From Tim.Haley@sun.com Mon Oct 20 09:45:24 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m9KGjNBT014986 for ; Mon, 20 Oct 2008 09:45:23 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m9KGjKSu056049; Mon, 20 Oct 2008 10:45:23 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K9100F2PQJN1K00@brm-avmta-1.central.sun.com>; Mon, 20 Oct 2008 10:45:23 -0600 (MDT) Received: from dm-central-01.central.sun.com ([129.147.62.4]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K91004NRQJHCZA0@brm-avmta-1.central.sun.com>; Mon, 20 Oct 2008 10:45:17 -0600 (MDT) Received: from spidey.Central.Sun.COM (spidey.Central.Sun.COM [172.20.25.27]) by dm-central-01.central.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m9KGjGM7021252; Mon, 20 Oct 2008 10:45:16 -0600 (MDT) Received: from spidey.Central.Sun.COM (localhost [127.0.0.1]) by spidey.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id m9KGhVIc006351; Mon, 20 Oct 2008 10:43:31 -0600 (MDT) Received: (from timh@localhost) by spidey.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id m9KGhVIV006349; Mon, 20 Oct 2008 10:43:31 -0600 (MDT) Date: Mon, 20 Oct 2008 10:43:31 -0600 (MDT) From: Tim Haley Subject: ACLs for CIFS/SMB shares [PSARC/2008/641 FastTrack timeout 10/27/2008] To: PSARC-ext@sun.com Cc: cifs-eng@sun.com Message-id: <200810201643.m9KGhVIV006349@spidey.Central.Sun.COM> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 3684 I am sponsoring the following fasttrack for Doug McCallum. The case introduces ACLs to control access to SMB shares. Requested binding is minor. Timeout is 10/27/2008. Template Version: @(#)sac_nextcase %I% %G% SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: ACLs for CIFS/SMB shares 1.2. Name of Document Author/Supplier: Author: Doug McCallum 1.3 Date of This Document: 20 October, 2008 2. Project Summary 2.1. Project Description: Project is to provide ACLs at the CIFS/SMB "share" level. This is a standard feature in Microsoft implementations and is needed for completeness. ACLs on shares will only be supported on ZFS file systems. 2.2. Risks and Assumptions: Assumes changes to ZFS to provide a place to store the share ACLs. 4. Technical Description: 4.1. Details: During SMB "tree connect" is will be necessary to get the ACL that is set on a share and use it to setup the initial access. The ACLs are expected to be stored in objects within a new directory under .zfs. /dataset/.zfs/shares/ will contain objects with names that match the shares defined on that dataset. Just before the tree connect, the sharename will be looked up in the .zfs/shares directory, the ACLs obtained and then processed relative to the user making the tree connect. The result of processing the ACL will be used to determine access. The ZFS changes will include a means to create/remove the share objects within the new .zfs/shares directory. Once created, it will also be possible to use the standard ACL interfaces to get/set ACLs on these new objects. That is, chmod and ls will be used. Note that there can be multiple shares (resources) for any given path that is shared. This mechanism allows setting different ACLs for the same path depending on the name it is associated with. CIFS is the only protocol we currently support that has the concept of shares (resources in sharemgr/share terms) so this implementation will initially only provide support for CIFS. 4.2. Bug/RFE Number(s): 6582163 Access Control List (ACL) for Shares 4.3. In Scope: Only ZFS file systems will be supported. 4.4. Out of Scope: 4.5. Interfaces: Standard ACL interfaces will be used (ls, chmod). 4.6. Doc Impact: CIFS Administration Guide Modification to the zfs(1M) man page: ---------------------------------------------------------- When the "sharesmb" property is changed for a dataset, the dataset and any children inheriting the property are re-shared with the new options, only if the property was previously set to "off", or if they were shared before the property was changed. If the new property is set to "off", the file systems are unshared. + When SMB shares are created, the SMB share name appears as an + entry in the .zfs/shares directory. You can use the ls or + chmod command to display the share-level ACLs on the entries + in this directory. ---------------------------------------------------------- 4.7. Admin/Config Impact: N/A 4.8. HA Impact: N/A 4.9. I18N/L10N Impact: N/A 4.10. Packaging & Delivery: N/A (existing packages will be used) 4.11. Security Impact: Doesn't change any existing security APIs or features. It does add an additional security mechanism. 4.12. Dependencies: N/A 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From Nicolas.Williams@sun.com Mon Oct 20 09:50:26 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m9KGoQLG015361 for ; Mon, 20 Oct 2008 09:50:26 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m9KGoNH1057903; Mon, 20 Oct 2008 10:50:25 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K9100F0DQRZLW00@nwk-avmta-2.sfbay.sun.com>; Mon, 20 Oct 2008 09:50:23 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K9100DPCQRYX730@nwk-avmta-2.sfbay.sun.com>; Mon, 20 Oct 2008 09:50:22 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id m9KGnuH5017593; Mon, 20 Oct 2008 11:49:56 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id m9KGnuHf017592; Mon, 20 Oct 2008 11:49:56 -0500 (CDT) Date: Mon, 20 Oct 2008 11:49:56 -0500 From: Nicolas Williams Subject: Re: ACLs for CIFS/SMB shares [PSARC/2008/641 FastTrack timeout 10/27/2008] In-reply-to: <200810201643.m9KGhVIV006349@spidey.Central.Sun.COM> To: Tim Haley Cc: PSARC-ext@sun.com, cifs-eng@sun.com Message-id: <20081020164956.GV8906@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200810201643.m9KGhVIV006349@spidey.Central.Sun.COM> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 351 On Mon, Oct 20, 2008 at 10:43:31AM -0600, Tim Haley wrote: > CIFS is the only protocol we currently support that has the > concept of shares (resources in sharemgr/share terms) so this > implementation will initially only provide support for CIFS. That can't possibly be right. NFS has long had a concept of shares, and share ACLs too. Nico -- From Nicolas.Williams@sun.com Mon Oct 20 09:57:49 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m9KGvnh1015916 for ; Mon, 20 Oct 2008 09:57:49 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m9KGvluP011124; Mon, 20 Oct 2008 09:57:48 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K9100F19R4BWV00@brm-avmta-1.central.sun.com>; Mon, 20 Oct 2008 10:57:47 -0600 (MDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K91004KKR49DHB0@brm-avmta-1.central.sun.com>; Mon, 20 Oct 2008 10:57:45 -0600 (MDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id m9KGvKKD017599; Mon, 20 Oct 2008 11:57:20 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id m9KGvKJC017598; Mon, 20 Oct 2008 11:57:20 -0500 (CDT) Date: Mon, 20 Oct 2008 11:57:20 -0500 From: Nicolas Williams Subject: Re: ACLs for CIFS/SMB shares [PSARC/2008/641 FastTrack timeout 10/27/2008] In-reply-to: <200810201643.m9KGhVIV006349@spidey.Central.Sun.COM> To: Tim Haley Cc: PSARC-ext@sun.com, cifs-eng@sun.com Message-id: <20081020165719.GW8906@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200810201643.m9KGhVIV006349@spidey.Central.Sun.COM> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 2021 On Mon, Oct 20, 2008 at 10:43:31AM -0600, Tim Haley wrote: > During SMB "tree connect" is will be necessary to get the ACL > that is set on a share and use it to setup the initial access. > The ACLs are expected to be stored in objects within a new > directory under .zfs. /dataset/.zfs/shares/ will contain > objects with names that match the shares defined on that > dataset. Just before the tree connect, the sharename will be > looked up in the .zfs/shares directory, the ACLs obtained and > then processed relative to the user making the tree > connect. The result of processing the ACL will be used to > determine access. > > The ZFS changes will include a means to create/remove the > share objects within the new .zfs/shares directory. Once > created, it will also be possible to use the standard ACL > interfaces to get/set ACLs on these new objects. That is, > chmod and ls will be used. NFS supports share ACLs of a sort now in the form of host/negroup lists. Shouldn't CIFS also support such an ACL mechanism? > Note that there can be multiple shares (resources) for any > given path that is shared. This mechanism allows setting > different ACLs for the same path depending on the name it is > associated with. Interesting. I believe there's nothing in the NFSv4 protocol precluding the same feature, but that our NFS server doesn't have this. Out of curiosity: is there a need for this (multiple shares for a given path/dataset) in NFS? > CIFS is the only protocol we currently support that has the > concept of shares (resources in sharemgr/share terms) so this > implementation will initially only provide support for CIFS. I pointed out that NFS has a notion of shares and share ACLs, but I see that the notion of share ACLs for CIFS is based on Windows file ACLs, as opposed to the NFS share-ACL-as-host/netgroup-list that we have now. In NFS there's no TreeConnect-type operation, but a share-level ACL can still be applied in operations that deal with paths. Nico -- From Doug.McCallum@sun.com Mon Oct 20 10:19:51 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m9KHJoLL016853 for ; Mon, 20 Oct 2008 10:19:51 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m9KHJidk021293; Tue, 21 Oct 2008 01:19:49 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K9100305S51X200@nwk-avmta-1.sfbay.Sun.COM>; Mon, 20 Oct 2008 10:19:49 -0700 (PDT) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K910005WS50ACB0@nwk-avmta-1.sfbay.Sun.COM>; Mon, 20 Oct 2008 10:19:49 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m9KHJmSE004695; Mon, 20 Oct 2008 17:19:48 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K9100001PGXRX00@mail-amer.sun.com> (original mail from Doug.McCallum@Sun.COM); Mon, 20 Oct 2008 11:19:48 -0600 (MDT) Received: from [129.147.50.20] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K9100MA0S4NIHB0@mail-amer.sun.com>; Mon, 20 Oct 2008 11:19:35 -0600 (MDT) Date: Mon, 20 Oct 2008 11:19:34 -0600 From: Doug McCallum Subject: Re: ACLs for CIFS/SMB shares [PSARC/2008/641 FastTrack timeout 10/27/2008] In-reply-to: <20081020164956.GV8906@Sun.COM> Sender: Doug.McCallum@sun.com To: PSARC-ext@sun.com Cc: cifs-eng@sun.com Message-id: <48FCBDA6.60308@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200810201643.m9KGhVIV006349@spidey.Central.Sun.COM> <20081020164956.GV8906@Sun.COM> User-Agent: Thunderbird 1.5.0.5 (X11/20060828) Status: RO Content-Length: 725 Nicolas Williams wrote: > On Mon, Oct 20, 2008 at 10:43:31AM -0600, Tim Haley wrote: > >> CIFS is the only protocol we currently support that has the >> concept of shares (resources in sharemgr/share terms) so this >> implementation will initially only provide support for CIFS. >> > > That can't possibly be right. NFS has long had a concept of shares, and > share ACLs too. > The NFS host access control (which is being added to SMB as well) is not ACL based. They are strictly based off of the client IP address and not based on the user's ID. SMB share ACLs are just like file ACLs except that they are based on the share name. Each SMB share name for the same path can have its own set of ACLs. Doug From Doug.McCallum@sun.com Mon Oct 20 10:25:52 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m9KHPpqt016949 for ; Mon, 20 Oct 2008 10:25:51 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m9KHPi5C023330; Tue, 21 Oct 2008 01:25:50 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K9100G03SEZTW00@nwk-avmta-2.sfbay.sun.com>; Mon, 20 Oct 2008 10:25:47 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K9100DPKSEZXF60@nwk-avmta-2.sfbay.sun.com>; Mon, 20 Oct 2008 10:25:47 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m9KHPklq008135; Mon, 20 Oct 2008 17:25:46 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K9100A01PIGA600@mail-amer.sun.com> (original mail from Doug.McCallum@Sun.COM); Mon, 20 Oct 2008 11:25:46 -0600 (MDT) Received: from [129.147.50.20] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K91009ORSEGVRA0@mail-amer.sun.com>; Mon, 20 Oct 2008 11:25:28 -0600 (MDT) Date: Mon, 20 Oct 2008 11:25:28 -0600 From: Doug McCallum Subject: Re: ACLs for CIFS/SMB shares [PSARC/2008/641 FastTrack timeout 10/27/2008] In-reply-to: <20081020165719.GW8906@Sun.COM> Sender: Doug.McCallum@sun.com To: PSARC-ext@sun.com Cc: cifs-eng@sun.com Message-id: <48FCBF08.9020908@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200810201643.m9KGhVIV006349@spidey.Central.Sun.COM> <20081020165719.GW8906@Sun.COM> User-Agent: Thunderbird 1.5.0.5 (X11/20060828) Status: RO Content-Length: 2625 Nicolas Williams wrote: > On Mon, Oct 20, 2008 at 10:43:31AM -0600, Tim Haley wrote: > >> During SMB "tree connect" is will be necessary to get the ACL >> that is set on a share and use it to setup the initial access. >> The ACLs are expected to be stored in objects within a new >> directory under .zfs. /dataset/.zfs/shares/ will contain >> objects with names that match the shares defined on that >> dataset. Just before the tree connect, the sharename will be >> looked up in the .zfs/shares directory, the ACLs obtained and >> then processed relative to the user making the tree >> connect. The result of processing the ACL will be used to >> determine access. >> >> The ZFS changes will include a means to create/remove the >> share objects within the new .zfs/shares directory. Once >> created, it will also be possible to use the standard ACL >> interfaces to get/set ACLs on these new objects. That is, >> chmod and ls will be used. >> > > NFS supports share ACLs of a sort now in the form of host/negroup lists. > > Shouldn't CIFS also support such an ACL mechanism? > The NFS host based access control will be putback into Nevada in build 102. It has been a long standing case for adding Montana equivalent support to NFS and CIFS. > >> Note that there can be multiple shares (resources) for any >> given path that is shared. This mechanism allows setting >> different ACLs for the same path depending on the name it is >> associated with. >> > > Interesting. I believe there's nothing in the NFSv4 protocol precluding > the same feature, but that our NFS server doesn't have this. > > Out of curiosity: is there a need for this (multiple shares for a given > path/dataset) in NFS? > There may not be anything that precludes it, but tI don't know of any implementations that provide for it. NFS essentially uses the "path" as the share name while SMB doesn't advertise the underlying path. If NFS implements an equivalent mechanism, this implementation would allow for it to be added. > >> CIFS is the only protocol we currently support that has the >> concept of shares (resources in sharemgr/share terms) so this >> implementation will initially only provide support for CIFS. >> > > I pointed out that NFS has a notion of shares and share ACLs, but I see > that the notion of share ACLs for CIFS is based on Windows file ACLs, as > opposed to the NFS share-ACL-as-host/netgroup-list that we have now. > > In NFS there's no TreeConnect-type operation, but a share-level ACL can > still be applied in operations that deal with paths. > Correct. Doug From Nicolas.Williams@sun.com Mon Oct 20 10:38:32 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m9KHcVUE017643 for ; Mon, 20 Oct 2008 10:38:31 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m9KHcJ7I028345; Tue, 21 Oct 2008 01:38:28 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K9100H0JT029Z00@nwk-avmta-2.sfbay.sun.com>; Mon, 20 Oct 2008 10:38:26 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K9100DZFT01XF70@nwk-avmta-2.sfbay.sun.com>; Mon, 20 Oct 2008 10:38:25 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id m9KHc0Da017660; Mon, 20 Oct 2008 12:38:00 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id m9KHc0qk017659; Mon, 20 Oct 2008 12:38:00 -0500 (CDT) Date: Mon, 20 Oct 2008 12:38:00 -0500 From: Nicolas Williams Subject: Re: ACLs for CIFS/SMB shares [PSARC/2008/641 FastTrack timeout 10/27/2008] In-reply-to: <48FCBDA6.60308@Sun.COM> To: Doug McCallum Cc: PSARC-ext@sun.com, cifs-eng@sun.com Message-id: <20081020173800.GY8906@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200810201643.m9KGhVIV006349@spidey.Central.Sun.COM> <20081020164956.GV8906@Sun.COM> <48FCBDA6.60308@Sun.COM> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 858 On Mon, Oct 20, 2008 at 11:19:34AM -0600, Doug McCallum wrote: > Nicolas Williams wrote: > >On Mon, Oct 20, 2008 at 10:43:31AM -0600, Tim Haley wrote: > > > >> CIFS is the only protocol we currently support that has the > >> concept of shares (resources in sharemgr/share terms) so this > >> implementation will initially only provide support for CIFS. > >> > > > >That can't possibly be right. NFS has long had a concept of shares, and > >share ACLs too. > > The NFS host access control (which is being added to SMB as well) is > not ACL based. I was specifically responding to the claim about the notion of shares. > They are strictly based off of the client IP address and not based on > the user's ID. That's true, but many people call these ACLs. An ACL need not have a particular form in order to be deserving of the term "ACL." Nico -- From Nicolas.Williams@sun.com Mon Oct 20 10:41:10 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m9KHf9C1018225 for ; Mon, 20 Oct 2008 10:41:09 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m9KHf6WL016006; Mon, 20 Oct 2008 18:41:07 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K910051LT4IZW00@nwk-avmta-1.sfbay.Sun.COM>; Mon, 20 Oct 2008 10:41:06 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K91005G4T47P200@nwk-avmta-1.sfbay.Sun.COM>; Mon, 20 Oct 2008 10:40:56 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id m9KHeU8k017666; Mon, 20 Oct 2008 12:40:30 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id m9KHeTEs017665; Mon, 20 Oct 2008 12:40:29 -0500 (CDT) Date: Mon, 20 Oct 2008 12:40:29 -0500 From: Nicolas Williams Subject: Re: ACLs for CIFS/SMB shares [PSARC/2008/641 FastTrack timeout 10/27/2008] In-reply-to: <48FCBF08.9020908@Sun.COM> To: Doug McCallum Cc: PSARC-ext@sun.com, cifs-eng@sun.com Message-id: <20081020174028.GZ8906@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200810201643.m9KGhVIV006349@spidey.Central.Sun.COM> <20081020165719.GW8906@Sun.COM> <48FCBF08.9020908@Sun.COM> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 870 On Mon, Oct 20, 2008 at 11:25:28AM -0600, Doug McCallum wrote: > >NFS supports share ACLs of a sort now in the form of host/negroup lists. > > > >Shouldn't CIFS also support such an ACL mechanism? > > > The NFS host based access control will be putback into Nevada in build 102. Er, NFS has had it forever. Do you mean that CIFS will also have it in build 102? If so, that's really cool. > >I pointed out that NFS has a notion of shares and share ACLs, but I see > >that the notion of share ACLs for CIFS is based on Windows file ACLs, as > >opposed to the NFS share-ACL-as-host/netgroup-list that we have now. > > > >In NFS there's no TreeConnect-type operation, but a share-level ACL can > >still be applied in operations that deal with paths. > > Correct. Can we expect to see a future case adding share-level ACLs (beyond host-based ACLs) to the NFS server? From Doug.McCallum@sun.com Mon Oct 20 11:12:41 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m9KICfcu024084 for ; Mon, 20 Oct 2008 11:12:41 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m9KICbK2028187; Mon, 20 Oct 2008 12:12:41 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K910090TUL4CW00@nwk-avmta-1.sfbay.Sun.COM>; Mon, 20 Oct 2008 11:12:40 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K91005Y6UL3P230@nwk-avmta-1.sfbay.Sun.COM>; Mon, 20 Oct 2008 11:12:39 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m9KICdtu025411; Mon, 20 Oct 2008 18:12:39 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K9100601UHHGA00@mail-amer.sun.com> (original mail from Doug.McCallum@Sun.COM); Mon, 20 Oct 2008 12:12:39 -0600 (MDT) Received: from [129.147.50.20] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K9100I8HUKZZKA0@mail-amer.sun.com>; Mon, 20 Oct 2008 12:12:36 -0600 (MDT) Date: Mon, 20 Oct 2008 12:12:35 -0600 From: Doug McCallum Subject: Re: ACLs for CIFS/SMB shares [PSARC/2008/641 FastTrack timeout 10/27/2008] In-reply-to: <20081020173800.GY8906@Sun.COM> Sender: Doug.McCallum@sun.com To: PSARC-ext@sun.com Cc: cifs-eng@sun.com Message-id: <48FCCA13.4080709@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200810201643.m9KGhVIV006349@spidey.Central.Sun.COM> <20081020164956.GV8906@Sun.COM> <48FCBDA6.60308@Sun.COM> <20081020173800.GY8906@Sun.COM> User-Agent: Thunderbird 1.5.0.5 (X11/20060828) Status: RO Content-Length: 1490 Nicolas Williams wrote: > On Mon, Oct 20, 2008 at 11:19:34AM -0600, Doug McCallum wrote: > >> Nicolas Williams wrote: >> >>> On Mon, Oct 20, 2008 at 10:43:31AM -0600, Tim Haley wrote: >>> >>> >>>> CIFS is the only protocol we currently support that has the >>>> concept of shares (resources in sharemgr/share terms) so this >>>> implementation will initially only provide support for CIFS. >>>> >>>> >>> That can't possibly be right. NFS has long had a concept of shares, and >>> share ACLs too. >>> >> The NFS host access control (which is being added to SMB as well) is >> not ACL based. >> > > I was specifically responding to the claim about the notion of shares. > NFS has shares, but not the same concept. The parenthetical addition of the "resources" terminology was intended to clarify the difference. NFS doesn't really have the same definition. The terminology can be confusing between protocols that have similar, but slightly different, semantics. > >> They are strictly based off of the client IP address and not based on >> the user's ID. >> > > That's true, but many people call these ACLs. An ACL need not have a > particular form in order to be deserving of the term "ACL." > NFS hasn't documented them exactly as ACLs, but I see where you are coming from. Access lists and access control lists are similar. We tend to refer to the NFS style as host based access and the SMB ACLs as share level ACLs. From Doug.McCallum@sun.com Mon Oct 20 11:31:44 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m9KIVhLG027496 for ; Mon, 20 Oct 2008 11:31:43 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m9KIVhD4027256; Mon, 20 Oct 2008 11:31:43 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K9100J09VGVAC00@nwk-avmta-2.sfbay.sun.com>; Mon, 20 Oct 2008 11:31:43 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K9100D1WVGUX7C0@nwk-avmta-2.sfbay.sun.com>; Mon, 20 Oct 2008 11:31:42 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m9KIVgh0016821; Mon, 20 Oct 2008 18:31:42 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K9100601UHHGA00@mail-amer.sun.com> (original mail from Doug.McCallum@Sun.COM); Mon, 20 Oct 2008 12:31:42 -0600 (MDT) Received: from [129.147.50.20] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K9100IA6VGLZKF0@mail-amer.sun.com>; Mon, 20 Oct 2008 12:31:34 -0600 (MDT) Date: Mon, 20 Oct 2008 12:31:33 -0600 From: Doug McCallum Subject: Re: ACLs for CIFS/SMB shares [PSARC/2008/641 FastTrack timeout 10/27/2008] In-reply-to: <20081020174028.GZ8906@Sun.COM> Sender: Doug.McCallum@sun.com To: PSARC-ext@sun.com Cc: cifs-eng@sun.com Message-id: <48FCCE85.5080403@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200810201643.m9KGhVIV006349@spidey.Central.Sun.COM> <20081020165719.GW8906@Sun.COM> <48FCBF08.9020908@Sun.COM> <20081020174028.GZ8906@Sun.COM> User-Agent: Thunderbird 1.5.0.5 (X11/20060828) Status: RO Content-Length: 1264 Nicolas Williams wrote: > On Mon, Oct 20, 2008 at 11:25:28AM -0600, Doug McCallum wrote: > >>> NFS supports share ACLs of a sort now in the form of host/negroup lists. >>> >>> Shouldn't CIFS also support such an ACL mechanism? >>> >>> >> The NFS host based access control will be putback into Nevada in build 102. >> > > Er, NFS has had it forever. Do you mean that CIFS will also have it in > build 102? If so, that's really cool. > Sorry. I did mean NFS style host based access control on CIFS. > >>> I pointed out that NFS has a notion of shares and share ACLs, but I see >>> that the notion of share ACLs for CIFS is based on Windows file ACLs, as >>> opposed to the NFS share-ACL-as-host/netgroup-list that we have now. >>> >>> In NFS there's no TreeConnect-type operation, but a share-level ACL can >>> still be applied in operations that deal with paths. >>> >> Correct. >> > > Can we expect to see a future case adding share-level ACLs (beyond > host-based ACLs) to the NFS server? > There aren't any current plans. The CIFS share-level ACLs are part of the Microsoft specification so we need to get those added. It seems like a reasonable RFE for NFS to provide an alternative namespace using resource names. From Richard.Matthews@sun.com Wed Oct 22 09:13:24 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m9MGDOAi019675 for ; Wed, 22 Oct 2008 09:13:24 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m9MGDMno036544; Wed, 22 Oct 2008 10:13:24 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K9500C0NEEBN500@nwk-avmta-1.sfbay.Sun.COM>; Wed, 22 Oct 2008 09:13:23 -0700 (PDT) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K95008AIEEACS20@nwk-avmta-1.sfbay.Sun.COM>; Wed, 22 Oct 2008 09:13:22 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m9MGDM0L006410; Wed, 22 Oct 2008 16:13:22 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K9500E01DBSYS00@mail-amer.sun.com> (original mail from Richard.Matthews@Sun.COM); Wed, 22 Oct 2008 10:13:22 -0600 (MDT) Received: from rick-matthews-powerbook-g4-15.local ([129.150.34.109]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K9500MDTEDLQI00@mail-amer.sun.com>; Wed, 22 Oct 2008 10:12:58 -0600 (MDT) Date: Wed, 22 Oct 2008 11:12:56 -0500 From: Rick Matthews Subject: Re: ACLs for CIFS/SMB shares [PSARC/2008/641 FastTrack timeout 10/27/2008] In-reply-to: <48FCCE85.5080403@Sun.COM> Sender: Richard.Matthews@sun.com To: Doug McCallum Cc: PSARC-ext@sun.com, cifs-eng@sun.com Message-id: <48FF5108.1010306@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200810201643.m9KGhVIV006349@spidey.Central.Sun.COM> <20081020165719.GW8906@Sun.COM> <48FCBF08.9020908@Sun.COM> <20081020174028.GZ8906@Sun.COM> <48FCCE85.5080403@Sun.COM> User-Agent: Thunderbird 2.0.0.17 (Macintosh/20080914) Status: RO Content-Length: 545 We seem to have no membership participation on this email thread. So, +1 -- --------------------------------------------------------------------- Rick Matthews email: Rick.Matthews@sun.com Sun Microsystems, Inc. phone:+1(651) 554-1518 1270 Eagan Industrial Road phone(internal): 54418 Suite 160 fax: +1(651) 554-1540 Eagan, MN 55121-1231 USA main: +1(651) 554-1500 --------------------------------------------------------------------- From tim.haley@sun.com Wed Oct 22 10:15:07 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m9MHF7Gq025813 for ; Wed, 22 Oct 2008 10:15:07 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m9MHF6lP062311; Wed, 22 Oct 2008 11:15:07 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K9500I45H95F900@nwk-avmta-1.sfbay.Sun.COM>; Wed, 22 Oct 2008 10:15:05 -0700 (PDT) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K95008X8H94D660@nwk-avmta-1.sfbay.Sun.COM>; Wed, 22 Oct 2008 10:15:04 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m9MHF4nq002603; Wed, 22 Oct 2008 17:15:04 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K9500E01FKX8400@mail-amer.sun.com> (original mail from tim.haley@sun.com) ; Wed, 22 Oct 2008 11:15:04 -0600 (MDT) Received: from [172.20.25.27] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K95001FLH8YTN50@mail-amer.sun.com>; Wed, 22 Oct 2008 11:14:58 -0600 (MDT) Date: Wed, 22 Oct 2008 11:13:15 -0600 From: Tim Haley Subject: Re: ACLs for CIFS/SMB shares [PSARC/2008/641 FastTrack timeout 10/27/2008] In-reply-to: <200810201643.m9KGhVIV006349@spidey.Central.Sun.COM> Sender: Timothy.Haley@sun.com To: PSARC-ext@sun.com Cc: cifs-eng@sun.com Message-id: <48FF5F2B.5010501@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200810201643.m9KGhVIV006349@spidey.Central.Sun.COM> User-Agent: Thunderbird 2.0.0.16 (X11/20080922) Status: RO Content-Length: 59 This case was approved during today's PSARC meeting. -tim