Re: [nfsv4] Review of http://www.ietf.org/id/draft-naik-nfsv4-xattrs-01.txt

[Nico Williams <[e-mail]>]

On Wed, Oct 08, 2014 at 09:21:22AM -0400, David Quigley wrote:
> On 10/03/2014 15:20, Nico Williams wrote:
> >Here I agree with you that the I-D must explain how the server helps
> >mediate access control.  And it must explain that some xattrs have
> >security-relevant semantics.  But that's as far as an NFSv4
> >specification can go here.
> 
> I think that the xattrs exposed through this shouldn't be
> security-relevant unless you're talking about application layer
> security. [...]

I agree with you, but system security-relevant xattrs is a ship that has
sailed.  Perhaps NFSv4 should just not transport them, but I think
that's probably not useful enough.  The really important thing is to
decide when a client is sufficiently privileged, and for that you need
something like RPCSEC_GSSv3 (that allows you to authenticate a client
and a user together and allows the client to make assertions about local
privilege that the server can then decide how much to reduce -- or even
to reject completely, of course).

>                                                       [...]. I agree
> that this is a problem because it opens up the system to
> interoperability issues by encouraging people to bypass any sort of
> standardization effort and just using the excuse that its just
> opaque data.

I agree that non-standardized conventions make xattrs _dangerous_.
Fortunately there appear to be naming conventions that we could
encourage the standardization of, and maybe that will be enough.

> >LNFS seems orthogonal here.  RPCSEC_GSSv3 is more relevant.
> 
> I agree. LNFS is just another way of conveying access control and
> because we punted on syntax, semantics and enforcement I think the
> only references to access control should be what is concretely
> defined in NFSv4. In that case it would be existing RPCSEC_GSS
> flavors for authentication and NFSv4 ACLs.

Right, except that xattrs have no ACLs as such.  (We could codify the
naming conventions and express their associated access controls
synthetically with NFSv4 ACLs...  But note that still, when a filesystem
says that you need "root" privilege (or similar), the context is local
access, and extending such notions of privilege to the network requires
something like RPCSEC_GSSv3.

Nico
--