[nfsv4] Re: RFC: atomically acquiring some attributes for the posix-acls extension

[David Noveck <[e-mail]>]

On Thu, Aug 8, 2024, 5:54 PM Mark Liam Brown <[e-mail]>
wrote:

> On Thu, Aug 8, 2024 at 10:15 PM Rick Macklem <[e-mail]>
> wrote:
> >
> > Hi,
> >
> > As some will already know, I am working on a draft that
> > proposes an extension to 4.2 related to POSIX ACLs which
> > adds 4 new attributes.
> >
> > I have run into a case where specifying the GETATTR return
> > some ACL related attributes "atomically". By atomically, I
> > mean that no SETATTR by another client is permitted to change
> > any on the attributes during the GETATTR.
> >
> > Some background:
> > true form - Is the kind of ACL stored on the file object and
> >             used for access permissions. A new attribute called
> >             acl_trueform indicates what the true form is.
> >             It can be ACL_MODEL_NFS4, ACL_MODEL_POSIX_DRAFT or
> >             ACL_MODEL_NONE.
>
> Stop.
>
> 1. POSIX.1e has been withdrawn, including POSIX.1e ACLs. One of the
> reasons were security issues
>

Could you be more specific?


> 2. POSIX.1e ACLs are only usable on Linux or POSIX-like platforms.
> They are INCOMPATIBLE to Windows, ZFS and NFSv4 ACLs, and there are no
> proper or safe translations between them - you lose information when
> going from NFSv4, ZFS or Windows ACLs, and the reverse translation
> either causes inaccessible files if the translation is too
> restrictive, or opens gaping security holes if the translations allows
> more than the admin intended.
>
> Better would be for Linux finally to adopt NFSv4/ZFS-style ACLs, and
> not cause security nightmares via grafting defunct POSIX.1e ACLs onto
> everything.
>

Whether that is true is not a decision for the working group to make.  Over
the last two decades  the current  NFSv4 ACL model has been the only one
supported and Linux has  chosen  not adopt that model.   Whatever you think
of that model, Linux has  not chosen to adopt it  and there are no
prospects of it doing so in the foreseeable future.

Rick's proposal would allow them to switch over in an incremental way by
allowing transition  between the two models  by supporting both models at
first (unlikely for decades) and eventual support of only the NFSv4 model
or its successor (maybe in the 22nd century).


> Mark
> --
> IT Infrastructure Consultant
> Windows, Linux
>
> _______________________________________________
> nfsv4 mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>