini wrote:
> > Tom,
> > 
> > Replies below:
> > 
> > On Tue, 31 Mar 2009, Tom Haynes wrote:
> > 
> > > What about this sequence?
> > > 
> > > clientC $ cp trojan /net/serverA/export/home/tdh/trojan
> > > clientC $ cp /net/serverA/export/home/tdh/trojan /net/serverB/export/home/tdh/trojan
> > > 
> > > I don't see enough detail in the proposal to prevent that from happening.
> > >     
> > 
> > What user is running cp? tdh?
> >    
> 
> 
> Sure....

With or without copy offload, user tdh will only be able to perform 
the operations above if tdh has write access to 
/net/serverA/export/home/tdh and /net/serverB/export/home/tdh.

If the COPY operation is used to perform the second command, then 
serverB will pull the data from serverA only after verifying that tdh 
has permission to perform this operation. tdh cannot use serverA as a 
backdoor into serverB, the protocol operates in the opposite 
direction.

-james