Re: [L3sm] New Version Notification for draft-wu-l3sm-rfc8049bis-02.txt

[David Ball <[e-mail]>]

On 24/08/2017 11:50, Qin Wu wrote:
>
> [DB] Like I said, my reading of RFC6536 is that it doesn't cascade 
> down the tree, so it needs to be put on every node.  Just putting it 
> on the container would mean that the client couldn't create the 
> container, but if the container already existed, they would still be 
> able to write to everything inside it.  See RFC6536 section 3.2.3 for 
> example.  I think the example in RFC7317 is wrong, although it is the 
> same authors as RFC6536, which is curious.  I'll check with Martin.
>
> [Qin]:  Yes, we need to get confirm about this, it looks to me if we 
> apply “nacm:default-deny-write” to top level node, 
> “nacm:default-deny-write” applicability will spread to the lower level 
> nodes as well.
>
> By reading RFC6536 section 3.2.3 example, I didn’t get the same 
> understanding. Please correct me if I am wrong.
>

I got a reply from Martin, he says you are right (although he agreed 
RFC6536 is unclear).  So, it's only needed on the container.

Thanks,

     David

-- 
David Ball
<[e-mail]>