Re: [nfsv4] WG last call complete for Requirements for Labeled NFS (still needs review)

Tom, Spencer,

The document is in pretty good shape. My review comments and questions 
are as follows:

1. Section 3.3 list the following Security Services:
- Authentication
- Integrity
- Privacy

I'd expect Confidentiality be listed as well, as many MAC systems do 
provide confidentiality. Is Privacy used here to mean Confidentiality?

2. Through out the document, "local server policy" and "local client 
policy" are used. It may be better to eliminate the word "local" and 
just use "server policy" and "client policy". Server and client policies 
may not be strictly "local" as the policies can reside in a centralized, 
networked database, which could make policy configuration and 
administration easier.

3. Section 3.4,
In "If the LFS of a system changes", it's probably more clear to state 
"If the LFS supported on a system changes".
An LFS, i.e. the label format mapping, probably won't change. A system 
may be reconfigured to support more or less LFSs.

4. Section 3.6,
    The content of the paragraph seems to suggest that the section title 
should be "Label Checking" instead of "Labeling".

5. Section 3.9,
The example usage of LFS here is incorrect. LFS indicates what label 
format is used and how labels should be interpreted. It is not meant to 
be used to indicate server capability or its smartness in handling 
labels, such as "I'm only capable of storing and returning labels".

6. Section 4.2,
double word "able to to protect".

7. Section 4.5,
The reference to case (a) should be removed.

8. The draft referenced by this doc, "Registry Specification for MAC 
Security Label Formats", just expired. David Q and I should move that 
draft forward.

Thanks.

- Jarrett

On 04/30/12 12:43 PM, Spencer Shepler wrote:
> Thanks, Jarrett and Dave.  Please go ahead with the review and let me know when you are finished.
>
> I would like to have one more volunteer that has been at least once removed from the material for a read of flow of the document and to see if there are any "missing"pieces.
>
> Volunteers?
>
> Spencer
>
> -----Original Message-----
> From: nfsv4-bounces@ietf.org [mailto:nfsv4-bounces@ietf.org] On Behalf Of Jarrett Lu
> Sent: Monday, April 30, 2012 6:15 AM
> To: Dave Quigley
> Cc: nfsv4@ietf.org
> Subject: Re: [nfsv4] WG last call complete for Requirements for Labeled NFS (still needs review)
>
>
> On Apr 30, 2012, at 5:13 AM, Dave Quigley<dpquigl@davequigley.com>  wrote:
>
>> On 4/30/2012 2:55 AM, Spencer Shepler wrote:
>>> We have completed the last call for the Labeled NFS.
>>>
>>> While this is a short document and certainly has had a lot of
>>> feedback over its lifetime, I do not believe this particular version
>>> is ready to forward to our AD.
>>>
>>> I need to have at least two reviewers for this version before I will
>>> shepherd it forward. Given this is a requirements document and it
>>> deals with security and it is providing a path for our NFSv4.2 work,
>>> I want it to be ready for the broader IESG review.
>>>
>>> Thanks in advance for the help.
>>>
>>> Spencer
>>>
>>>
>>>
>>> _______________________________________________
>>> nfsv4 mailing list
>>> nfsv4@ietf.org
>>> https://www.ietf.org/mailman/listinfo/nfsv4
>> Does this have to be revewiers besides myself? I can be one of them and we've had a review from Casey Schaufler on the SELinux list that I had forgotten to forward over here. If you'd like We could be the two. If someone else besides me needs to do it I'll get Steve Smalley to chime in on the draft.
> I can be one of the reviewer too.
>
> - Jarrett
>
>
>> Dave
>> _______________________________________________
>> nfsv4 mailing list
>> nfsv4@ietf.org
>> https://www.ietf.org/mailman/listinfo/nfsv4
> _______________________________________________
> nfsv4 mailing list
> nfsv4@ietf.org
> https://www.ietf.org/mailman/listinfo/nfsv4
>
>