Re: [netmod] Eric Rescorla's Discuss on draft-ietf-netmod-schema-mount-11: (with DISCUSS)

[Eric Rescorla <[e-mail]>]

On Wed, Oct 10, 2018 at 5:32 AM Martin Bjorklund <[e-mail]> wrote:

> Hi,
>
> Eric Rescorla <[e-mail]> wrote:
> > Eric Rescorla has entered the following ballot position for
> > draft-ietf-netmod-schema-mount-11: Discuss
> >
> > When responding, please keep the subject line intact and reply to all
> > email addresses included in the To and CC lines. (Feel free to cut this
> > introductory paragraph, however.)
> >
> >
> > Please refer to
> https://www.ietf.org/iesg/statement/discuss-criteria.html
> > for more information about IESG DISCUSS and COMMENT positions.
> >
> >
> > The document, along with other ballot positions, can be found here:
> > https://datatracker.ietf.org/doc/draft-ietf-netmod-schema-mount/
> >
> >
> >
> > ----------------------------------------------------------------------
> > DISCUSS:
> > ----------------------------------------------------------------------
> >
> > Rich version of this review at:
> > https://mozphab-ietf.devsvcdev.mozaws.net/D3506
> >
> >
> >
> > DETAIL
> > S 4.
> > >
> > >      It is worth emphasizing that the nodes specified in
> > >      "parent-reference" leaf-list are available in the mounted schema
> only
> > >      for XPath evaluations.  In particular, they cannot be accessed
> there
> > >      via network management protocols such as NETCONF [RFC6241] or
> > >      RESTCONF [RFC8040].
> >
> > What are the security implications of this XPath reference outside the
> > mount jail? Specifically, how does it interact with the access control
> > for the enclosing module.
>
> There is no such interaction, since access control comes into play
> when some external entity accesses the data through some management
> protocol, and the nodes from the "parent-reference" expressions cannot
> be accessed via management protocols.
>
> The last sentence of the quoted paragraph was supposed to make this
> clear, but it seems we might need some additional explanation?
>

Yes, I think so. I guess I'm not clear on what the XPath expressions are
for if they
can't be accessed via the management protocols. How can they be used?

-Ekr


>
>
> /martin
>