[nfsv4] Re: RFC: atomically acquiring some attributes for the posix-acls extension

[Mark Liam Brown <[e-mail]>]

On Thu, Aug 8, 2024 at 10:15 PM Rick Macklem <[e-mail]> wrote:
>
> Hi,
>
> As some will already know, I am working on a draft that
> proposes an extension to 4.2 related to POSIX ACLs which
> adds 4 new attributes.
>
> I have run into a case where specifying the GETATTR return
> some ACL related attributes "atomically". By atomically, I
> mean that no SETATTR by another client is permitted to change
> any on the attributes during the GETATTR.
>
> Some background:
> true form - Is the kind of ACL stored on the file object and
>             used for access permissions. A new attribute called
>             acl_trueform indicates what the true form is.
>             It can be ACL_MODEL_NFS4, ACL_MODEL_POSIX_DRAFT or
>             ACL_MODEL_NONE.

Stop.

1. POSIX.1e has been withdrawn, including POSIX.1e ACLs. One of the
reasons were security issues

2. POSIX.1e ACLs are only usable on Linux or POSIX-like platforms.
They are INCOMPATIBLE to Windows, ZFS and NFSv4 ACLs, and there are no
proper or safe translations between them - you lose information when
going from NFSv4, ZFS or Windows ACLs, and the reverse translation
either causes inaccessible files if the translation is too
restrictive, or opens gaping security holes if the translations allows
more than the admin intended.

Better would be for Linux finally to adopt NFSv4/ZFS-style ACLs, and
not cause security nightmares via grafting defunct POSIX.1e ACLs onto
everything.

Mark
-- 
IT Infrastructure Consultant
Windows, Linux