Subject: Mapping Between NFSv4 and Posix Draft ACLs (I-D submitted)

From: Spencer Shepler <[email-masked]>
Date: Mon, 16 Sep 2002 20:55:31 -0500

A personal draft entitled
"Mapping Between NFSv4 and Posix Draft ACLs"
was submitted by Marius Eriksen and can be found at:

http://www.ietf.org/internet-drafts/draft-eriksen-nfsv4-acl-00.txt

It is an interesting read for those implementing the ACL portions of
the protocol.

I would like to suggest it be reviewed and that the WG consider
picking this up as a WG draft as a potential informational RFC or at
least as a portion of any NFSv4 implementation drafts that are built
in the future.

-- 
Spencer

---

From: Carl Beame <[email-masked]>
Date: 17 Sep 2002 20:25:32 +0100

> http://www.ietf.org/internet-drafts/draft-eriksen-nfsv4-acl-00.txt
The following is an extract from the above document:

 The ACE access mask is translated as follows.  The read bit of the
   POSIX access mask is translated to the "ACE4_READ_DATA" NFSv4 access
   mask field.  The write bit of the POSIX access mask is translted to
   "ACE4_WRITE_DATA" NFSv4 access mask field.  In the case of a
   directory object, the execute bit of the POSIX access mask is
   translated into the "ACE4_LIST_DIRECTORY" NFSv4 access mask field.
   In the case of any other file system object, the execute bit of the
   POSIX access mask is translated into the "ACE4_EXECUTE" NFSv4 access
   mask field.

---------------------------------------------------
Given the NFS V4 permissions:
   READ_DATA              Permission to read the data of the file
   LIST_DIRECTORY         Permission to list the contents of a
                          directory
   WRITE_DATA             Permission to modify the file's data
   ADD_FILE               Permission to add a new file to a
                          directory
   APPEND_DATA            Permission to append data to a file
   ADD_SUBDIRECTORY       Permission to create a subdirectory to a
                          directory
   READ_NAMED_ATTRS       Permission to read the named attributes
                          of a file
   WRITE_NAMED_ATTRS      Permission to write the named attributes
                          of a file
   EXECUTE                Permission to execute a file
   DELETE_CHILD           Permission to delete a file or directory
                          within a directory
   READ_ATTRIBUTES        The ability to read basic attributes
                          (non-acls) of a file

I believe the following more acurately describes the translation:

On a Normal File:
POSIX Read = READ_DATA |
             (( READ_NAMED_ATTRS|READ_ATTRIBUTES) & DIR_POSIX_Read)
POSIX Write = WRITE_DATA|APPEND_DATA|
             (( WRITE_NAME_ATTRS) & DIR_POSIX_Write)
POSIX Execute = EXECUTE

On a Directory:
POSIX Read = READ_NAMED_ATTRS|READ_ATTRIBUTES
POSIX Write = ADD_FILE|ADD_SUBDIRECTORY|DELETE_CHILD|
             (( WRITE_NAME_ATTRS) & DIR_POSIX_Write)
POSIX Execute = LIST_DIRECTORY

Note that DIR_POSIX_xxxx is the POSIX attributes of the directory
holding the current file/directory.

This may not be 100%, but I think it is closer.

- Carl Beame

---

From: marius aamodt eriksen <[email-masked]>
Date: Tue, 17 Sep 2002 15:49:59 -0400

> POSIX Execute = LIST_DIRECTORY

with the exception of | APPEND_DATA in POSIX write, i mostly agree.  i
will have to think a little more about the attributes, too.

marius.

-- 
> [email-masked] > http://www.citi.umich.edu/u/marius

---

From: Andreas Gruenbacher <[email-masked]>
Date: Tue, 17 Sep 2002 22:28:48 +0200 (CEST)

Hi,

the description of the POSIX ACL access algorithm doesn't mention the
ACL_GROUP_OBJ entry. That's probably because I had a messed up description
of the algorithm on the acl(5) man page. I'm sure you will promptly
correct that.

Also you are saying that POSIX ACLs are s proper subset of NFSv4 ACLs in
(4.). That's not true; permissions are cumulative under Windows but not
under POSIX. (A counter example is easy to construct.)

In the second to last paragraph of (4.) you describe how the ACL_MASK
entry can be mapped. I don't understand what you are saying there.

Cheers,
Andreas.

---

From: marius aamodt eriksen <[email-masked]>
Date: Tue, 17 Sep 2002 16:53:42 -0400

> of the algorithm on the acl(5) man page. I'm sure you will promptly

yes, i meant to include it (as i had notified you), but simply forgot
it.

> under POSIX. (A counter example is easy to construct.)

following the methods of my proposed algorithm, cumulative
vs. non-cumulative is emulated.

> entry can be mapped. I don't understand what you are saying there.

let me read it again, and see if i can clarify.

marius.

--