Subject: [nfsv4] Moving forward with Requirements for Labeled NFS

From: Spencer Shepler <[email-masked]>
Date: Wed, 9 May 2012 18:51:36 +0000

Thanks for everyone's input to the Labeled NFS document.
Tom has integrated everyone's comments and pushed an update in the form of draft-ietf-nfsv4-labreqs-01.txt.

If there are no further comments by the end of this week (please do a quick check to make sure comments have been integrated effectively), I will shepherd this version forward.

Spencer

---

From: <[email-masked]>
Date: Thu, 10 May 2012 21:20:47 -0400

Since I'm rather late to the party on this one, I'll limit myself to one comment.

Section 3.5 describes two modes of operation, Full mode (MAC enforcement at server and clients) and Guest mode (no MAC functionality at the client), and this structure is repeated in the Policy Enforcement discussion in Section 3.7.  The requirements on client-only Guest mode in both of these sections appear to exclude the MAC-Aware (but not MAC-Functional) server discussed in Section 4.7, and that is applicable to a number of use cases in Section 4 in suitably controlled environments (e.g., 4.2, 4.5 and 4.6).

Thanks,
--David

From: [email-masked] [mailto:[email-masked]] On Behalf Of Spencer Shepler
Sent: Wednesday, May 09, 2012 2:52 PM
To: [email-masked]
Subject: [nfsv4] Moving forward with Requirements for Labeled NFS

Spencer

---

From: "Haynes, Tom" <[email-masked]>
Date: Fri, 11 May 2012 03:37:31 +0000

The MAC-aware, aka label aware server from last year, is something we all thought filled a need for the specific use case for seVirt. But we came up with it when the documents were pretty baked.

We've also gone from smart/dumb terminology to full/guest.

So, are you suggesting we keep the MAC aware distinction and make this type of change to start of 3.5?

   LNFS must cater for three potentially concurrent operating modes,
   depending on the state of MAC functionality:

I.e., from two modes to three?

Or are you suggesting we modify section 3.5.2 to include the MAC-aware server?

From: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Date: Thursday, May 10, 2012 8:20 PM
To: Spencer Shepler <[email-masked]<mailto:[email-masked]>>, nfsv4 <[email-masked]<mailto:[email-masked]>>
Subject: Re: [nfsv4] Moving forward with Requirements for Labeled NFS

Since I’m rather late to the party on this one, I’ll limit myself to one comment.

Thanks,
--David

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Spencer Shepler
Sent: Wednesday, May 09, 2012 2:52 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [nfsv4] Moving forward with Requirements for Labeled NFS

Thanks for everyone’s input to the Labeled NFS document.
Tom has integrated everyone’s comments and pushed an update in the form of draft-ietf-nfsv4-labreqs-01.txt.

Spencer

---

From: <[email-masked]>
Date: Fri, 11 May 2012 06:11:25 -0400

I thought we agreed to have 3 modes. I see the server MAC aware as an important use case. I hope it is not too late.

Sent from my iPad

On May 10, 2012, at 11:38 PM, "Haynes, Tom" <[email-masked]<mailto:[email-masked]>> wrote:

From: "<mailto:[email-masked]>[email-masked]<mailto:[email-masked]>" <<mailto:[email-masked]>[email-masked]<mailto:[email-masked]>>
Date: Thursday, May 10, 2012 8:20 PM
To: Spencer Shepler <<mailto:[email-masked]>[email-masked]<mailto:[email-masked]>>, nfsv4 <<mailto:[email-masked]>[email-masked]<mailto:[email-masked]>>
Subject: Re: [nfsv4] Moving forward with Requirements for Labeled NFS

Thanks,
--David

From: <mailto:[email-masked]> [email-masked]<mailto:[email-masked]> [<mailto:[email-masked]>mailto:[email-masked]] On Behalf Of Spencer Shepler
Sent: Wednesday, May 09, 2012 2:52 PM
To: <mailto:[email-masked]> [email-masked]<mailto:[email-masked]>
Subject: [nfsv4] Moving forward with Requirements for Labeled NFS

Spencer

_______________________________________________
nfsv4 mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/nfsv4

---

From: <[email-masked]>
Date: Fri, 11 May 2012 12:38:43 -0400

Hi Tom,

> I.e., from two modes to three?

Yes, I think a MAC-Aware server with MAC-Functional clients is a third mode - it's different from Guest mode because there are labels in the NFSv4.2 protocol, in contrast to Guest mode's clear statement that the protocol is used with no label enhancements.  The policy enforcement and security considerations topics are also different in this third mode, as configuration and other restrictions are necessary in order for the clients to trust the labels on the server - those require separate discussion.

Thanks,
--David

From: Haynes, Tom [mailto:[email-masked]]
Sent: Thursday, May 10, 2012 11:38 PM
To: Black, David; [email-masked]; [email-masked]
Subject: Re: [nfsv4] Moving forward with Requirements for Labeled NFS

Thanks,
--David

Spencer

---

From: "Haynes, Tom" <[email-masked]>
Date: Fri, 11 May 2012 20:47:08 +0000

Sorin,

Yes, 3 modes, we just need to wordsmith it better.

Tom

On 5/11/12 5:11 AM, "[email-masked]" <[email-masked]> wrote:

>I thought we agreed to have 3 modes. I see the server MAC aware as an
>important use case. I hope it is not too late.
>
>Sent from my iPad
>
>On May 10, 2012, at 11:38 PM, "Haynes, Tom"
><[email-masked]<mailto:[email-masked]>> wrote:
>
>The MAC-aware, aka label aware server from last year, is something we all
>thought filled a need for the specific use case for seVirt. But we came
>up with it when the documents were pretty baked.
>
>From: 
>"<mailto:[email-masked]>[email-masked]<mailto:[email-masked]
>m>" 
><<mailto:[email-masked]>[email-masked]<mailto:[email-masked]
>m>>
>To: Spencer Shepler
><<mailto:[email-masked]>[email-masked]<mailto:sshepler@mic
>rosoft.com>>, nfsv4
><<mailto:[email-masked]>[email-masked]<mailto:[email-masked]>>
>Since I¹m rather late to the party on this one, I¹ll limit myself to one
>comment.
>
>Section 3.5 describes two modes of operation, Full mode (MAC enforcement
>at server and clients) and Guest mode (no MAC functionality at the
>client), and this structure is repeated in the Policy Enforcement
>discussion in Section 3.7.  The requirements on client-only Guest mode in
>both of these sections appear to exclude the MAC-Aware (but not
>MAC-Functional) server discussed in Section 4.7, and that is applicable
>to a number of use cases in Section 4 in suitably controlled environments
>(e.g., 4.2, 4.5 and 4.6).
>
>Thanks,
>--David
>
>From: <mailto:[email-masked]>
>[email-masked]<mailto:[email-masked]>
>[<mailto:[email-masked]>mailto:[email-masked]] On Behalf
>Of Spencer Shepler
>Thanks for everyone¹s input to the Labeled NFS document.
>Tom has integrated everyone¹s comments and pushed an update in the form
>of draft-ietf-nfsv4-labreqs-01.txt.
>
>If there are no further comments by the end of this week (please do a
>quick check to make sure comments have been integrated effectively), I
>will shepherd this version forward.
>
>Spencer
>