Subject: Re: [nfsv4] pNFS, OPEN principals and ACLs

From: Nicolas Williams <[email-masked]>
Date: Wed, 21 Sep 2005 14:23:43 -0500

On Wed, Aug 31, 2005 at 10:39:51AM -0500, David Robinson wrote:
> I don't think we have constructed delegations in a manner that
> will allow delegation of trust back to the so for a principal that
> has not previously OPEN'd a file we need an over the wire op.
> (A better security person than I may correct me, but I think I
> am right) So a delegation will save the case where a principal
> repeatedly opens a file, but not a new principal.  But arguably
> an ACCESS is lighter weight than an OPEN so there is still
> some savings.

Agreed.  OPEN once, then ACCESS as necessary for any other users opening
the same file on the same client.  The client can handle share modes and
maybe even local lock conflicts on the same file; it just can't eval
ACLs.

Nico
-- 

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 21 Sep 2005 14:27:12 -0500

> maybe even local lock conflicts on the same file; it just can't eval

Also, for those other users any actual I/O on that file needs to be done
with credentials for the same principal as did the file open through
which those users' processes got the file descriptor (a mouthful).