Re: [nfsv4] Fwd: New Version Notification for draft-dnoveck-nfsv4-security-04.txt

[Rick Macklem <[e-mail]>]

J. Bruce Fields wrote:
> Rick Macklem wrote:
[stuff snipped]
> >
> > On the PSARC/2010/029 document:
> > - The author of the FreeBSD NFSv4 ACL code no longer has a copy, either.
> >    However, he recalls the main item in it was an alternate algorithm for
> >    converting mode->ACL. The "canonical six" upset Windows, because it
> >    mixes allow/deny ACEs and apparently Windows likes all the Allow ACEs
> >    to preceed all the Deny ACEs.
>
> It's the other way around.  Googling....:
>
>        https://docs.microsoft.com/en-us/windows/win32/secauthz/order-of-aces-in-a-dacl
>
> >    - This alternate algorithm creates a set of Allow ACEs followed by a set of
> >       Deny ACEs that are semnatically equivalent to the "canonical six".
>
> So, we put Deny ACEs before Allow whenever possible.  Or, better yet,
> just leave them out.
>
> In theory Windows allows both but I'm told various tools complain if
> your ACLs are weird.
Oops, my mistake.
This algorithm only generates Allow ACEs for simple cases like
# chmod 664
but for
# chmod 646
it generates

owner@:write/append Allow
group@:write/append Deny
owner@:read/write/append + a bunch more Allow
group@read + read acl Allow
everyone@:read/write/append + read acl Allow

So it puts the Deny before the Allow for any given "who".

rick

--b.