[nfsv4] Re: Our different approaches to draft POSIX ACL support in NFSv4

[Chuck Lever III <[e-mail]>]

> On Jul 22, 2024, at 7:13 PM, Rick Macklem <[e-mail]> wrote:
> 
> I just looked at opensolaris/usr/src/head/rpcsvc/nfs_acl.x
> which I think is the closest thing there is to a spec. for NFSACL.
> (FreeBSD does not implement this protocol and all I know about it
> is what this little .x file indicates.)

That's excellent, thanks for finding it.

My concern about this is that the cited .x file falls under
CDDL, and thus cannot be used directly by a GPL-encumbered
OS like Linux, nor can it be contributed to the IETF in its
current form.

This is clearly prior art.

My question then is whether we should endeavor to produce
an Informational document that describes NFSACL without
encumbrance -- ie, get Sun-Oracle to contribute that work
so that it might be used openly.


(I will also note that the cited XDR description appears
to use one or more XDR types that are not in the XDR
language description provided by RFC 4506 Section 6.)


> It appears to handle POSIX draft ACLs in a manner similar to
> what new POSIX draft ACL attributes would do.  The only difference
> appears to be that it provides a way for a client to query to
> find out how big the ACL list is without getting the actual ACL.
> (This could be done via additional new attributes, I think?)
> 
> Here's a snippet of nfs_acl.x that I found interesting...
> /*
>  * XXX {
>  * This is a transitional interface to enable Solaris NFSv4
>  * clients to manipulate ACLs on Solaris servers until the
>  * spec is complete enough to implement this inside the
>  * NFSv4 protocol itself.  NFSv4 does handle extended
>  * attributes in-band.
>  */
> 
> /*
>  * This is the definition for the GETACL procedure which applies
>  * to NFS Version 4 files.
>  */
> struct GETACL4args {
> nfs_fh4 fh;
> u_int mask;
> };
> 
> struct GETACL4resok {
> post_op_attr attr;
> secattr acl;
> };
> 
> struct GETACL4resfail {
> post_op_attr attr;
> };
> 
> union GETACL4res switch (nfsstat3 status) {
> case ACL4_OK:
> GETACL4resok resok;
> default:
> GETACL4resfail resfail;
> };
> 
> /*
>  * This is the definition for the SETACL procedure which applies
>  * to NFS Version 4 files.
>  */
> struct SETACL4args {
> nfs_fh4 fh;
> secattr acl;
> };
> 
> struct SETACL4resok {
> post_op_attr attr;
> };
> 
> struct SETACL4resfail {
> post_op_attr attr;
> };
> 
> I found the comment amusing.
> Note that "secattr" is the POSIX draft ACLs similar to what I
> proposed as new attributes for NFSv4.2.
> (The "mask" in the argument seems to indicate whether the client
> wants the count of entries in the ACL or the actual ACL.)
> 
> Note that there are basically identical definitions for NFSv2 and
> NFSv3, except for the nfs_fh version.
> 
> rick
> 
> 
> 
> --
> Chuck Lever


--
Chuck Lever