[netconf] NACM read access for actions

["Christofer Tornkvist (ctornkvi)" <[e-mail]>]

Hi,

I read in the NACM RFC 8341 that for actions to not be rejected
they both must have execute access and also read access
for all its parent (instance) nodes along the node hierarchy
up to the top node -described by the path for the action node.

The read access property, is that equivalent of having NACM rules
stating read access for all parent (instance) nodes?

If that is the case, does not that open up the node tree
structure unnecessarily much?


I support the idea of just having to state one NACM rule
containing read and execute access for the action node itself for it
to be able to be run,
and also that all the parent (instance) nodes
will be readable only along the path up to the action node without
any additional NACM rules.
And if there is a read access deny rule on any parent (instance) node
the action will be rejected.


Would appreciate a clarification.

Below are references to RFC 8341.

Regards
/Christofer Tornkvist


References in RFC 8341 are:
Ch. 3.1.3 s.3
   The new "pre-read data node acc. ctl" boxes in the diagram below
   refer to group read access as it relates to data node ancestors of an
   action or notification.  As an example, if an action is defined as
   /interfaces/interface/reset-interface, the group must be authorized
   to (1) read /interfaces and /interfaces/interface and (2) execute on
   /interfaces/interface/reset-interface.

Ch. 3.1.3 p.12 bullet 2
   o  If the <action> operation defined in [RFC7950] is invoked, then
      read access is required for all instances in the hierarchy of data
      nodes that identifies the specific action in the datastore, and
      execute access is required for the action node.  If the user is
      not authorized to read all the specified data nodes and execute
      the action, then the request is rejected with an "access-denied"
      error.