Subject: [nfsv4] Labeled NFS Requirements

From: "Nordgren, Bryce L -FS" <[email-masked]>
Date: Tue, 15 May 2012 22:01:00 +0000

I'm looking over -02 now.

In the mean time, it occurs to me that this document is much more general than "Labeled NFS". The issues which the document deals with concern mostly the sharing of labels: what happens when all parties understand the same set of labels; what happens when they don't; what additional value-added does a "label-aware" shared store have over a non-label-aware shared store; etc.?

Is there any reason this document couldn't be applied to "Labeled CIFS" or "Labeled Ceph" or "Labeled Gfarm"? The only real requirement seems to be that the underlying filesystem support attributes and a means of attribute synchronization. If the underlying filesystem is federated or distributed, that's just gravy.

Bryce

This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.

---

From: Nico Williams <[email-masked]>
Date: Tue, 15 May 2012 17:08:58 -0500

On Tue, May 15, 2012 at 5:01 PM, Nordgren, Bryce L -FS
<[email-masked]> wrote:
> Is there any reason this document couldn’t be applied to “Labeled CIFS” or
> “Labeled Ceph” or “Labeled Gfarm”? The only real requirement seems to be
> that the underlying filesystem support attributes and a means of attribute
> synchronization. If the underlying filesystem is federated or distributed,
> that’s just gravy.

I sure could be applied to other filesystem protocols.  And in the
fullness of time it might be.  But since the IETF only has two or
three such protocols (NFS, WebDAV, SFTP), it seems quite appropriate
that this should apply only to NFS for now.  Making it apply to CIFS
is certainly out: the IETF does not control that protocol's
specification.

Nico
--

---

From: Spencer Shepler <[email-masked]>
Date: Tue, 15 May 2012 22:09:09 +0000

It likely can be applied to other mechanisms but the focus is the requirements for NFS in this environment.  A note can be made at the end of the document if appropriate but let's keep the scope tight for the moment and let other efforts broaden it if there is interest.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Nordgren, Bryce L -FS
Sent: Tuesday, May 15, 2012 3:01 PM
To: [email-masked]
Subject: [nfsv4] Labeled NFS Requirements

Bryce

---

From: David Quigley <[email-masked]>
Date: Tue, 15 May 2012 18:20:47 -0400

On 05/15/2012 18:01, Nordgren, Bryce L -FS wrote:
> In the mean time, it occurs to me that this document is much more
> general than "Labeled NFS". The issues which the document deals with
> concern mostly the sharing of labels: what happens when all parties
> understand the same set of labels; what happens when they don't; what
> additional value-added does a "label-aware" shared store have over a
> non-label-aware shared store; etc.?
>
> Is there any reason this document couldn't be applied to "Labeled
> CIFS" or "Labeled Ceph" or "Labeled Gfarm"? The only real requirement
> seems to be that the underlying filesystem support attributes and a
> means of attribute synchronization. If the underlying filesystem is
> federated or distributed, that's just gravy.
>
> Bryce
>
>  This electronic message contains information generated by the USDA
> solely for the intended recipients. Any unauthorized interception of
> this message or the use or disclosure of the information it contains
> may violate the law and subject the violator to civil or criminal
> penalties. If you believe you have received this message in error,
> please notify the sender and delete the email immediately.
> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nfsv4

That is true. The document does describe a more general system for 
security labeling. We have the LFS document which is going to describe 
some of the label formats and their usage which can also apply to any 
security labeled system. In the past Jarrett and I worked with joy 
Layton from IBM to have the LFS work apply to labeled IPSec as well. I 
have spoken to the chair of the IPSec WG about this work in the past so 
hopefully it will receive wider adoption. To answer your question about 
other systems there is no reason that this can't be applied to other 
file systems as well. It is a little bit more complex than your 
assessment of filesystem attributes and attribute synchronization. There 
are semantics that a security label attribute must have which are laid 
out in the document as well. Once I am done with NFSv4 I intend on 
looking into trying to do a Labeled CIFS implementation. Hopefully 
Microsoft will be interested in supporting simple attribute storage on 
windows servers to be able to support Linux clients in the enterprise.

Dave