Re: [nfsv4] Eric Rescorla's Discuss on draft-ietf-nfsv4-xattrs-05: (with DISCUSS)

[Eric Rescorla <[e-mail]>]

On Thu, May 25, 2017 at 9:19 PM, Spencer Dawkins at IETF <
[e-mail]> wrote:

> Hi, Eric,
>
> On Tue, May 23, 2017 at 9:30 PM, Eric Rescorla <[e-mail]> wrote:
>
>> Eric Rescorla has entered the following ballot position for
>> draft-ietf-nfsv4-xattrs-05: Discuss
>>
>> When responding, please keep the subject line intact and reply to all
>> email addresses included in the To and CC lines. (Feel free to cut this
>> introductory paragraph, however.)
>>
>>
>> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
>> for more information about IESG DISCUSS and COMMENT positions.
>>
>>
>> The document, along with other ballot positions, can be found here:
>> https://datatracker.ietf.org/doc/draft-ietf-nfsv4-xattrs/
>>
>>
>>
>> ----------------------------------------------------------------------
>> DISCUSS:
>> ----------------------------------------------------------------------
>>
>>       Since xattrs are application data, security issues are exactly
>> the
>>       same as those relating to the storing of file data and named
>>       attributes.  These are all various sorts of application data and
>>       the fact that the means of reference is slightly different in
>> each
>>       case should not be considered security-relevant.  As such, the
>>       additions to the NFS protocol for supporting extended attributes
>>       do not alter the security considerations of the NFSv4.2 protocol
>>       [RFC7862].
>>
>> This seems inadequate. The issue is that if machine A writes some
>> extended attribute which is security relevant (i.e., this file is
>> only readable under certain conditions) and then machine B doesn't
>> know about the attribute, then you have a security problem on B
>> because it will not enforce it. It seems like FreeBSD uses extended
>> attributes for this purpose, so this isn't just theoretical.
>
>
> I haven't seen a response from the authors on this Discuss, so, at the
> risk of talking out of my hat, I THINK the answer is going to be that
>
>    - either machine B keeps enforcing the incredibly lame access rights
>    it's already enforcing (all users are part of the "nfs" group, so share the
>    same access rights anyway, or whatever), or
>    - machine B isn't enforcing anything now, so wouldn't be enforcing
>    anything anyway.
>
>
I think that's right.


>
>    -
>
> So, at a minimum, this extension would Do No Harm during periods of
> partial deployment.
>

This, I don't agree with, because once this capability exists, people come
to rely on it.

-Ekr


> My advice is to wait for a response from a smarter Spencer (S), or another
> person who knows more about NFSv4 than I do, who will either confirm what
> I'm saying or tell you what I should have said instead, but if it's worth
> having a speculative discussion on the call today, I'm always up for that,
> of course.
>
> Spencer
>