Subject: [nfsv4] New MAC label support Internet Draft posted to IETF website

From: "David P. Quigley" <[email-masked]>
Date: Thu, 22 Jan 2009 14:16:55 -0500

to the IETF website. It contains a lot of clarifying text that has been
asked for by several people in the IETF community. I would like to ask
that people give it a look over and provide comments if possible. I
would prefer that discussion takes place on the NFSv4 WG mailing list
since it shows interest in the technology which is what the WG is
currently looking for. If you have any questions regarding the text or
the system outlined in it email me and I'll be more than happy to help
with any confusion. I am hoping to drum up enough interest in the work
to request that it be added to the NFSv4 WG charter at the next IETF
meeting. If you are interested in the work and would like to participate
or just think that it is a worthwhile technology and would like to see
it added to the NFSv4 standard feel free to speak up. 

The information for the document which I received in the conformation
email and a link to it can be found below.

Dave Quigley

A new version of I-D, draft-quigley-nfsv4-sec-label-00.txt has been
successfuly submitted by David Quigley and posted to the IETF
repository.

Filename:        draft-quigley-nfsv4-sec-label
Revision:        00
Title:           MAC Security Label Support for NFSv4
Creation_date:   2009-01-22
WG ID:           Independent Submission
Number_of_pages: 12

Abstract:
This Internet-Draft describes additions to NFSv4 minor version one to
support Mandatory Access Control systems.  The current draft
describes the mechanism for transporting a MAC security label using
the NFSv4.1 protocol and the semantics required for that label.  In
addition to this it describes an example system of using this label
in a fully MAC aware environment.

The IETF Secretariat.

http://www.ietf.org/internet-drafts/draft-quigley-nfsv4-sec-label-00.txt

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nfsv4

---

From: Spencer Shepler <[email-masked]>
Date: Fri, 23 Jan 2009 11:37:37 -0600

work but until now, the show of specific interest within the NFSv4  
working group
has been very minimal.  If this work is to be added to the working  
group's
charter, there must be a show of interest.  This can be as simple as an
email to the [email-masked] alias stating interest and brief description
of need/use.  This will demonstrate to the area director that work is
occurring and it is worthwhile to have the NFSv4 WG undertake the
work.

So, please speak up, join the nfsv4 WG alias and participate as
interest and need declares.

Spencer

On Jan 22, 2009, at 1:16 PM, David P. Quigley wrote:

> Hello,
>   I have just posted a new document for the MAC labeling support work

---

From: Peter Staubach <[email-masked]>
Date: Fri, 23 Jan 2009 12:47:12 -0500

>
> As David suggests, the NFSv4 working group is positive about this

I will start, I guess.

We, Red Hat, are looking at this work as enabling some fundamental
technologies for our virtual offerings.  We need the ability to
run SELinux over NFS mounted file systems and the current NFSv4[.1]
support is not sufficient to do it.

    Thanx...

       ps

---

From: "Kevin L. Smith" <[email-masked]>
Date: Fri, 23 Jan 2009 11:07:20 -0800

We only wish that labeled NFS could be mainstreamed sooner to get us out of the kernel building process.

Kevin Smith
Software Engineer
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Spencer Shepler [[email-masked]]
Sent: Friday, January 23, 2009 9:37 AM
To: David P. Quigley
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Labeled-nfs] [nfsv4] New MAC label support Internet Draft posted to IETF website

Spencer

_______________________________________________
Labeled-nfs mailing list
[email-masked]
http://linux-nfs.org/cgi-bin/mailman/listinfo/labeled-nfs
_______________________________________________
nfsv4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nfsv4

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 23 Jan 2009 15:17:26 -0600

On Fri, Jan 23, 2009 at 11:37:37AM -0600, Spencer Shepler wrote:
> As David suggests, the NFSv4 working group is positive about this work
> but until now, the show of specific interest within the NFSv4  working
> group has been very minimal.  If this work is to be added to the
> working  group's charter, there must be a show of interest.  This can
> be as simple as an email to the [email-masked] alias stating interest
> and brief description of need/use.  This will demonstrate to the area
> director that work is occurring and it is worthwhile to have the NFSv4
> WG undertake the work.

I can't speak for Sun's Solaris Trusted Extensions team, but as an
individual I believe this work is important and should proceed.

And while this work could well proceed outside the NFSv4 WG as
individual submission Internet-Drafts, I believe these documents will
greatly benefit, in terms of quality and time-to-publication, by being
covered by the NFSv4 WG charter.

Therefore I support amending the WG's charter to include work on MAC
labeling support in NFSv4.

Cheers,

Nico
--

---

From: Lars Eggert <[email-masked]>
Date: Sat, 24 Jan 2009 11:36:56 +0200

Hi,

On 2009-1-23, at 19:37, Spencer Shepler wrote:
> If this work is to be added to the working group's

community interest ("I'd use it if it existed") is necessary, but not  
sufficient to charter new IETF work. We also need to determine if  
there is a group of folks willing to commit to doing the work (writing  
documents, reviewing documents, attending meetings, implement, etc.)  
If you're willing to do this, please indicate it and let us know how  
you'd contribute.

Thanks,
Lars

---

From: Glenn Faden <[email-masked]>
Date: Fri, 23 Jan 2009 13:59:44 -0800

Sun is also positive about David's proposal although we currently don't 
depend on it.

Labeled NFS services are currently provided by Solaris Trusted 
Extensions, without relying on NFS protocol extensions. Instead, Trusted 
Extensions uses the labels of the network endpoints to determine the 
labels of the underlying clients and servers. When acting as an NFS 
server, Trusted Extensions sends packets at the same label as the 
underlying exported filesystem. These endpoint labels are then 
implicitly used to enforce mount policy restrictions by the NFS client 
and server code in the kernel. A restriction of this implementation is 
that all files in a NFS mounted filesystem must have the same label.

In order for Solaris to support per-file labeling we will need NFS 
protocol extensions similar to what David has proposed.

--Glenn

Peter Staubach wrote:
> Spencer Shepler wrote:
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to 
> [email-masked] with
> the words "unsubscribe selinux" without quotes as the message.

---

From: Jarrett Lu <[email-masked]>
Date: Tue, 27 Jan 2009 17:17:59 -0800

> If you're willing to do this, please indicate it and let us know how 

David's labeled-nfs extension is interesting to Sun Microsystems as both 
Solaris
Trusted Extensions and the Flexible Mandatory Access Control (FMAC) 
OpenSolaris
project will benefit from the proposed extension. I'm willing to 
dedicate time to
reviewing documents, attending meetings and discussions, and likely 
contributing
to implementation as well.

Jarrett

>
> Thanks,
> Lars
> ------------------------------------------------------------------------
>