Re: [nfsv4] Fwd: New Version Notification for draft-dnoveck-nfsv4-acls-00.txt

I may have missed it since it is a large document, but
I think there is one specific case for NFSv4.1/4.2 that
needs to be addressed.

RFC8881 specifies that integrity of privacy is required
for SP4_MACH_CRED.
I think the RPC/transport layer privacy protection, such
as that provided by RPC-with-TLS should now be considered
sufficient to satisfy this requirement. (ie, integrity or privacy or
RPC/transport layer privacy should be required)

rick

On Mon, Mar 4, 2024 at 5:28 AM David Noveck <davenoveck@gmail.com> wrote:
>
> This was also submitted in time.  To get it in by the deadline, left some gaps that will be corerected in -01. Will discuss  at IETF119.
>
> ---------- Forwarded message ---------
> From: <internet-drafts@ietf.org>
> Date: Thu, Feb 29, 2024 at 8:33 AM
> Subject: New Version Notification for draft-dnoveck-nfsv4-acls-00.txt
> To: David Noveck <davenoveck@gmail.com>
>
>
> A new version of Internet-Draft draft-dnoveck-nfsv4-acls-00.txt has been
> successfully submitted by David Noveck and posted to the
> IETF repository.
>
> Name:     draft-dnoveck-nfsv4-acls
> Revision: 00
> Title:    ACLs within the NFSv4 Protocols
> Date:     2024-02-29
> Group:    Individual Submission
> Pages:    75
> URL:      https://www.ietf.org/archive/id/draft-dnoveck-nfsv4-acls-00.txt
> Status:   https://datatracker.ietf.org/doc/draft-dnoveck-nfsv4-acls/
> HTML:     https://www.ietf.org/archive/id/draft-dnoveck-nfsv4-acls-00.html
> HTMLized: https://datatracker.ietf.org/doc/html/draft-dnoveck-nfsv4-acls
>
>
> Abstract:
>
>    This document describes the structure of NFSv4 ACLs and their role in
>    the NFSv4 security architecture.  While their role in providing a
>    more flexible approach to file access authorization than is made
>    available by the POSIX-derived authorization-related attributes, the
>    potential provision of other security-related functionality is
>    covered as well.
>
>    While the goals of the description are similar to that used in
>    previous specficaion, the approach taken is substantally different,
>    in that a core set of functionality, derived form the the now-
>    withdrawn POSIX draft ACLs is the conceptual base of the feature set
>    while extensions to that functionality are made available as OPTIONAL
>    extensions to that core.
>
>    The current version of the document is intended, in large part, to
>    result in working group discussion regarding existing NFSv4 security
>    issues and to provide a framework for addressing these issues and
>    obtaining working group consensus regarding necessary changes.
>
>    When the resulting document is eventually published as an RFC, it
>    will supersede the descriptions of ACL structure and semantics
>    appearing in existing minor version specification documents such as
>    RFCs 7530 and 8881, thereby updating RFC7530 and RFC8881.
>
>
>
> The IETF Secretariat
>
>
> _______________________________________________
> nfsv4 mailing list
> nfsv4@ietf.org
> https://www.ietf.org/mailman/listinfo/nfsv4