Subject: Re: [nfsv4] NFSv4.2 work items

From: "Mike Eisler" <[email-masked]>
Date: Sun, 18 Oct 2009 08:42:58 -0700

This I-D has been posted,

http://www.ietf.org/internet-drafts/draft-eisler-nfsv4-minorversion-2-requirements-00.txt

Discussion welcome. I expect to update at least once this week.

On Thu, September 17, 2009 7:24 am, Spencer Shepler wrote:
>
>
> Given the interest in potential NFSv4.2 items, I have asked Mike Eisler
> to prepare a very brief I-D (3-5 pages) on requirements for NFSv4.2.
> In fact, it might be better phrased NFSv4.2 theme(s) or "keystone"
> items.
>
> What I am looking for is what is the key value(s) or solutions that
> NFSv4.2
> can provide.  This will be a personal I-D and certainly open for
> discussion.  The reason for the I-D is to capture the ideas such that we
> can use them as input for WG charter update.
>
> Spencer
>
> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nfsv4
>

-- 
Mike Eisler, Senior Technical Director, NetApp, 719 599 9026,
http://blogs.netapp.com/eislers_nfs_blog/

---

From: "Sorin Faibish" <[email-masked]>
Date: Sun, 18 Oct 2009 16:19:07 -0400

> http://www.ietf.org/internet-drafts/draft-eisler-nfsv4-minorversion-2-requirements-00.txt
A new I-D addressing the a 4.2 item from the above I-D: "pNFS  
connectivity/access indication."
was posted at:
http://www.ietf.org/id/draft-faibish-nfsv4-pnfs-access-permissions-check-00.txt

Discussion welcome.

/Sorin

-- 
Best Regards
Sorin Faibish
Corporate Distinguished Engineer
Network Storage Group

        EMC²
where information lives

Phone: 508-435-1000 x 48545
Cellphone: 617-510-0422
Email : [email-masked]

---

From: "David P. Quigley" <[email-masked]>
Date: Mon, 19 Oct 2009 11:09:11 -0400

I've never contributed to someone else's document before. How should I
go about commenting? Should I just make comments here or should I write
up some text as a suggestion and post it as a reply here?

Dave

---

From: Spencer Shepler <[email-masked]>
Date: Mon, 19 Oct 2009 10:11:17 -0500

> up some text as a suggestion and post it as a reply here?

Comments here is my preference on a document like this.

My intent behind asking Mike to prepare the document was
to act as the focal point of the discussion and to have a work
product we could then discuss with the ADs and IESG (if necessary).

Spencer

---

From: "Mike Eisler" <[email-masked]>
Date: Mon, 19 Oct 2009 09:29:14 -0700

This has been updated (all changes are wordsmith stuff).

http://www.ietf.org/internet-drafts/draft-eisler-nfsv4-minorversion-2-requirements-01.txt

---

From: "David P. Quigley" <[email-masked]>
Date: Wed, 21 Oct 2009 12:16:40 -0400

I have some comments for the text in the compliance section. There are
several points to get across in this section.

It is important to note that the purpose of Mandatory Access Controls
isn't just to determine who can view the data but also who and by what
means that data can be modified. For example let's say in your
enterprise data of an certain type is only supposed to be modified by
one special purpose application. With security labels and the
appropriate MAC model/protections you can enforce the security goal that
only that particular application has the ability to modify that data.

Second while it is important to note that ACLs are discretionary and
that is a major problem when trying to enforce certain security goals
its also important to note that they are only based on users. This means
that they can't confine malicious and/or flawed software from running
with the full privileges of the user executing the software. Security
labels on file and also the process label transport that will be
provided by rpcsecgssv3 allows for this type of confinement among other
things.

The end of the first paragraph specifically calls out that two object
labels must match for an access to be allowed. While you could have a
MAC model that implements this security goal, in general this usually
isn't the case. MLS uses an ordered dominance relationship to determine
what subjects can have access to what objects. The text implies that the
equality constraint here is a requirement. I think it would be better to
put "When the labels of two objects are authorized by the security
policy" or something along those lines instead. This removes the strict
equality requirement and allows for flexibility by saying that it is up
to the particular MAC model being implemented to determine the
relationship of those labels and whether access should be allowed or
denied. With that change it would be appropriate to use maybe Secret and
Top Secret in the example instead and make a note that MLS uses a
dominance relationship.

The last point that I think should be made is that currently the choice
exists of whether I should have strong security protections in the form
of MAC in the enterprise or should I use NFS. This is a problem because
I believe both of these technologies are very important to increasing
the security of enterprise environments. I think a brief mention that
having the ability to label file objects on the NFS server and have the
server apply an access policy to them while also enabling the client to
apply access policy on top of that (or vice versa) enables end to end
protections which are very important. Think of the scenario where you
have 2 clients accessing that special data I mentioned earlier. Unless
the server can say in addition to the client that only the special
purpose application can modify that data it is possible for the other
client that may not have that security policy to modify that data
without knowledge of the first client.

---

From: sfaibish <[email-masked]>
Date: Thu, 22 Oct 2009 11:57:09 -0400

> http://www.ietf.org/id/draft-faibish-nfsv4-pnfs-access-permissions-check-00.txt
I posted a second version of the draft with additions and comments from
Jason Glasgow.
http://www.ietf.org/internet-drafts/draft-faibish-nfsv4-pnfs-access-permissions-check-01.txt

This will be probably the last modification before the IETF meeting.
I propose the discussion on this draft as an agenda item for the
IETF 76 meeting. Thank you

/Sorin

-- 
Best Regards

Sorin Faibish

         EMC²
where information lives

---

From: "Mike Eisler" <[email-masked]>
Date: Mon, 26 Oct 2009 16:17:03 -0700

David,

Thanks for your comments.

I hope in
 http://www.ietf.org/internet-drafts/draft-eisler-nfsv4-minorversion-2-requirements-02.txt

these have been addressed.

I have also added links to I-Ds that have been posted that propose to
address the requirements listed in
draft-eisler-nfsv4-minorversion-2-requirements .