Subject: [nfsv4] seek input on file access control management standard

From: "Yoder, Alan" <[email-masked]>
Date: Mon, 7 Nov 2005 21:25:59 -0800

Hi,

   I'm on the hook to develop an SMI-S profile
for filesystem access control management.  This 
in some sense requires approaching the problem
of filesystem security from the opposite 
direction of that currently embodied in the
spec.  Meaning that whereas RFC 3510 tries to
encapsulate all the things related to access
control (section 5.11) that a server COULD do,
a management spec has to specify all the things
that a management client application CAN do, and
that a server supporting that client MUST do.

   There are multiple areas in which I'm not very
clear on the intent of the RFC.  For instance, there
are four bits related to inheritance *per ACE*.
This level of generality is not available on 
previously shipping systems that I'm aware of, and
I also am not acquainted with a use case for it.
Therefore, I'm tempted to simplify the SNIA spec
to make these flags ACL-wide.  It will be easier
to get through committee that way.

   If anyone has opinions on this type of 
simplification wrt client-side use and mangagement
applications, please either initiate a correspondence 
with me directly or join the SNIA FileSystem Management 
(FSM) TWG.  Given the probable future importance of 
SMI-S, it's unlikely that capabilities not managed 
by it will be much used in the heterogeneous filesystem 
space [understood however that they may be used in 
other spaces].  For that reason, I'd like the authors 
of NFSv4 to have as much input into the management 
standard as possible.

Thanks,

Alan

===============================================================
Alan G. Yoder                                    [email-masked]
Technical Staff                           
Network Appliance, Inc.                            408-822-6919
===============================================================

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Spencer Shepler <[email-masked]>
Date: Fri, 11 Nov 2005 01:49:07 -0600

I am confused.  Is this management of filesystems or management
of the objects within a filesystem?

I might expect the control of either to be different and 
potentially authenticated differently.

Spencer