Re: [nfsv4] draft-quigley-nfsv4-labeled-00 - some comments

[Nico Williams <[e-mail]>]

On Thu, Apr 7, 2011 at 11:44 AM, Thomas Haynes <[e-mail]> wrote:
> On Apr 7, 2011, at 10:50 AM, Nico Williams wrote:
>> No, that a user, "joe", on a multi-user client could see an entry
>> named "Covert operations in Foobania.doc" that he was not allowed to
>> see but that another user, "jane", on that client was allowed to see.
>> Conversely, if "joe" was first to readdir that directory then "jane"
>> won't see that directory entry whereas she should.
>>
>> The simplest fix is to say that all names in a given directory have
>> the same label as the directory itself, even though the named objects
>> themselves might have different labels.
>
> But that allows Jane to deduce there were covert operations in Foobania.
> She might even be able to see the date and based on the size, deduce
> how many operations or how large of an operation it was.

Not so.  The classification officer might move or create that document
in a sub-directory with a harmless name.  Of course, if one were to do
that one might as well rely on the Solaris TX approach of mapping
paths to labels...

> If the client is MAC aware, then I would argue that it needs to maintain
> separate name spaces for all users. If the client is non-MAC aware, then
> it has to consistently get the minimum label afforded to it.

That's one approach, yes.

> I.e., the MAC aware server has to assume that the aware client can safely
> hand out directory entries based on labels, but it also has to assume that
> the non-aware client cannot mix and match different labels.

I'd rather the server make authorization decisions based on labels.
Consider Smack... the server might have policies that the client
doesn't, so I'd want the client to call ACCESS for all distinct
process credentials trying to access an object.

Nico
--