Subject: RE: [nfsv4] pNFS, OPEN principals and ACLs

From: "Noveck, Dave" <[email-masked]>
Date: Thu, 22 Sep 2005 20:14:50 -0400

One case in which it can do this is when an ace specifying everyone
is provided.  For example, the server can tell the client that 
everyone can read the file.

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]]
Sent: Thursday, September 22, 2005 6:29 PM
To: [email-masked]
Cc: [email-masked]; Everhart, Craig
Subject: Re: [nfsv4] pNFS, OPEN principals and ACLs

On Thu, Sep 22, 2005 at 05:58:29PM -0400, [email-masked] wrote:
> [Nico wrote]
> > I think it's simpler.  The client does an OPEN as a given principal, the
> > server then tells it what access that principal has to that file and
> > what the principal's "who" name is as far as the server is concerned.
> > 
> > I think the plural "users" that rick quoted from RFC3530 is misleading
> > -- that ACE is not supposed to represent more than one user, the one
> > that opened the file.
> 
> Well, here's the first sentence of the last para in Sec. 9.4:
>    The use of delegation together with various other forms of caching
>    creates the possibility that no server authentication will ever be
>    performed for a given user since all of the user's requests might be
>    satisfied locally.
> 
> To me, that says that the ACE can apply to other "users" than the one
> that did the OPEN, otherwise how could it never authenticate to the
> server, since it was the one that did the OPEN?

How can it?  An ACE can only have one subject.  Even assuming a group as
a subject the client may not be able to resolve the group to the same
set of users as the server.  Any implication that the client can
determine, given just one ACE what the rest of the ACL on that file
looks like and how to interpret that is clearly, clearly incorrect.

> Higher up on pg 104:
>    The nfsace4 passed with delegation can be used to avoid frequent
>    ACCESS calls.  The permission check should be as follows:
> 
>    o  If the nfsace4 indicates that the open may be done, then it should
>       be granted without reference to the server.
> 
>    o  If the nfsace4 indicates that the open may not be done, then an
>       ACCESS request must be sent to the server to obtain the definitive
>       answer.
> 
> It seems "if the nfsace4 says the OPEN can be done, that's all that
> needs to occur". No suggestion that it only applies to the principal
> that did the OPEN, from what I read.

The client can ultimately do whatever it well pleases.  It can open a
file as one principal that has access to it and then turn around and
give access to that file away to any and all who ask the client.

So what?  That doesn't mean that the client can do what the server would
have done had the client done an ACCESS for any other users on it asking
to access that same file.

Nico
-- 

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 22 Sep 2005 19:22:50 -0500

> everyone can read the file.

An exception that proves a, er, rule.