Subject: [nfsv4] draft-ietf-nfsv4-acl-mapping-00: mapping of posix to NFSv4 access mask bits

From: Benny Halevy <[email-masked]>
Date: Wed, 20 Aug 2003 17:59:56 -0400

Marius,

It seems like the mapping you suggested between the Posix 
{read,write,execute}
access mask bits to ACE4_GENERIC_{READ,WRITE,EXECUTE} access masks in 
section 4.
may have a problem with regards to reading and writing the object's 
attributes
and ACL.

The Posix read, write, and execute permissions refer to file data and to the
directory contents and do not cover file attributes or ACL. Attributes 
(and ACL)
are always readable to everyone and writeable to the file owner and to other
permitted users, e.g. the super user.

A simple example of what can go wrong with the mapping you suggested is a
read-only file for which the file owner can never change the file's ACL 
since
the permission to write the file's attributes and ACL is tied with the
permission to write the file's contents.

I believe that a Posix compliant nfsv4 client should create an ACE for 
the file
OWNER to allow it ACE4_WRITE_{ATTRIBUTES,ACL} | ACE4_WRITE_OWNER and an 
ACE for
EVERYONE to allow ACE4_READ_{ATTRIBUTES,ACL} and ACE4_DELETE (when 
supported by
the server).

Also, for the complimenting DENY ACEs suggested, what do you mean by 
"with the
exception that the access mask is inverted."? A Posix client needs to 
map the
unset Posix ACL permission bits to their corresponding NFSv4 access mask 
bits
in the DENY ACE.

To summarize, I believe that the correct mappings should be:
Posix read:     ACE4_READ_DATA | ACE4_LIST_DIRECTORY
Posix write:    ACE4_WRITE_DATA | ACE4_ADD_FILE | ACE4_APPEND_DATA |
                ACE4_ADD_SUBDIRECTORY | ACE4_DELETE_CHILD
Posix execute:  ACE4_READ_DATA | ACE4_LIST_DIRECTORY | ACE4_EXECUTE

--
Benny Halevy
[email-masked]

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Richard Sharpe <[email-masked]>
Date: Wed, 20 Aug 2003 15:15:11 -0700 (PDT)

> permission to write the file's contents.

Do you mean read only in a Posix r--r--r-- sense, or read only in a 
Windows readonly, Linux/FreeBSD immutable file sense?

As a side issue, I have not been able to find any discussion of attributes 
like immutable, append only, etc, in the archive, and their absence any 
discussion any where in the SPEC (even as standardized named attributes) 
is interesting.

Regards
-----
Richard Sharpe, rsharpe[at]ns.aus.com, rsharpe[at]samba.org, 
sharpe[at]ethereal.com, http://www.richardsharpe.com

---

From: marius aamodt eriksen <[email-masked]>
Date: Thu, 21 Aug 2003 01:34:11 -0400

* Benny Halevy <[email-masked]> [030820 18:00]:

> {read,write,execute} access mask bits to
> ACE4_GENERIC_{READ,WRITE,EXECUTE} access masks in section 4.  may
> have a problem with regards to reading and writing the object's
> attributes and ACL.
>
> The Posix read, write, and execute permissions refer to file data
> and to the directory contents and do not cover file attributes or
> ACL. Attributes (and ACL) are always readable to everyone and
> writeable to the file owner and to other permitted users, e.g. the
> super user.

you are absolutely right, it seems i misinterpreted the specs on this
point.  i will change the draft accordingly.

> "with the exception that the access mask is inverted."? A Posix
> client needs to map the unset Posix ACL permission bits to their
> corresponding NFSv4 access mask bits in the DENY ACE.

the binary complement; every bit which is not enabled in the ALLOW ace
should be denied in the DENY ACE.  i think this should be worded
better; i will think about it.

> Posix execute:  ACE4_READ_DATA | ACE4_LIST_DIRECTORY | ACE4_EXECUTE

this is what ACE4_GENERIC_{READ,WRITE,EXECUTE} is for.

-- 
> [email-masked] > http://www.citi.umich.edu/u/marius