From: Sam Falkner Subject: Re: Re: NFSv4 ACL and POSIX interaction / mask, draft-ietf-nfsv4-acls-00 not ready Date: Mon, 10 Jul 2006 09:32:28 -0600 Message-ID: <1A2FAFA9-0B94-48FA-8B0B-2A8AC0BE0331@Sun.COM> References: <200607032310.15252.agruen@suse.de> <200607071355.30624.agruen@suse.de> <200607091822.44656.agruen@suse.de> <20060710141541.GA978@fieldses.org> Mime-Version: 1.0 Content-Type: text/plain; format=flowed; delsp=yes; charset=US-ASCII Cc: Brian Pawlowski , Spencer Shepler , nfs@lists.sourceforge.net, nfsv4@ietf.org, Lisa Week Return-path: In-reply-to: <20060710141541.GA978@fieldses.org> To: "J. Bruce Fields" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: nfsv4-bounces@ietf.org List-ID: On Jul 10, 2006, at 8:15 AM, J. Bruce Fields wrote: > On Mon, Jul 10, 2006 at 07:29:56AM -0600, Sam Falkner wrote: >> On Jul 9, 2006, at 10:22 AM, Andreas Gruenbacher wrote: >>> According to section 5.1 of draft-ietf-nfsv4-acls [1], the >>> resulting file mode >>> permission bits for this acl shall be rw-r--r--. >> >> Your proposal would give this mode: rw-rw-r--. I think we should >> consider this more carefully. > > As Andreas says, this is what the posix draft would have you do. It's > also what Linux (and, I assume, Solaris) do in the case of posix ACLs. Not on Solaris. With POSIX-draft ACLs, adding user:friend:rw- to a mode rw-r--r-- file still gives you rw-r--r--. (And as you point out later, these ACLs ain't POSIX.) > If the goals was compatibility with that posix draft, RFC3530 should > have specified that owner, other, and group bits be kept in sync with > (respectively) OWNER@, EVERYONE@, and the *maximum* of permissions > given > to any other entity, rather than with OWNER@, EVERYONE@, and GROUP@. > >> You would call it wrong that a chmod 770 would allow WRITE_DATA to >> members of the file's owning group?! The user did a chmod -- the >> user changed the permissions on the file! > > That is how posix acl's work; again, the group mode bit really > corresponds to the mask, not to the group acl entry: > > bfields@pickle:~$ getfacl foo > # file: foo > # owner: bfields > # group: bfields > user::rw- > user:bfields:r-- > group::r-- > mask::r-- > other::--- > > bfields@pickle:~$ chmod 770 foo > bfields@pickle:~$ getfacl foo > # file: foo > # owner: bfields > # group: bfields > user::rwx > user:bfields:r-- > group::r-- > mask::rwx > other::--- Again, not so on Solaris. I wasn't aware that it was on Linux. Sigh. > Of course, "posix" acls aren't really posix, and we could do something > else if seems simpler. Neither behavior seems intuitive to me in all > situations. I think having chmod be functional, i.e. chmod 770 gives write permission to the owning group, and an "ls -l" shows "rwxrwx---", would be best by far. - Sam _______________________________________________ nfsv4 mailing list nfsv4@ietf.org https://www1.ietf.org/mailman/listinfo/nfsv4