Subject: [nfsv4] WG last call complete for Requirements for Labeled NFS (still needs review)

From: Spencer Shepler <[email-masked]>
Date: Mon, 30 Apr 2012 06:55:51 +0000

We have completed the last call for the Labeled NFS.

While this is a short document and certainly has had a lot of feedback over its lifetime, I do not believe this particular version is ready to forward to our AD.

I need to have at least two reviewers for this version before I will shepherd it forward.  Given this is a requirements document and it deals with security and it is providing a path for our NFSv4.2 work, I want it to be ready for the broader IESG review.

Thanks in advance for the help.

Spencer

---

From: Dave Quigley <[email-masked]>
Date: Mon, 30 Apr 2012 08:13:51 -0400

On 4/30/2012 2:55 AM, Spencer Shepler wrote:
> While this is a short document and certainly has had a lot of feedback
> over its lifetime, I do not believe this particular version is ready to
> forward to our AD.
>
> I need to have at least two reviewers for this version before I will
> shepherd it forward. Given this is a requirements document and it deals
> with security and it is providing a path for our NFSv4.2 work, I want it
> to be ready for the broader IESG review.
>
> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nfsv4

Does this have to be revewiers besides myself? I can be one of them and 
we've had a review from Casey Schaufler on the SELinux list that I had 
forgotten to forward over here. If you'd like We could be the two. If 
someone else besides me needs to do it I'll get Steve Smalley to chime 
in on the draft.

Dave

---

From: Jarrett Lu <[email-masked]>
Date: Mon, 30 Apr 2012 06:15:23 -0700

On Apr 30, 2012, at 5:13 AM, Dave Quigley <[email-masked]> wrote:

> Does this have to be revewiers besides myself? I can be one of them and we've had a review from Casey Schaufler on the SELinux list that I had forgotten to forward over here. If you'd like We could be the two. If someone else besides me needs to do it I'll get Steve Smalley to chime in on the draft.

I can be one of the reviewer too. 

- Jarrett

---

From: Spencer Shepler <[email-masked]>
Date: Mon, 30 Apr 2012 19:43:22 +0000

Thanks, Jarrett and Dave.  Please go ahead with the review and let me know when you are finished.

I would like to have one more volunteer that has been at least once removed from the material for a read of flow of the document and to see if there are any "missing"pieces.

Volunteers?

Spencer

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Jarrett Lu
Sent: Monday, April 30, 2012 6:15 AM
To: Dave Quigley
Cc: [email-masked]
Subject: Re: [nfsv4] WG last call complete for Requirements for Labeled NFS (still needs review)

On Apr 30, 2012, at 5:13 AM, Dave Quigley <[email-masked]> wrote:

>> While this is a short document and certainly has had a lot of 
>> feedback over its lifetime, I do not believe this particular version 
>> is ready to forward to our AD.
>> 
>> shepherd it forward. Given this is a requirements document and it 
>> deals with security and it is providing a path for our NFSv4.2 work, 
>> I want it to be ready for the broader IESG review.
>> 

- Jarrett

---

From: <[email-masked]>
Date: Mon, 30 Apr 2012 16:37:59 -0400

I will give it a review as well.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Spencer Shepler
Sent: Monday, April 30, 2012 3:43 PM
To: Jarrett Lu; Dave Quigley
Cc: [email-masked]
Subject: Re: [nfsv4] WG last call complete for Requirements for Labeled NFS (still needs review)

Volunteers?

Spencer

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Jarrett Lu
Sent: Monday, April 30, 2012 6:15 AM
To: Dave Quigley
Cc: [email-masked]
Subject: Re: [nfsv4] WG last call complete for Requirements for Labeled NFS (still needs review)

- Jarrett

---

From: Dave Quigley <[email-masked]>
Date: Tue, 01 May 2012 00:23:06 -0400

> Thanks in advance for the help.

I am forwarding some comments from Casey Schaufler on the document that 
he sent to the SELinux mailing list a while back. They can be found below.

Quote starts here:

Overall well done document.

Section 3.3 uses the term "context" differently than it is used in
sections 3.5.1 and 3.7.1.
It is not clear what comprises the "context" referenced in section 3.3.
The "security context" referenced in 3.5.1 and 3.7.1 may not translate
between client and server.
If the client is a strictly capability based Unix (e.g. Trusted Irix)
and the server SELinux the "security context" of the client may be
completely incomprehensible to the server.

Perhaps a change on the order of:

     "Both the server and the client have MAC functionality enabled, and
full LNFS functionality is extended over the network between both client
and server."

to

     "The server and the client have mutually recognized MAC
functionality enabled, and full LNFS functionality is extended over the
network between both client and server. "

---

From: Dave Quigley <[email-masked]>
Date: Tue, 01 May 2012 00:32:21 -0400

> Thanks in advance for the help.

Here are my comments come up with.

Section 1

This might be splitting hairs so I leave it up to others to decide but 
technically Windows Vista/Windows 7 does not provide mandatory access 
controls. They have a mandatory integrity model but not access controls. 
Their access control model is squarely in the DAC category.

Section 3.4 First paragraph

The sentence "The opaque component consists of the label which will be 
interpreted by the MAC model on the other end...." That last part just 
reads weirdly to me. I'm not sure how to change it or if it needs to but 
reading over it several times it just doesn't read well to me.

Section 3.5

In modes of operation we don't describe what we use to refer to a dumb 
mode. We have guest mode in here but I don't read anything in the 
section which says that the server may provide labeling without 
enforcing a policy and the client may still enforce policy on its end. 
Maybe its late and I'm missing something but I tried reading it over and 
couldn't find anything which would enable the use case in section 4.5 
which is simple security label storage.

Section 4.7 with subsections

It seems weird to have such a large section describing MLS semantics. It 
was important when it was one of two use cases but is it still 
necessary? I'm ok with leaving it in but it seems out of place that we 
have over a full page for that one use case while everything else gets 
two or three paragraphs.

That is all I could find. Everything else is very polished and reads 
well. I'm glad we were able to put together such a good document.