From: J. Bruce Fields (bfields@fieldses.org)
Date: 01/10/05-03:01:50 PM Z
Date: Mon, 10 Jan 2005 16:01:50 -0500
Subject: Re: [nfsv4] NFSv4 ACLs: {READ,WRITE}_NAMED_ATTRIBUTES
Message-ID: <20050110210150.GD13564@fieldses.org>
From: "J. Bruce Fields" <bfields@fieldses.org>
On Fri, Jan 07, 2005 at 04:46:55PM -0700, Sam Falkner wrote:
> This document describes what the Solaris NFSv4 Server will accept for
> ACLs when it must map to POSIX-draft ACLs for a UFS filesystem.
That all looks OK to me. I only see one minor practical problem,
with {READ,WRITE}_NAMED_ATTRIBUTES.
I think what you've chosen to do (allow anything except explicit DENY's
of {READ,WRITE}_NAMED_ATTRIBUTES) is the right thing given what you've
said about the security model for Sun's named attributes (which is that
the only thing acls and mode bits on the file can affect is the default
permission of associated streams on the file). But currently I think
that will cause interoperability problems with Netapp--the permissions
on a newly created file on a Netapp server will include DENY's to entity
without read and write permissions, so your client will have to decide
what to do in that case. (You don't really discuss client-side
behaviour, though, so maybe you'll be more lenient there.)
I also still think there's room for more leniency (on {READ,WRITE}_ATTRS,
etc.), but at this point I think we're close enough.
In the next week or so I'll work on updating our code and the I-D to
what we've agreed on.
--b.
_______________________________________________
nfsv4 mailing list
nfsv4@ietf.org
https://www1.ietf.org/mailman/listinfo/nfsv4
This archive was generated by hypermail 2.1.2 : 03/04/05-02:13:50 AM Z CST