Subject: [nfsv4] Labeled NFS Telecon Wednesday May 26th at 5:00pm EST

From: "David P. Quigley" <[email-masked]>
Date: Mon, 24 May 2010 17:04:52 -0400

Date/Time: May 26th 5:00-6:00 PM EST

Telecon dial-in information:

U.S. toll free: 866-682-4770
Australia toll free: 1800420354
Conference code: 8530264 (new)
Security Passcode: 7042044

1. Dial the Global Access Number for your country 
2. Enter the Conference Code, followed by #
3. Enter the Security Passcode, followed by #

We haven't had a telecon in a while due to various schedule reasons so I
would like to start it up this week. The proposed agenda is below with
the necessary documents for the meeting attached.

Proposed Agenda
-----------------------

+ IETF Note Well Agreement

  This is a reminder that our discussions are governed by the 
  IETF Note Well Agreement. See:

    http://www.ietf.org/NOTEWELL.html

  We will start each week's meeting with this announcement.

+ Discuss RPCSEC gssv3 document (rpcsecgssv3-01.txt)

+ Label Format Specification document status update

+ Discuss possible uses of a Policy Authority field

+ Discuss possible submission topics for Linux Security Summit 2010

+ Discuss work needed for October Bake-A-Thon

---

From: "David P. Quigley" <[email-masked]>
Date: Thu, 27 May 2010 13:14:44 -0400

I've cleaned up the past meetings minutes and have posted them on my
selinuxproject.org webpage [0]. From now on I will be placing all
telecon minutes there hopefully within 48 hours of the meeting.

Dave

[0] http://www.selinuxproject.org/~dpquigl/telecon/

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 27 May 2010 15:55:33 -0500

> [0] http://www.selinuxproject.org/~dpquigl/telecon/

IMO posting the minutes to the WG list in addition to posting them at
selinuxproject.org would be good because then the IETF itself would have
them archived.

Anyways, from the minutes:

| Jarrett: I think we are running into a true interoperability problem.
|          Not all systems define the same namespaces for privileges. 

Indeed, but RPCSEC_GSSv3 doesn't need to be aware of all the complexity
of various privilege systems.  For example, there's no need for it to be
aware of the Solaris L, P, E and I sets, nor oP/oE, nor anything about
transitions.  Similarly for Linux capabilities.  Nor does RPCSEC_GSSv3
itself need to know about individual privileges -- that's an application
problem.

For NFSv4 we can probably (almost certainly, IMO) do a good job of
defining privileges that make sense for NFSv4 and which can be mapped
onto native privileges on the client and server.  If need be we could
define a privilege for every NFSv4 operation, and we could still map
them to/from Solaris privs and Linux capabilities.

Nico
--