[nfsv4] yet more on delayed writes

[William A.(Andy) Adamson wrote]
> wait a minute: for #3 to happen, the file permissions have to allow the user 
> nfs/host1@KERBEROS.REALM to write. are you proposing that machine creds have 
> acl's in exported filesystems?

I'm wasn't proposing machine creds in acl's (although that's an interesting
idea). I took a quick look at the section on the WriteOp (14.2.36)
and didn't spot any statement that the server was required to check for
file permissions when a WriteOp is performed. (Most will, because they
don't trust the cred. enough to accept the related Open or Write Delegation
as sufficient. Local POSIX file access doesn't check file protection
on every write, so it seems to me a V4 server doesn't have to, if it can
trust the cred enough to believe the Write is associated with the
Open or Write Delegation related to it by the stateid.)

However, it sounds like the consensus is that that is too much trust,
at least for most cases.

Anyhow, just a thought, rick

_______________________________________________
nfsv4 mailing list
nfsv4@ietf.org
https://www1.ietf.org/mailman/listinfo/nfsv4