Subject: [nfsv4] nfsv4.1 acl: Remove operation and ACE4_ADD_SUBDIRECTORY

From: "Aneesh Kumar K.V" <[email-masked]>
Date: Thu, 15 Oct 2009 13:49:55 +0530

Hi,

I am looking for a clarification with respect to below section in nfsv4.1 RFC

6.2.1.3.2.  ACE4_DELETE vs. ACE4_DELETE_CHILD

The section states
"If the ACLs in question neither explicitly ALLOW nor DENY either of the above,
 and if MODE4_SVTX is not set on the parent, then the server SHOULD allow the
 removal if and only if ACE4_ADD_FILE is permitted. In the case where MODE4_SVTX
 is set, the server may also require the remover to own either the parent or the
 target, or may require the target to be writable."

I am wondering why we consider only ACE_ADD_FILE. Why not ACE4_ADD_SUBDIRECTORY also ?

-aneesh

---

From: "J. Bruce Fields" <[email-masked]>
Date: Thu, 15 Oct 2009 14:37:07 -0400

> I am wondering why we consider only ACE_ADD_FILE. Why not ACE4_ADD_SUBDIRECTORY also ?

I agree, it would probably make more sense to say "if and only if
ACE_ADD_FILE (or, for removal of directories, ACE_ADD_SUBDIRECTORY) is
permitted." (And change "ACE4_ADD_FILE" to "ACE4_ADD_FILE and
ACE4_ADD_SUBDIRECTORY" in the following paragraph.)

The use of "SHOULD" as opposed to "MUST" here is intentional, and I
think server implementers will need to use some judgement when fitting
these recommendations to their OS's security model.

--b.

---

From: Sam Falkner <[email-masked]>
Date: Thu, 15 Oct 2009 15:00:32 -0600

> ACE4_ADD_SUBDIRECTORY" in the following paragraph.)

I agree.  It was an oversight.

> these recommendations to their OS's security model.

I agree with this as well.

- Sam

---

From: Andreas Gruenbacher <[email-masked]>
Date: Fri, 16 Oct 2009 02:37:35 +0200

On Thursday, 15 October 2009 20:37:07 J. Bruce Fields wrote:
> > "If the ACLs in question neither explicitly ALLOW nor DENY either of the
> > above, and if MODE4_SVTX is not set on the parent, then the server SHOULD
> > allow the removal if and only if ACE4_ADD_FILE is permitted. In the case
> > where MODE4_SVTX is set, the server may also require the remover to own
> > either the parent or the target, or may require the target to be
> > writable."
> >

The code at http://www.suse.de/~agruen/nfs4acl/ doesn't implement the 
ACE_ADD_{FILE,SUBDIRECTORY} and IIRC there was a reason for that -- but I 
don't remember anymore. Greg, do you?

Thanks,
Andreas