Subject: LOOKUPP and NFS4ERR_WRONGSEC

From: [email-masked]
Date: Fri, 7 Feb 2003 16:20:44 -0500

As far as I understand, NFS4ERR_WRONGSEC is returned to the client
when a compound request crosses into an export with incompatible security
requirements. For example, in the following scenario, putfh [/foo/bar];
lookup "baz"
will cause the error to be returned.

  /foo  <-- auth_unix
   |
  /foo/bar
   |
  /foo/bar/baz  <-- krb5

Using the same example, it seems that going the opposite direction using
LOOKUPP would have the same problem. However, the spec did not include
NFS4ERR_WRONGSEC as a possible error code for LOOKUPP. Is this an
oversight or did I miss something?

Thanks
Peng

---

From: Spencer Shepler <[email-masked]>
Date: Fri, 7 Feb 2003 15:24:15 -0600

> oversight or did I miss something?

Not an oversight.  The assumption is that if a object in the server's
namespace requires a particular security mechanism for access that all
ancestors of that object will accept the same security mechanism.
This allows a client to use a single security mechanism while
traversing the namespace to that node.  It also avoids the problem
that you thought might exist.

-- 
Spencer

---

From: "Sergey Klyushin" <[email-masked]>
Date: Fri, 7 Feb 2003 17:44:27 -0500

> -----Original Message-----
> From: [email-masked] [mailto:owner-nfsv4-
> [email-masked]] On Behalf Of Spencer Shepler
> Sent: Friday, February 07, 2003 4:24 PM
> To: [email-masked]
> Subject: Re: LOOKUPP and NFS4ERR_WRONGSEC
> 

Does it mean that /foo and /foo/bar implicitly allow krb5 security?
If yes, what would be in the following "stupid" scenario?

/foo  <-- krb5
 |
/foo/bar
 |
/foo/bar/baz  <-- auth_unix

May I use auth_unix to LOOKUP /foo/bar in /foo?

Thanks,
Sergey