Subject: Re: ACL in NFSv4 protocol

From: Mike Eisler <[email-masked]>
Date: Mon, 3 Mar 2003 09:51:45 -0800 (PST)

> From [email-masked]  Mon Mar  3 02:15:16 2003
> Given the following what does "Synchronization" mean?

> File: rwx------ (700) Owner Read/Write/Execute
> on local system an ACL is added which contains one ACE:
> 	"FRED" - DENY WRITE

> FRED is the owner of the file.

> A local "ls" command will list the file as:
> 	rwx------

I hope not.

> >From an NFS connected machine, the mode will be?????

> 	r-x------ or rwx------ 

> If Synchronized that I would assume you mean r-x------.

If the implementation automatically reflects FRED's DENY WRITE into the
OWNER@ DENY, then the former (r-x ...).

> Now a CHOWN is done to CARL so what are the permissions on the file???

> rwx------ with an ACE for FRED which denies him WRITE??

That's my understanding.

> So the "Synchronized" ls changes the displayed mode to rwx------ from r-x------?

> Is the above scenario different if the ACE is OWNER@ ???

ONWER@ is determinator. If the implementation is
going to allow the ACE for the owner to conflict with OWNER@ then
I don't know what it should do.

> -------------------------------------------------

> I should note that my intention was the OWNER and GROUP were placeholders which
> matched the current owner and current group, but were not "storable" values. The

Well either you didn't convey that intent when you wrote the text or it
somehow got dropped. Given that there are 10 or so other special "@"
identifiers in the ACL proposal you gave us, it is easy to see why we
thought they were all storage.  Regardless, I don't think it is a big
deal. The implementation can either synchronize stroes of OWBER@ and
GROUP@ with the explicit ACE and have a sane result, or it not
synchronize and have an insane result. But either way, it has to allow
the stores.

> real current owner and group would be inserted in the ACE before it went to
> disk. By having them as "storable" values you can have two ACEs one which refers
> to the OWNER of the file at any given time and the other refers to a specific
> user who might now own the file. This was not the intention.

I beginning to think that if server implementors find this
to be too hard, then they shouldn't support mode. Let the client
figure it out.

Also, the argument that if a host has an NFsv3 server it has to
have its NFSv4 server support mode seems flawed since the
NFSv3 server is likely faking the mode anyway (to reflect
any ACLs). In NFSv4, if mode is to be reported, then the true
mode should be reported.

	-mre

---

From: "Sergey Klyushin" <[email-masked]>
Date: Mon, 3 Mar 2003 12:35:27 -0800

I believe that definition of OWNER@/GROUP@/EVERYONE@ should be solved first
and only after we need to return to synchronization issue.

We have to agree->disagree->and finally agree on the following
1. EVERYONE@ includes owner and group and all other special "who" ids.
2. What is special "who" ids OWNER@/GROUP@
2.1 Direct mapping/meaning of POSIX ACL_USER_OBJ/ACL_GROUP_OBJ or
2.2 Direct mapping/meaning of Windows CREATOR_OWNER/CREATOR_GROUP ACE or
2.3 "I (Carl) should note that my intention was the OWNER and GROUP were 
placeholders which matched the current owner and current group, but were not
"storable" values. The real current owner and group would be inserted in the

ACE before it went to disk. By having them as "storable" values you can have

two ACEs one which refers to the OWNER of the file at any given time and the

other refers to a specific user who might now own the file. This was not the

intention."
2.4 All above or non from above -:)
3. Whatever OWNER@/GROUP@ is, may ACL include ACE for real owner/group in
addition to OWNER@/GROUP@.
4. Whatever OWNER@/GROUP@ is, may ACL include more than one ACE of 
OWNER@/GROUP@.
5. Should OWNER@/GROUP@ be "storable".
6. Is special ACL processing required for user/group that is file owner/
owner_group (not to process all ACL, but OWNER@/GROUP@ only)

I strongly believe making agreement on this will solve synchronization issue
much easily.

Thanks,
Sergey

> -----Original Message-----
> From: [email-masked] [mailto:owner-nfsv4-
> [email-masked]] On Behalf Of Mike Eisler
> Sent: Monday, March 03, 2003 9:52 AM
> To: [email-masked]; [email-masked]
> Subject: Re: ACL in NFSv4 protocol
>