Re: [nfsv4] Going forward on the security document

[Rick Macklem <[e-mail]>]

On Thu, Feb 15, 2024 at 7:50 AM Rob Thurlow <[e-mail]> wrote:
>
> On 2/14/24 9:07 AM, David Noveck wrote:
>
> > As a result, the next draft of the security document,
> > draft-dnoveck-nfsv4-security-08, will limit the discussion of
> > acl-related issues by treating acls as an EXPERIMENTAL feature to be
> > described in a separate document.
>
> > We will be needing information about actual implementations of some of
> > the ACL extensions discussed in existing documents and have to be
> > prepared to simply drop material that was never implemented.
FreeBSD implements what was believed to be a RFC5661 compatible
implementation of NFSv4 ACLs, with the following limitation:
- Only Allow and Deny ACEs are handled (there is some code for Alert
  and Alarm in ZFS, but they are not recognized by the generic code).
- For ZFS, they are based on what was in OpenSolaris (FreeBSD now uses
  what is referred to as the OpenZFS code base, formerly called ZoL, but
  I do not think NFSv4 ACL semantics has changed from what OpenSolaris had.
- There is also an implementation for UFS (which also supports POSIX draft
  ACLs). A UFS volume needs to choose one or the other, as I understand it.
This document (which Rob might actually know where it can be found?) is
referred to for the mode->NFSv4 ACL translation.

 * Calculate trivial ACL in a manner compatible with PSARC/2010/029.
 * Note that this results in an ACL different from (but semantically
 * equal to) the "canonical six" trivial ACL computed using algorithm
 * described in draft-ietf-nfsv4-minorversion1-03.txt, 3.16.6.2.
It would be really nice to find a copy of PSARC/2010/029?

And this comment indicates how ZFS handles "delete". I have no idea who/what
generated the "recommendation"?
 * The following chart is the recommended NFSv4 enforcement for
 * ability to delete an object.
 *
 *      -------------------------------------------------------
 *      |   Parent Dir  |           Target Object Permissions |
 *      |  permissions  |                                     |
 *      -------------------------------------------------------
 *      |               | ACL Allows | ACL Denies| Delete     |
 *      |               |  Delete    |  Delete   | unspecified|
 *      -------------------------------------------------------
 *      |  ACL Allows   | Permit     | Permit    | Permit     |
 *      |  DELETE_CHILD |                                     |
 *      -------------------------------------------------------
 *      |  ACL Denies   | Permit     | Deny      | Deny       |
 *      |  DELETE_CHILD |            |           |            |
 *      -------------------------------------------------------
 *      | ACL specifies |            |           |            |
 *      | only allow    | Permit     | Permit    | Permit     |
 *      | write and     |            |           |            |
 *      | execute       |            |           |            |
 *      -------------------------------------------------------
 *      | ACL denies    |            |           |            |
 *      | write and     | Permit     | Deny      | Deny       |
 *      | execute       |            |           |            |
 *      -------------------------------------------------------
 *         ^
 *         |
 *         No search privilege, can't even look up file?

Now, having said the above, I believe few (if anyone) uses the NFSv4
ACLs in FreeBSD.

Since Linux does not support native NFSv4 ACLs (the translation algorithm
to/from POSIX draft ACLs is too obscure for me), I do not see how this will
ever be resolved?
- An extention to NFSv4.2 for getting/setting POSIX draft ACLs might help,
  but since ZFS does not support POSIX draft ACLs, it wouldn't be much
  help for FreeBSD.

Off topic,but nice to hear from you Rob, it has been a while, rick


>
> I will attempt to describe what Solaris does for ACLs for this.
> It's going to take some time for me to get something useful.
> The top-level summary is that our ZFS ACL implementation, which
> our SMB implementation also uses, are strongly similar to what
> the NFSv4 spec details, while older filesystems like UFS use
> Posix-draft ACLs.
>
> Rob T
>
> _______________________________________________
> nfsv4 mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/nfsv4