[nfsv4] Re: RFC: atomically acquiring some attributes for the posix-acls extension

[Rick Macklem <[e-mail]>]

On Thu, Aug 8, 2024 at 2:52 PM Mark Liam Brown <[e-mail]>
wrote:

> On Thu, Aug 8, 2024 at 10:15 PM Rick Macklem <[e-mail]>
> wrote:
> >
> > Hi,
> >
> > As some will already know, I am working on a draft that
> > proposes an extension to 4.2 related to POSIX ACLs which
> > adds 4 new attributes.
> >
> > I have run into a case where specifying the GETATTR return
> > some ACL related attributes "atomically". By atomically, I
> > mean that no SETATTR by another client is permitted to change
> > any on the attributes during the GETATTR.
> >
> > Some background:
> > true form - Is the kind of ACL stored on the file object and
> >             used for access permissions. A new attribute called
> >             acl_trueform indicates what the true form is.
> >             It can be ACL_MODEL_NFS4, ACL_MODEL_POSIX_DRAFT or
> >             ACL_MODEL_NONE.
>
> Stop.
>
> 1. POSIX.1e has been withdrawn, including POSIX.1e ACLs. One of the
> reasons were security issues
>
I have not heard comments w.r.t. security issues for POSIX 1003.1e
draft 17 ACLs. Yes, the draft was withdrawn, but it covered a lot
of other things and not just ACLs.

Linux, FreeBSD, Solaris and IBM's GPFS have adopted them, although
some of these also support NFSv4 ACLs.


> 2. POSIX.1e ACLs are only usable on Linux or POSIX-like platforms.
> They are INCOMPATIBLE to Windows, ZFS and NFSv4 ACLs, and there are no
> proper or safe translations between them - you lose information when
> going from NFSv4, ZFS or Windows ACLs, and the reverse translation
> either causes inaccessible files if the translation is too
> restrictive, or opens gaping security holes if the translations allows
> more than the admin intended.
>
You might want to read the draft.
 https://datatracker.ietf.org/doc/draft-rmacklem-nfsv4-posix-acls/
The idea behind the draft is to avoid the translations (I tend to
call mapping.)


> Better would be for Linux finally to adopt NFSv4/ZFS-style ACLs, and
> not cause security nightmares via grafting defunct POSIX.1e ACLs onto
> everything.
>
Well, I'm the FreeBSD NFS guy, so I wouldn't argue with you.
However, my impression is that Linux (and some others) are
going to use POSIX draft ACLs for a long time?

rick

>
> Mark
> --
> IT Infrastructure Consultant
> Windows, Linux
>