Re: [nfsv4] Going forward on the security document

[Rick Macklem <[e-mail]>]

On Fri, Feb 16, 2024 at 10:12 AM Brian Pawlowski <[e-mail]> wrote:
>
> Does this help Rick?
Good work. I looked months ago and couldn't find it.
I think it might be useful for David as he proceeds with an ACL document.

Thanks, rick

>
> https://www.illumos.org/opensolaris/ARChive/PSARC/2010/029/20100126_mark.shellenbaum
>
> On Thu, Feb 15, 2024 at 3:44 PM Rick Macklem <[e-mail]> wrote:
>>
>> On Thu, Feb 15, 2024 at 7:50 AM Rob Thurlow <[e-mail]> wrote:
>> >
>> > On 2/14/24 9:07 AM, David Noveck wrote:
>> >
>> > > As a result, the next draft of the security document,
>> > > draft-dnoveck-nfsv4-security-08, will limit the discussion of
>> > > acl-related issues by treating acls as an EXPERIMENTAL feature to be
>> > > described in a separate document.
>> >
>> > > We will be needing information about actual implementations of some of
>> > > the ACL extensions discussed in existing documents and have to be
>> > > prepared to simply drop material that was never implemented.
>> FreeBSD implements what was believed to be a RFC5661 compatible
>> implementation of NFSv4 ACLs, with the following limitation:
>> - Only Allow and Deny ACEs are handled (there is some code for Alert
>>   and Alarm in ZFS, but they are not recognized by the generic code).
>> - For ZFS, they are based on what was in OpenSolaris (FreeBSD now uses
>>   what is referred to as the OpenZFS code base, formerly called ZoL, but
>>   I do not think NFSv4 ACL semantics has changed from what OpenSolaris had.
>> - There is also an implementation for UFS (which also supports POSIX draft
>>   ACLs). A UFS volume needs to choose one or the other, as I understand it.
>> This document (which Rob might actually know where it can be found?) is
>> referred to for the mode->NFSv4 ACL translation.
>>
>>  * Calculate trivial ACL in a manner compatible with PSARC/2010/029.
>>  * Note that this results in an ACL different from (but semantically
>>  * equal to) the "canonical six" trivial ACL computed using algorithm
>>  * described in draft-ietf-nfsv4-minorversion1-03.txt, 3.16.6.2.
>> It would be really nice to find a copy of PSARC/2010/029?
>>
>> And this comment indicates how ZFS handles "delete". I have no idea who/what
>> generated the "recommendation"?
>>  * The following chart is the recommended NFSv4 enforcement for
>>  * ability to delete an object.
>>  *
>>  *      -------------------------------------------------------
>>  *      |   Parent Dir  |           Target Object Permissions |
>>  *      |  permissions  |                                     |
>>  *      -------------------------------------------------------
>>  *      |               | ACL Allows | ACL Denies| Delete     |
>>  *      |               |  Delete    |  Delete   | unspecified|
>>  *      -------------------------------------------------------
>>  *      |  ACL Allows   | Permit     | Permit    | Permit     |
>>  *      |  DELETE_CHILD |                                     |
>>  *      -------------------------------------------------------
>>  *      |  ACL Denies   | Permit     | Deny      | Deny       |
>>  *      |  DELETE_CHILD |            |           |            |
>>  *      -------------------------------------------------------
>>  *      | ACL specifies |            |           |            |
>>  *      | only allow    | Permit     | Permit    | Permit     |
>>  *      | write and     |            |           |            |
>>  *      | execute       |            |           |            |
>>  *      -------------------------------------------------------
>>  *      | ACL denies    |            |           |            |
>>  *      | write and     | Permit     | Deny      | Deny       |
>>  *      | execute       |            |           |            |
>>  *      -------------------------------------------------------
>>  *         ^
>>  *         |
>>  *         No search privilege, can't even look up file?
>>
>> Now, having said the above, I believe few (if anyone) uses the NFSv4
>> ACLs in FreeBSD.
>>
>> Since Linux does not support native NFSv4 ACLs (the translation algorithm
>> to/from POSIX draft ACLs is too obscure for me), I do not see how this will
>> ever be resolved?
>> - An extention to NFSv4.2 for getting/setting POSIX draft ACLs might help,
>>   but since ZFS does not support POSIX draft ACLs, it wouldn't be much
>>   help for FreeBSD.
>>
>> Off topic,but nice to hear from you Rob, it has been a while, rick
>>
>>
>> >
>> > I will attempt to describe what Solaris does for ACLs for this.
>> > It's going to take some time for me to get something useful.
>> > The top-level summary is that our ZFS ACL implementation, which
>> > our SMB implementation also uses, are strongly similar to what
>> > the NFSv4 spec details, while older filesystems like UFS use
>> > Posix-draft ACLs.
>> >
>> > Rob T
>> >
>> > _______________________________________________
>> > nfsv4 mailing list
>> > [e-mail]
>> > https://www.ietf.org/mailman/listinfo/nfsv4
>>
>> _______________________________________________
>> nfsv4 mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/nfsv4