Subject: [nfsv4] [LNFS] Meeting Minutes for 07/07/2011

From: Thomas Haynes <[email-masked]>
Date: Thu, 7 Jul 2011 13:50:18 -0500

Attendees:

Tom Haynes (NetApp)
Jarrett Lu (Oracle)
Peter Staubach (EMC)
Trond Myklebust (NetApp)
David Black (EMC)
Sorin Faibish (EMC)
Dave Quigley
Nico Williams

+ IETF Note Well Agreement

   http://www.ietf.org/NOTEWELL.html

+ Upcoming Draft split

Will wait until after Quebec City, will want to redraft the requirements with the focus on
labels and not client/server roles.

Are looking for a driving author for the requirements.

+ SET_LABEL

David Q: What problem is this solving?

We agreed that we are not interested in a SET_LABEL that occurs per compound.
If you want that type of granularity, RPCSEC_GSSv3 is your friend.

We discussed if there was a conflict of using SET_LABEL and RPCSEC_GSSv3
at the same time. Nico outlined a possible sequence that would not be an error.
In any event, we decided not to raise an error here.

The order of priority of deciding a client's subject label would be:

Server's determination if it trusts the client's choice
RPCSEC_GSSv3 subject label
SET_LABEL subject label
Inferred subject label

SET_LABEL would occur after an EXCHANGE_ID, so if the client had to reissue
an EXCHANGE_ID, it could change the subject label.

Quote of the day, Trond asking Nico if he was proposing "Advisory Mandatory Access Control"
during the discussion on whether SET_LABEL was advisory or mandatory.

A lot of discussion about possible use cases.

We talked about whether inferred subject labels would satisfy the
root problem, and they will.

David Q mentioned that for svirt, an object aware server was sufficient.

In the end, we had consensus that we wanted a use case before we accepted
SET_LABEL. Sorin took the AI to see if one existed.

The discussion was good in that we have a vision on what SET_LABEL should
look like if we take it.

We do plan on meeting on July 21st to finalize on what we are taking to Quebec City.

Please review the existing draft for issues.

---

From: Spencer Shepler <[email-masked]>
Date: Thu, 7 Jul 2011 18:56:54 +0000

In reference to this:

"Are looking for a driving author for the requirements"

The requirements/scenarios work must be completed with/before the functionality
move forward.  Given the level of discussion and potential interest outside of
the NFSv4 WG  in this security feature it is best to have appropriate context
set for what is being solved with the use of the requirement/scenarios I-D.
It will likely move forward as an information RFC so that it receives reasonable
review.

Spencer

From: [email-masked] [mailto:[email-masked]] On Behalf Of Thomas Haynes
Sent: Thursday, July 07, 2011 11:50 AM
To: [email-masked]
Subject: [nfsv4] [LNFS] Meeting Minutes for 07/07/2011

Attendees:

Tom Haynes (NetApp)
Jarrett Lu (Oracle)
Peter Staubach (EMC)
Trond Myklebust (NetApp)
David Black (EMC)
Sorin Faibish (EMC)
Dave Quigley
Nico Williams

+ Upcoming Draft split

+ SET_LABEL