Re: [netconf] NACM read access for actions

["Johan Vikman Lundström (jvikman)" <[e-mail]>]

On Wed, Feb 24, 2021 at 3:52 PM Kent Watsen <[e-mail]<mailto:[e-mail]>> wrote:
Hi Christofer,

Looking at unread email, I noticed your message didn't receive any responses.

Could someone with familiarity with this NACM-question reply?


I think the question is whether the read access required for exec access exposes
too much data.

I think the original intent of the text is that read access to the container or list
element is required, not the entire subtree.  It could be argued that read access to the
key leafs within a list entry is also required.


JV: I agree with your interpretation of the question. Looking at the RFC and the default read being “permit” I think the paragraphs makes sense, reusing the /interfaces/interface/reset-interface example an admin could for instance add a deny on /interfaces for the group and thus stopping the operator from using the action.

When it gets interesting is when the the default read setting is “deny”, it’s not unreasonable to think that the admin wants to deny everything and only open up what is needed. But then adding an explicit rule permit read on /interfaces /interfaces/interface would open up a lot.

Interpreting your thought on original intent, it would be enough to have read access on /interfaces/interface[name=’if0’] OR /interfaces/interface, even if the default read permission was ‘deny’ (which would affect /interface), right?

/Johan

Thanks,
Kent


Andy



On Dec 4, 2020, at 3:40 AM, Christofer Tornkvist (ctornkvi) <ctornkvi=[e-mail]<mailto:ctornkvi=[e-mail]>> wrote:

Hi,

I read in the NACM RFC 8341 that for actions to not be rejected
they both must have execute access and also read access
for all its parent (instance) nodes along the node hierarchy
up to the top node -described by the path for the action node.

The read access property, is that equivalent of having NACM rules
stating read access for all parent (instance) nodes?

If that is the case, does not that open up the node tree
structure unnecessarily much?


I support the idea of just having to state one NACM rule
containing read and execute access for the action node itself for it
to be able to be run,
and also that all the parent (instance) nodes
will be readable only along the path up to the action node without
any additional NACM rules.
And if there is a read access deny rule on any parent (instance) node
the action will be rejected.


Would appreciate a clarification.

Below are references to RFC 8341.

Regards
/Christofer Tornkvist


References in RFC 8341 are:
Ch. 3.1.3 s.3
   The new "pre-read data node acc. ctl" boxes in the diagram below
   refer to group read access as it relates to data node ancestors of an
   action or notification.  As an example, if an action is defined as
   /interfaces/interface/reset-interface, the group must be authorized
   to (1) read /interfaces and /interfaces/interface and (2) execute on
   /interfaces/interface/reset-interface.

Ch. 3.1.3 p.12 bullet 2
   o  If the <action> operation defined in [RFC7950] is invoked, then
      read access is required for all instances in the hierarchy of data
      nodes that identifies the specific action in the datastore, and
      execute access is required for the action node.  If the user is
      not authorized to read all the specified data nodes and execute
      the action, then the request is rejected with an "access-denied"
      error.


_______________________________________________
netconf mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/netconf

_______________________________________________
netconf mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/netconf