[nfsv4] Re: Our different approaches to draft POSIX ACL support in NFSv4

[David Noveck <[e-mail]>]

On Friday, July 26, 2024, Rick Macklem <[e-mail]> wrote:

>
>
> On Thu, Jul 25, 2024 at 12:36 PM David Noveck <[e-mail]>
> wrote:
>
>>
>>
>> On Thursday, July 25, 2024, Chuck Lever III <[e-mail]>
>> wrote:
>>
>>>
>>>
>>> > On Jul 25, 2024, at 9:44 AM, Rick Macklem <[e-mail]>
>>> wrote:
>>> >
>>> > Christoph pointed out to me that having multiple ACLs on a file is not
>>> > reasonable.  The draft I am writing will require a server to only
>>> support
>>> > one ACL model/file. (I think it needs to be a server choice and could
>>> be
>>> > indicated to the client by which attributes are supported for the
>>> fiile.
>>> > (This is related to the last point.  I'll leave the rest for others.)
>>>
>>> I agree there should be one per file,
>>
>>
>> Definitely.
>>
>>>
>>> and that the server's
>>> local file system should determine which type of ACL it can
>>> support.
>>
>>
>> I would think it determines the set of types  it  an support.  This can
>> be ofen will be a singleton or the null set.
>>
>> (I don't envision a scenario where one file system
>>> could support multiple types of ACLs).
>>
>>
>> I consider it unfortunate that your vision is so limited.
>>
>> I expect to face the issue in the near future since Netapp supports a
>> considerable portion of the NFSv4 ACL model and will want to support the
>> draft POSIX ACL.
>>
>> I don't think it is reasonable to tell users that they have to get rid of
>> their existing ACLs in order to allow them to use draft POSIX ACLs.
>>
> If you are referring to the granularity of whether a
> NFSv4 ACL or POSIX draft ACL is applied, I do not see
> a problem with "per file" granularity, which is what I
> had planned for the draft I am writing (in progress).
> (My limited vision comes from the fact that FreeBSD uses
> a "per file system" mount option to define which ACL model
> is used.)
>
> However, if you are suggestion that a file object could
> have both a NFSv4 ACL and a POSIX draft ACL, then I do
> envision problems.
>

I see problems also, and having two different ACls controlling
authorization is not needed or wanted.

However, I think we can see a sacl and a dacl  together and the dacl could
be replaced by a draft POSIX ACL.

I would also see the case of setting a draft POSIX ACL and being able to
interrogate using multiple attributes.  This might look to some as if there
were two ACLs but in reality there would be only one.  I discuss the
details in Appendix C of acls-05, coming to the data tracker in the next
few weeks.

-> How would the server check access?

>     - By checking both ACLs and only allow access if both
>       ACLs allowed access?
>       --> That would cause confusion for users on clients
>           that only see one of the ACLs, when the ACL the
>           client sees allows access, but the server replies
>           NFS4ERR_ACCES, since the other ACL does not allow
>           access.
>
> rick
>
>
>
>>
>>
>>>
>>> > It would be nice if, somehow, the Linux folk could determine how often
>>> > the mapped NFSv4 ACLs are used on the Linux NFSv4 servers?
>>>
>>> As far as I am aware, NFSD does not use mapped ACLs, but I
>>> haven't done an in-depth look.
>>>
>>>
>>> --
>>> Chuck Lever
>>>
>>>
>>>