Subject: [nfsv4] I-D Action: draft-ietf-nfsv4-integrity-measurement-00.txt

From: [email-masked]
Date: Tue, 29 May 2018 15:04:13 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Network File System Version 4 WG of the IETF.

        Title           : Integrity Measurement for Network File System version 4
        Author          : Charles Lever
	Filename        : draft-ietf-nfsv4-integrity-measurement-00.txt
	Pages           : 12
	Date            : 2018-05-29

Abstract:
   This document specifies an OPTIONAL extension to NFS version 4.2 that
   enables Linux Integrity Measurement Architecture metadata (IMA) to be
   conveyed between NFSv4.2 servers and clients.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-nfsv4-integrity-measurement/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-nfsv4-integrity-measurement-00
https://datatracker.ietf.org/doc/html/draft-ietf-nfsv4-integrity-measurement-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Chuck Lever <[email-masked]>
Date: Wed, 30 May 2018 10:30:36 -0400

Hi-

> Begin forwarded message:
> 
> From: [email-masked]
> Subject: [nfsv4] I-D Action: draft-ietf-nfsv4-integrity-measurement-00.txt
> Date: May 29, 2018 at 6:04:13 PM EDT
> To: <[email-masked]>
> Cc: [email-masked]
> 
> 

What has changed since draft-cel-nfsv4-linux-seclabel-xtensions-00:

- The original personal draft has been promoted to a Working Group document.
- Tom Haynes' review comments on the original document have been merged,
  including the addition of some forward citations and definitions.
- Support for Linux file capabilities has been removed, to be submitted via
  a separate I-D. The document has been renamed to reflect the refinement of
  purpose.
- The use of NFSv4 Security Labels has been replaced with new OPTIONAL fattr4
  attributes. The document includes an XDR definition of the new attributes.
  This makes IMA support a legitimate extension of the NFSv4.2 protocol,
  rather than something "tunneled" through Security Labels.
- Support has been added for EVM HMAC hashes covering optional extended
  attributes. The server advertises a list of which optional attributes are
  included.
- The discussion is more sensitive to servers that support storing hashes but
  do not permit native access to them (ie., non-Linux server implementations).
- The Security Considerations section has been expanded.

My plan for file capabilities is to submit a similar document as this
one, once this one has had some review and discussion.

--
Chuck Lever