Re: [netconf] NACM read access for actions

Hi Christofer,

Looking at unread email, I noticed your message didn't receive any responses.

Could someone with familiarity with this NACM-question reply?

Thanks,
Kent

> On Dec 4, 2020, at 3:40 AM, Christofer Tornkvist (ctornkvi) <ctornkvi=40cisco.com@dmarc.ietf.org> wrote:
> 
> Hi,
>  
> I read in the NACM RFC 8341 that for actions to not be rejected
> they both must have execute access and also read access
> for all its parent (instance) nodes along the node hierarchy
> up to the top node -described by the path for the action node.
>  
> The read access property, is that equivalent of having NACM rules
> stating read access for all parent (instance) nodes?
>  
> If that is the case, does not that open up the node tree
> structure unnecessarily much?
>  
>  
> I support the idea of just having to state one NACM rule
> containing read and execute access for the action node itself for it
> to be able to be run,
> and also that all the parent (instance) nodes
> will be readable only along the path up to the action node without
> any additional NACM rules.
> And if there is a read access deny rule on any parent (instance) node
> the action will be rejected.
>  
>  
> Would appreciate a clarification.
>  
> Below are references to RFC 8341.
>  
> Regards
> /Christofer Tornkvist
>  
>  
> References in RFC 8341 are:
> Ch. 3.1.3 s.3
>    The new "pre-read data node acc. ctl" boxes in the diagram below
>    refer to group read access as it relates to data node ancestors of an
>    action or notification.  As an example, if an action is defined as
>    /interfaces/interface/reset-interface, the group must be authorized
>    to (1) read /interfaces and /interfaces/interface and (2) execute on
>    /interfaces/interface/reset-interface.
>  
> Ch. 3.1.3 p.12 bullet 2
>    o  If the <action> operation defined in [RFC7950] is invoked, then
>       read access is required for all instances in the hierarchy of data
>       nodes that identifies the specific action in the datastore, and
>       execute access is required for the action node.  If the user is
>       not authorized to read all the specified data nodes and execute
>       the action, then the request is rejected with an "access-denied"
>       error.
>  
>  
> _______________________________________________
> netconf mailing list
> netconf@ietf.org <mailto:netconf@ietf.org>
> https://www.ietf.org/mailman/listinfo/netconf <https://www.ietf.org/mailman/listinfo/netconf>