Re: [nfsv4] nfsv4.1 acl: Remove operation and ACE4_ADD_SUBDIRECTORY

[Andreas Gruenbacher <agruen at suse.de>]

On Thursday, 15 October 2009 20:37:07 J. Bruce Fields wrote:
> On Thu, Oct 15, 2009 at 01:49:55PM +0530, Aneesh Kumar K.V wrote:
> > Hi,
> >
> > I am looking for a clarification with respect to below section in nfsv4.1
> > RFC
> >
> > 6.2.1.3.2.  ACE4_DELETE vs. ACE4_DELETE_CHILD
> >
> > The section states
> > "If the ACLs in question neither explicitly ALLOW nor DENY either of the
> > above, and if MODE4_SVTX is not set on the parent, then the server SHOULD
> > allow the removal if and only if ACE4_ADD_FILE is permitted. In the case
> > where MODE4_SVTX is set, the server may also require the remover to own
> > either the parent or the target, or may require the target to be
> > writable."
> >
> > I am wondering why we consider only ACE_ADD_FILE. Why not
> > ACE4_ADD_SUBDIRECTORY also ?
>
> I agree, it would probably make more sense to say "if and only if
> ACE_ADD_FILE (or, for removal of directories, ACE_ADD_SUBDIRECTORY) is
> permitted." (And change "ACE4_ADD_FILE" to "ACE4_ADD_FILE and
> ACE4_ADD_SUBDIRECTORY" in the following paragraph.)
>
> The use of "SHOULD" as opposed to "MUST" here is intentional, and I
> think server implementers will need to use some judgement when fitting
> these recommendations to their OS's security model.

The code at http://www.suse.de/~agruen/nfs4acl/ doesn't implement the 
ACE_ADD_{FILE,SUBDIRECTORY} and IIRC there was a reason for that -- but I 
don't remember anymore. Greg, do you?

Thanks,
Andreas