Re: [nfsv4] I-D ACTION:draft-ietf-nfsv4-acl-mapping-05.txt

On Wed, Aug 23, 2006 at 03:50:02PM -0400, Internet-Drafts@ietf.org wrote:
> 	Title		: Mapping Between NFSv4 and Posix Draft ACLs
> 	Author(s)	: M. Eriksen, J. Fields
> 	Filename	: draft-ietf-nfsv4-acl-mapping-05.txt
> 	Pages		: 20
> 	Date		: 2006-8-23

So the problem here has been that a server implementing this mapping is
so picky that a user *must* use a posix acl utility to set acls.  That
means we have to provide both posix and nfsv4 acl utilities and train
them to use one or the other depending on which server they're talking
to (or which filesystem them server is exporting).

In practice, since the posix acl utility will work (more or less) on
both, that means they'll probably just use it.  But this saddles all the
servers with weird requirements of the similarly picky client-side
mapping.

We're all working on implementing NFSv4 ACLs natively on our server
filesystems, which will solve the problem for new filesystems.

This draft solves the problem as completely as possible without
requiring a filesystem upgrade, by making a server exporting a posix-acl
filesystem support a much wider range of NFSv4 ACLs.

Changes to this draft:

	- sketches argument that the mapping actually takes any NFSv4
	  ACL to the unique POSIX ACL that is "closest" to the given NFSv4
	  ACL without being more permissive[1];
	- includes new description of the NFSv4->posix ACL mapping that
	  should be easier to implement from;
	- includes discussion of compatibility with old mapping, with a
	  brief description of the old mapping.

I've implemented the new NFSv4->posix mapping in the Linux server, and
could post some cleaned-up sample code at some point.

So the point of all this is that there's no longer any excuse for a
server (even one with backend posix acls) not to accept close to the
full range of NFSv4 ACLs.

--b.

[1]  Gory details: by the "closest" ACL we mean the most permissive ACL
that isn't more permissive than the given ACL.  The POSIX ACL is unique
only up to some choices of mask and inheritance flags.  Some ACLs (such
as acls with explicit denies of read_attributes, or that use unsupported
inheritance flags) may still have to be rejected.

_______________________________________________
nfsv4 mailing list
nfsv4@ietf.org
https://www1.ietf.org/mailman/listinfo/nfsv4