Subject: ACE SUCCESSFUL/FAILED attribute descriptions need clarification

From: "Clem Dickey" <[email-masked]>
Date: Fri, 11 Jan 2002 17:37:28 -0500

In section 5.9.2 of RFC 3010, the descriptions of
ACE4_SUCCESSFUL_ACCESS_FLAG and  ACE4_FAILED_ACCESS_FLAG need clarfication.

The paragraph in question reads

   The flag ACE4_SUCCESSFUL_ACCESS_ACE_FLAG only produces the AUDIT or
   ALARM if the ACCESS or OPEN call is successful. The
   ACE4_FAILED_ACCESS_ACE_FLAG causes the ALARM or AUDIT if the ACCESS or
   OPEN call fails.

Consider the effect if (ACE4_SUCCESSFUL_ACCESS_ACE_FLAG,
ACE4_FAILED_ACCESS_ACE_FLAG) are

(0, 0) - presumably the default; all accesses logged
(0, 1) - literal reading is that failures are explicitly logged, and
SUCCESSes (which are not mentioned) are logged by default; intent is
probably that only FAILUREs are logged
(1, 0) - only SUCCESSes are logged
(1, 1) - literal reading is that FAILUREs both are and are not logged, a
contradiction.  Intent is unclear.

As an aside, 5.9.2 also has a couple of typos - there are references to
"ACL4_DIRECTORY_INHERITANCE_ACE" and "ACL4_FAILED_ACCESS_ACE_FLAG" which
should begin with "ACE4_" and not "ACL4_".

 - Clem