Re: [nfsv4] Going forward on the security document

[Brian Pawlowski <[e-mail]>]

Does this help Rick?

https://www.illumos.org/opensolaris/ARChive/PSARC/2010/029/20100126_mark.shellenbaum

On Thu, Feb 15, 2024 at 3:44 PM Rick Macklem <[e-mail]> wrote:

> On Thu, Feb 15, 2024 at 7:50 AM Rob Thurlow <[e-mail]>
> wrote:
> >
> > On 2/14/24 9:07 AM, David Noveck wrote:
> >
> > > As a result, the next draft of the security document,
> > > draft-dnoveck-nfsv4-security-08, will limit the discussion of
> > > acl-related issues by treating acls as an EXPERIMENTAL feature to be
> > > described in a separate document.
> >
> > > We will be needing information about actual implementations of some of
> > > the ACL extensions discussed in existing documents and have to be
> > > prepared to simply drop material that was never implemented.
> FreeBSD implements what was believed to be a RFC5661 compatible
> implementation of NFSv4 ACLs, with the following limitation:
> - Only Allow and Deny ACEs are handled (there is some code for Alert
>   and Alarm in ZFS, but they are not recognized by the generic code).
> - For ZFS, they are based on what was in OpenSolaris (FreeBSD now uses
>   what is referred to as the OpenZFS code base, formerly called ZoL, but
>   I do not think NFSv4 ACL semantics has changed from what OpenSolaris had.
> - There is also an implementation for UFS (which also supports POSIX draft
>   ACLs). A UFS volume needs to choose one or the other, as I understand it.
> This document (which Rob might actually know where it can be found?) is
> referred to for the mode->NFSv4 ACL translation.
>
>  * Calculate trivial ACL in a manner compatible with PSARC/2010/029.
>  * Note that this results in an ACL different from (but semantically
>  * equal to) the "canonical six" trivial ACL computed using algorithm
>  * described in draft-ietf-nfsv4-minorversion1-03.txt, 3.16.6.2.
> It would be really nice to find a copy of PSARC/2010/029?
>
> And this comment indicates how ZFS handles "delete". I have no idea
> who/what
> generated the "recommendation"?
>  * The following chart is the recommended NFSv4 enforcement for
>  * ability to delete an object.
>  *
>  *      -------------------------------------------------------
>  *      |   Parent Dir  |           Target Object Permissions |
>  *      |  permissions  |                                     |
>  *      -------------------------------------------------------
>  *      |               | ACL Allows | ACL Denies| Delete     |
>  *      |               |  Delete    |  Delete   | unspecified|
>  *      -------------------------------------------------------
>  *      |  ACL Allows   | Permit     | Permit    | Permit     |
>  *      |  DELETE_CHILD |                                     |
>  *      -------------------------------------------------------
>  *      |  ACL Denies   | Permit     | Deny      | Deny       |
>  *      |  DELETE_CHILD |            |           |            |
>  *      -------------------------------------------------------
>  *      | ACL specifies |            |           |            |
>  *      | only allow    | Permit     | Permit    | Permit     |
>  *      | write and     |            |           |            |
>  *      | execute       |            |           |            |
>  *      -------------------------------------------------------
>  *      | ACL denies    |            |           |            |
>  *      | write and     | Permit     | Deny      | Deny       |
>  *      | execute       |            |           |            |
>  *      -------------------------------------------------------
>  *         ^
>  *         |
>  *         No search privilege, can't even look up file?
>
> Now, having said the above, I believe few (if anyone) uses the NFSv4
> ACLs in FreeBSD.
>
> Since Linux does not support native NFSv4 ACLs (the translation algorithm
> to/from POSIX draft ACLs is too obscure for me), I do not see how this will
> ever be resolved?
> - An extention to NFSv4.2 for getting/setting POSIX draft ACLs might help,
>   but since ZFS does not support POSIX draft ACLs, it wouldn't be much
>   help for FreeBSD.
>
> Off topic,but nice to hear from you Rob, it has been a while, rick
>
>
> >
> > I will attempt to describe what Solaris does for ACLs for this.
> > It's going to take some time for me to get something useful.
> > The top-level summary is that our ZFS ACL implementation, which
> > our SMB implementation also uses, are strongly similar to what
> > the NFSv4 spec details, while older filesystems like UFS use
> > Posix-draft ACLs.
> >
> > Rob T
> >
> > _______________________________________________
> > nfsv4 mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/nfsv4
>
> _______________________________________________
> nfsv4 mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/nfsv4
>