Subject: RE: LOOKUPP and NFS4ERR_WRONGSEC

From: [email-masked]
Date: Fri, 7 Feb 2003 17:58:40 -0500

> > > 
> > > Not an oversight.  The assumption is that if a object in 
> the server's
> > > namespace requires a particular security mechanism for 
> access that all
> > > ancestors of that object will accept the same security mechanism.
> > > This allows a client to use a single security mechanism while
> > > traversing the namespace to that node.  It also avoids the problem
> > > that you thought might exist.
> > 
> > What you are effectively saying is any v4 compliant server 
> implementation
> > MUST require a nested export to be more restrictive than 
> its parent exports.
> > IMHO, the protocol should not place a limit on the way 
> security policy is
> > administered, although I can see the assumption makes sense 
> most of the
> > time.
> 
> The protocol implies the requirement via the construction of the
> SECINFO operation as you have pointed out.  So I guess it would be an
> implicit MUST.  However, the server implementation is apply its

I thought for SECINFO to work, the child export must support some of
the flavors that the parent export supports (to be able to cross), but
not necessarily a subset of what the parent supports.

> security policy however it wants.  There are no policy statements like

If the server is free to do what it wants, what error code should we
return if the LOOKUPP crosses into parent export with an unsupported
security flavor? Looks like it has to return NFS4ERR_WRONGSEC so the
client will know it's time to renegotiate, or the client won't be able
to go back. Right?

> this in the protocol specification.  The only limiting factor will be
> how useful a particular policy will be based on the available
> protocol.

Peng

---

From: Mike Eisler <[email-masked]>
Date: Fri, 07 Feb 2003 15:10:22 -0800

>client will know it's time to renegotiate, or the client won't be able

If you return an error code, there is no way for the client to recover.
So you can't return an error code.

If  the nested export is less restrictive then the ancestor, then it means
that ancestor directories can be read with the weaker security flavor.

    -mre