Subject: [nfsv4] NFSv4.1 SACL attribute and AUDIT ACE: what's required?

From: Mike Kupfer <[email-masked]>
Date: Fri, 16 Jun 2017 11:00:54 -0700

I'm trying to make sense of the final paragraph in Section 6.2.1.2 of
RFC 5661, which reads

    Support for any of the ACL attributes is optional (albeit
    RECOMMENDED).  However, a server that supports either of the new
    ACL attributes (dacl or sacl) MUST allow use of the new ACL
    attributes to access all of the ACE types that it supports.  In
    other words, if such a server supports ALLOW or DENY ACEs, then it
    MUST support the dacl attribute, and if it supports AUDIT or ALARM
    ACEs, then it MUST support the sacl attribute.

IIUC, this is forbidding a situation where (for example) the server
lists support for the dacl attribute and AUDIT ACEs but not support
for the sacl attribute.

If the server lists support for neither the dacl or sacl attributes,
it can still support AUDIT ACEs via the acl attribute.

Am I reading that correctly?

thanks,
mike

---

From: David Noveck <[email-masked]>
Date: Fri, 16 Jun 2017 14:39:45 -0400

> RFC 5661,

Good luck with that.

> which reads

>     RECOMMENDED).

It is hard to figure out since, in one paragraph, these attributes are
optional, RECOMMENDED and (sometimes) REQUIRED.

   - are (lower-case) "optional" at the start of the first sentence
   - are then "RECOMMENDED" at the end of the sentence, although this term
   is not in line with RFC2119.  (this sort of disparity recognized RFC7530,
   but still in RFC5661)
   - By the end of the paragraph. "MUST" is being used.

> However, a server that supports either of the new
>   attributes to access all of the ACE types that it supports.

As the sentence is written, both of these attributes are OPTIONAL, but,
when you support one of them, the supported ACEs for those attributes
must include all the ACEs you support.  Essentially, this says that if you
support
sacl and dacl, they must be the same.  I don't think that's the intention,
though.
I think this sentence is just a mistake.

Perhaps the intention was to say that these attributes, when
implemented,should
support the ACE types that each of the attibutes were designed/intended to
support,
if the server supports them at all.

>  In
>   MUST support the dacl attribute,

This is essentially saying that if you support the acl attribute you have
to support
dacl.  I don''t know if that is the intention.

> and if it supports AUDIT or ALARM

> lists support for the dacl attribute and AUDIT ACEs but not support

As I read it, support for dacl is irrelevant. I think it is saying that if
you support AUDIT ACE's you must be able to set them using the sacl
attribute.

> it can still support AUDIT ACEs via the acl attribute.

I think that is sensible but it doesn't seem to be what the spec says.

On Fri, Jun 16, 2017 at 2:00 PM, Mike Kupfer <[email-masked]> wrote:

> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nfsv4
>

---

From: Mike Kupfer <[email-masked]>
Date: Tue, 20 Jun 2017 12:11:35 -0700

>>   attributes to access all of the ACE types that it supports.
[...]
 > implemented,should support the ACE types that each of the attributes
 > were designed/intended to support, if the server supports them at
 > all.

That was more or less my interpretation.

 >>   In other words, if such a server supports ALLOW or DENY ACEs,
 >>   then it MUST support the dacl attribute,
 >
 > This is essentially saying that if you support the acl attribute you
 > have to support dacl.  I don't know if that is the intention.

But there's that qualifier: "such a server".  I think that refers to
servers that support either dacl or sacl.  So if the server supports
acl, but not dacl or sacl, only the first sentence of the paragraph is 
relevant.

The rest of the paragraph is moot.

mike