Re: [nfsv4] nfsv4.1 acl: Remove operation and ACE4_ADD_SUBDIRECTORY

["J. Bruce Fields" <bfields at fieldses.org>]

On Thu, Oct 15, 2009 at 01:49:55PM +0530, Aneesh Kumar K.V wrote:
> Hi,
> 
> I am looking for a clarification with respect to below section in nfsv4.1 RFC
> 
> 6.2.1.3.2.  ACE4_DELETE vs. ACE4_DELETE_CHILD
> 
> The section states
> "If the ACLs in question neither explicitly ALLOW nor DENY either of the above,
>  and if MODE4_SVTX is not set on the parent, then the server SHOULD allow the
>  removal if and only if ACE4_ADD_FILE is permitted. In the case where MODE4_SVTX
>  is set, the server may also require the remover to own either the parent or the
>  target, or may require the target to be writable."
> 
> I am wondering why we consider only ACE_ADD_FILE. Why not ACE4_ADD_SUBDIRECTORY also ?

I agree, it would probably make more sense to say "if and only if
ACE_ADD_FILE (or, for removal of directories, ACE_ADD_SUBDIRECTORY) is
permitted." (And change "ACE4_ADD_FILE" to "ACE4_ADD_FILE and
ACE4_ADD_SUBDIRECTORY" in the following paragraph.)

The use of "SHOULD" as opposed to "MUST" here is intentional, and I
think server implementers will need to use some judgement when fitting
these recommendations to their OS's security model.

--b.