Re: [nfsv4] Eric Rescorla's Discuss on draft-ietf-nfsv4-xattrs-05: (with DISCUSS)

[Spencer Dawkins at IETF <[e-mail]>]

Hi, Eric,

On Tue, May 23, 2017 at 9:30 PM, Eric Rescorla <[e-mail]> wrote:

> Eric Rescorla has entered the following ballot position for
> draft-ietf-nfsv4-xattrs-05: Discuss
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-nfsv4-xattrs/
>
>
>
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
>
>       Since xattrs are application data, security issues are exactly
> the
>       same as those relating to the storing of file data and named
>       attributes.  These are all various sorts of application data and
>       the fact that the means of reference is slightly different in
> each
>       case should not be considered security-relevant.  As such, the
>       additions to the NFS protocol for supporting extended attributes
>       do not alter the security considerations of the NFSv4.2 protocol
>       [RFC7862].
>
> This seems inadequate. The issue is that if machine A writes some
> extended attribute which is security relevant (i.e., this file is
> only readable under certain conditions) and then machine B doesn't
> know about the attribute, then you have a security problem on B
> because it will not enforce it. It seems like FreeBSD uses extended
> attributes for this purpose, so this isn't just theoretical.


I haven't seen a response from the authors on this Discuss, so, at the risk
of talking out of my hat, I THINK the answer is going to be that

   - either machine B keeps enforcing the incredibly lame access rights
   it's already enforcing (all users are part of the "nfs" group, so share the
   same access rights anyway, or whatever), or
   - machine B isn't enforcing anything now, so wouldn't be enforcing
   anything anyway.

So, at a minimum, this extension would Do No Harm during periods of partial
deployment.

My advice is to wait for a response from a smarter Spencer (S), or another
person who knows more about NFSv4 than I do, who will either confirm what
I'm saying or tell you what I should have said instead, but if it's worth
having a speculative discussion on the call today, I'm always up for that,
of course.

Spencer