Subject: RE: subset of ACLs functionality

From: "Noveck, Dave" <[email-masked]>
Date: Fri, 19 Jul 2002 09:21:39 -0700

Spencer wrote: 
On Wed, Noveck, Dave wrote:
> > 
> > I don't see any statement in the spec that the same credentials have 
> > to be used on a READ or WRITE as were used on the OPEN.  I would expect
> > that in most cases that would be true but it's not guaranteed, and
> > therefore you had better check when the IO is done.  

> True and as you point out most clients will use the same credentials
> or they won't get what they expect.

> > Even if there were such a rule and the server checked tha the credentials
> > are the same, there is still the issue of responding to permission
> > changes.  Waiting unitl close and a new OPEN might not be desirable.

> >From a Unix perspective, check at OPEN is exactly what is desired,
> right?  We are all familiar with the old applications that like to
> open() then chmod such that the file can not be read/written and this
> works for v2/v3 when the credential matches the owner of the file but
> what you have suggested may potentially break then unless the v4
> server implements the same behavior as in v2/v3.

I think the server can make an exception for the owner.  It could also
make an exception on READ and WRITE for OPEN'er if it saved the principal
and verified that the principal was the same.

What the server can't do is check at OPEN time and not check the principal
at all (massive security hole), or reject out of hand any READ or WRITE 
where the principal did not match the OPENer.  That latter is just not 
NFS-v4(.0).  We might have gone that way when we designed the OPEN logic,
but I think people were too skittish about OPEN in general (so un-NFS-like),
to go that extra step.  It might be done in a 4.x.

---

From: Spencer Shepler <[email-masked]>
Date: Fri, 19 Jul 2002 13:34:44 -0500

> to go that extra step.  It might be done in a 4.x.

Agreed.

-- 
Spencer