Re: [secdir] secdir review of draft-ietf-webdav-bind-23

[Tero Kivinen <[e-mail]>]

Julian Reschke writes:
> I have fixed this in my copy of the draft; see 
> <http://www.webdav.org/bind/draft-ietf-webdav-bind-latest.html#rfc.issue.sec-cons-references>. 

That seems to be ok.

> We can either produce a new draft after IESG review, or let this change 
> wait until AUTH48.

Either one is ok for me...

> > One of the things I am not sure if it is really applicable here, but
> > which is not covered by the security considerations section is that
> > bindings might confuse administrator about access permissions. I.e.
> > even when administrator revokes all change permissions from certain
> > collection (i.e the user cannot change the data any more), if that
> > collection has binding pointing to some other collection or resource
> > where user still has permissions, the user might still be able to
> > change resources in the first collection even when administrator
> > believes he already removed permissions.
> > 
> > I am not familiar enough with the WebDAV authorization model to know
> > if this kind of attacks are possible or not, i.e. I do not know if the
> > permissions are set per resource basis or for per collection or what.
> 
> RFC 3744 (WebDAV ACLs) defines access privileges per resource, not per 
> URI (see also 
> <http://www.webdav.org/bind/draft-ietf-webdav-bind-24.html#rfc.section.9> 
> and <http://greenbytes.de/tech/webdav/rfc3744.html#rfc.section.5.p.2>).

Ok, that should make it clear as then bindings do not affect access
privileges. 
-- 
[e-mail]