Subject: [nfsv4] Why can't SECINFO return NFS4ERR_WRONGSEC?

From: "Haynes, Tom" <[email-masked]>
Date: Thu, 16 Dec 2004 14:23:48 -0800 (PST)

DESCRIPTION

   The SECINFO operation is used by the client to obtain a list of valid
   RPC authentication flavors for a specific directory filehandle, file
   name pair.  SECINFO should apply the same access methodology used for
   LOOKUP when evaluating the name.  Therefore, if the requester does
   not have the appropriate access to LOOKUP the name then SECINFO must
   behave the same way and return NFS4ERR_ACCESS.

If a client sends a SECINFO request for a file handle and the underlying
security flavor for the request does not meet the exported flavors,
then the only option is to return NFS4ERR_ACCESS instead of 
NFS4ERR_WRONGSEC.

But, this is incomplete information.  The issue wasn't that the client
could not get access, just that we could not determine it with the
current flavor.  Or do client implementations, when they get NFS4ERR_ACCESS
on SECINFO, then start trying other underlying security flavors?

A forgiving server could say, ahh, what the hey, here is the SECINFO.
But, I take *must* as saying the server can not be forgiving.

-- 
Tom Haynes, ex-cfb
[email-masked]

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Mike Eisler <[email-masked]>
Date: Mon, 20 Dec 2004 13:51:11 -0800

> -----Original Message-----
 > From: Haynes, Tom
 > Sent: Thursday, December 16, 2004 2:24 PM
 > To: [email-masked]
 > Subject: [nfsv4] Why can't SECINFO return NFS4ERR_WRONGSEC?

Because it got _WRONGSEC there's no way, short of trial
and error, to find the right security.

 > then the only option is to return NFS4ERR_ACCESS instead of

"access" here applies primarily to whether the permission bits/ACL
checks pass.

 > But, I take *must* as saying the server can not be forgiving.

The client has a directory file handle and obtained that file handle
using some flavor I'll call X. Thus security flavor X should
be sufficient to perform a SECINFO using that file handle.

In other words, while the security flavor required to do a LOOKUP is
not the same as the security flavor required to do a SECINFO,
the access rights, as a described by the ACL required for
LOOKUP and SECINFO are the same. If the directory search right is
denied, then so is SECINFO.