Re: [nfsv4] Fwd: New Version Notification for draft-dnoveck-nfsv4-security-04.txt

[[e-mail]]

On Sat, Jan 08, 2022 at 04:41:03PM +0000, Rick Macklem wrote:
> David Noveck wrote:
> [> Rick Macklem wrote:
> [stuff snipped]
> > > Why?
> > > Well, my understanding is that APPEND_DATA does not apply to
> > > any old Write that happens to start at EOF, but specifically "append-only"
> >
> > The spec says the contrary.  since there are no NFSv4 append-only operations it
> > would not make sense to revise it in line with your understanding.
> Ok, yes. I found a Microsoft document that states APPEND_DATA allows writes
> that start at EOF.
> 
> But what about:
> - Setattr of size, where this size is beyond EOF.
>   (Not covered by APPEND_DATA, so presumably allowed/denied via
>    WRITE_DATA.)
> - A Write with an offset > size (ie past EOF).
>   (Also allowed/denied via WRITE_DATA.)
> 
> So, does WRITE_DATA being set without APPEND_DATA being set make
> sense. Not really, but it is allowed by the RFCs, as far as I can see?
> It just makes no sense to allow a Write that starts beyond EOF, but not
> one that starts at EOF.
> 
> So, I understand your position, but I believe (it is not up to me), that
> FreeBSD's NFSv4 server will simply choose to continue to ignore APPEND_DATA.
> 
> On the PSARC/2010/029 document:
> - The author of the FreeBSD NFSv4 ACL code no longer has a copy, either.
>    However, he recalls the main item in it was an alternate algorithm for
>    converting mode->ACL. The "canonical six" upset Windows, because it
>    mixes allow/deny ACEs and apparently Windows likes all the Allow ACEs
>    to preceed all the Deny ACEs.

It's the other way around.  Googling....:

	https://docs.microsoft.com/en-us/windows/win32/secauthz/order-of-aces-in-a-dacl

>    - This alternate algorithm creates a set of Allow ACEs followed by a set of
>       Deny ACEs that are semnatically equivalent to the "canonical six".

So, we put Deny ACEs before Allow whenever possible.  Or, better yet,
just leave them out.

In theory Windows allows both but I'm told various tools complain if
your ACLs are weird.

--b.