[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [nfsv4] nfsv4.1 acl: Remove operation and ACE4_ADD_SUBDIRECTORY

On Oct 15, 2009, at 12:37 PM, J. Bruce Fields wrote:


On Thu, Oct 15, 2009 at 01:49:55PM +0530, Aneesh Kumar K.V wrote:

Hi,
I am looking for a clarification with respect to below section in nfsv4.1 RFC 

6.2.1.3.2.  ACE4_DELETE vs. ACE4_DELETE_CHILD

The section states
"If the ACLs in question neither explicitly ALLOW nor DENY either of the above, and if MODE4_SVTX is not set on the parent, then the server SHOULD allow the removal if and only if ACE4_ADD_FILE is permitted. In the case where MODE4_SVTX is set, the server may also require the remover to own either the parent or the 
target, or may require the target to be writable."
I am wondering why we consider only ACE_ADD_FILE. Why not ACE4_ADD_SUBDIRECTORY also ? 

I agree, it would probably make more sense to say "if and only if
ACE_ADD_FILE (or, for removal of directories, ACE_ADD_SUBDIRECTORY) is
permitted." (And change "ACE4_ADD_FILE" to "ACE4_ADD_FILE and
ACE4_ADD_SUBDIRECTORY" in the following paragraph.)


I agree.  It was an oversight.


The use of "SHOULD" as opposed to "MUST" here is intentional, and I
think server implementers will need to use some judgement when fitting
these recommendations to their OS's security model.


I agree with this as well.

- Sam