Subject: Issue 202: POSIX_ACL_MASK special user

From: "William A.(Andy) Adamson" <[email-masked]>
Date: Fri, 19 Jul 2002 13:40:15 -0400

i think this is a small addition to the draft that makes a large contribution 
to interoperability. the ability to set the posix acl mask is essential for 
file systems that support posix acl's. the additon to this special user makes 
this possible. we have coded it, and it works. can it please be included in 
rfc 3010.

the issue should be reworded from:

  Issue202: 
It may be possible to map a POSIX draft ACL to and from the NFSv4 ACL with the 
addition of a POSIX_ACL_MASK@ special user.

to 
 Issue202:
It is possible to map a POSIX MASK ACL to and from the NFSv4 ACL with the 
addition of a POSIX_ACL_MASK@ special user.

-->Andy

---

From: Spencer Shepler <[email-masked]>
Date: Fri, 19 Jul 2002 13:07:22 -0500

> this possible. we have coded it, and it works. can it please be included in 

If so, then I would suggest that you team provide the suggested
changes to the specification with the motivation, etc.  It seems your
team understands the issues best at this point and that would be a
great starting point.

-- 
Spencer

---

From: [email-masked]
Date: Fri, 19 Jul 2002 11:38:52 -0700

What's the status of the POSIX ACL spec and the ACL_MASK entry?  The
last I heard (a couple years ago), the POSIX ACL effort had failed to
produce a final specification, due in part to lack of consensus about
whether to include ACL_MASK.

mike

---

From: Mike Eisler <[email-masked]>
Date: Fri, 19 Jul 2002 12:12:46 -0700

POSIX ACL standardization and acceptance by customers have both
been failures right?

Perhaps NFSv4 implementors on POSIX operation environments
should together and draft an API that uses pure v4
ACL semantics. It worked for Large Files years ago.
Have a Summit in Ann Arbor during the bakeoff.
Since v4 ACLs are derived from the Windows paradigm,
and since that paradigm has had some measure of
customer acceptance, this would benefit POSIX
platforms.

	-mre

---

From: marius aamodt eriksen <[email-masked]>
Date: Mon, 22 Jul 2002 11:57:34 -0400

> POSIX ACL standardization and acceptance by customers have both

the only place i have seen it used is by andreas gruebacker's ACL API
for Linux, which is close to becoming an official part of the linux
kernel (according to linus torvalds @ usenix this year), and hence
POSIX ACLs will have a ton of users.  these are reasons for our
decision on basing our ACL implementation upon this.  it has a clean
and to-become-standard API in the kernel, and we wanted to comply so
that users did not have to learn a different ACL functionality for
their NFSv4 mounts; they can use the same ACLs on their local
FS. 

> customer acceptance, this would benefit POSIX

of course this is an ideal situation, but is it worth the hellish
process of standardization?  but also think about the issues; do ACLs
lend themselves nicely to POSIX?  POSIX specifies that files have
owners and groups; but in more puristic ACL environments, there are no
such things, there are only ACEs.

marius.

-- 
> [email-masked] > http://www.citi.umich.edu/u/marius

---

From: Mike Eisler <[email-masked]>
Date: Thu, 25 Jul 2002 14:10:52 -0700

> their NFSv4 mounts; they can use the same ACLs on their local

I  looked at it, and it looks to me like the same old arcane POSIX
ACL interface to me. It's a nonstarter IMHO ... but if Andreas has customers
that tolerate it, they have my admiration.
The primary problem with POSIX ACLs is that there's no way to associate a
carefullly craft long list of access contriol entries (such a list is an 
ACL)
with a symbolic name. Whereas, with UNIX style groups, one can assign
a symbolic name to lists of user names. This is a lot easier to handle,
especially when this database is extended from a file /etc to
the directory (NIS/NIS+/LDAP).

I used to believe that ACLs would obviate the 16 group limit in
AUTH_SYS but now believe that won't happen.

There needs to be an "ACL map" in NIS/NIS+/LDAP before
ACLs succeed in the UNIX space. Windows ACLs might
be similarly hampered, I don't know, but at least Windows ACLs
have one thing going for them that UNIX doesn't ... a standard ACL
manipulation protocol for file access protocol (CIFS).
Maybe NFSv4 will solve a problem for
UNIX users, but as long as they can uses UNIX groups, I doubt they
will bother. UNIX/NFS users can overcome AUTH_SYS limits
via Kerberos V5 authentication (no groups on the wire, no problem).
No, I think NFSv4 ACLs will primarily server Windows desktops which
is still useful.

    -mre