From Tim.Haley@sun.com Mon Apr 20 07:30:28 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3KEUSEu025518 for ; Mon, 20 Apr 2009 07:30:28 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n3KEUPBA024362; Mon, 20 Apr 2009 07:30:28 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIE0060PLMS6A00@brm-avmta-1.central.sun.com>; Mon, 20 Apr 2009 08:30:28 -0600 (MDT) Received: from dm-central-02.central.sun.com ([129.147.62.5]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIE00F17LMRYOA0@brm-avmta-1.central.sun.com>; Mon, 20 Apr 2009 08:30:27 -0600 (MDT) Received: from spidey.Central.Sun.COM (spidey.Central.Sun.COM [172.20.25.27]) by dm-central-02.central.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n3KEURiM022426; Mon, 20 Apr 2009 08:30:27 -0600 (MDT) Received: from spidey.Central.Sun.COM (localhost [127.0.0.1]) by spidey.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n3KEMuAf026627; Mon, 20 Apr 2009 08:22:56 -0600 (MDT) Received: (from timh@localhost) by spidey.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n3KEMuN0026625; Mon, 20 Apr 2009 08:22:56 -0600 (MDT) Date: Mon, 20 Apr 2009 08:22:56 -0600 (MDT) From: Tim Haley Subject: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] To: PSARC-ext@sun.com Cc: cifs-eng@sun.com, zfs-eng@sun.com Message-id: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 3965 I am sponsoring the following fast-track for myself. This case introduces a new feature into ZFS to support Access Based Enumeration within our SMB server. Requested binding is patch/micro. Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI This information is Copyright 2009 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: ZFS support for Access Based Enumeration 1.2. Name of Document Author/Supplier: Author: Timothy Haley 1.3 Date of This Document: 20 April, 2009 4. Technical Description OVERVIEW Windows file servers support a feature called Access Based Enumeration (ABE), which, when enabled, filters the response to readdir requests such that the consumer only sees files and directories (folders) to which the consumer has access. ABE support has been requested in RFE 6802734 to support Windows interoperability. Access is defined as having any of the permissions assignable via chmod(1M) and described in acl(5). There are currently 14 such permissions[1]. The filtering only applies to data returned by the file system's VOP_READDIR() function. If the entity defined by the cred_t lacks access to a directory entry, that entry is omitted from the returned dirent data. A caller to the VOP requests ABE filtering by bitwise OR-ing V_RDDIR_ACCFILTER into the flags passed to VOP_READDIR(). A new VFS feature flag (see PSARC 2007/227) VFSFT_ACCESS_FILTER will be added to support ABE, which is set by a file system to indicate that it implements access based filtering. A file system that does not implement the feature may still receive the V_RDDIR_ACCFILTER flag in a call to its VOP_READDIR() and should ignore it. Note: While it is possible for consumers of VOP_READDIR() to perform an access check on each directory entry it is significantly more efficient to implement this feature within the file system. ABE feature support is also testable using pathconf(2) with a name argument of _PC_ACCESS_FILTERING. If the path or file descriptor refers to a directory within a file system that supports VFSFT_ACCESS_FILTER, a non-zero value is returned, otherwise zero is returned. [1] The currently defined permissions are read_data/list_directory, write_data/add_file, append_data/add_subdirectory, read_xattr, write_xattr, execute, read_attributes, write_attributes, delete,delete_child, read_acl, write_acl, write_owner, and synchronize. PROPOSED MAN PAGE CHANGES *** pathconf_2.rogi Mon Mar 16 16:25:45 2009 --- pathconf_2 Mon Mar 16 13:54:29 2009 *************** *** 64,69 **** --- 64,71 ---- |___________________________|________________________|______________| | {XATTR_EXISTS} | _PC_XATTR_EXISTS | 1 | |___________________________|________________________|______________| + | {ACCESS_FILTERING} | _PC_ACCESS_FILTERING | 12 | + |___________________________|________________________|______________| | _POSIX_CHOWN_RESTRICTED | _PC_CHOWN_RESTRICTED | 7 | |___________________________|________________________|______________| | _POSIX_NO_TRUNC | _PC_NO_TRUNC | 3, 4 | *************** *** 145,150 **** --- 147,157 ---- not specify the minimum hole size but still reports holes. + 12. If path or fildes refers to a directory, and the file + system in which the directory resides supports access + filtering, a non-zero value is returned. Otherwise, 0 + is returned. + RETURN VALUES If name is an invalid value, both pathconf() and fpathconf() return -1 and errno is set to indicate the error. 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From Darren.Moffat@sun.com Wed Apr 22 01:59:21 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3M8xL0h015221 for ; Wed, 22 Apr 2009 01:59:21 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n3M8xJfN055546; Wed, 22 Apr 2009 02:59:20 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIH00F0HVMWSB00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 22 Apr 2009 01:59:20 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIH009NYVMV5A30@nwk-avmta-1.sfbay.Sun.COM>; Wed, 22 Apr 2009 01:59:20 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe3.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n3M8xIt1022999; Wed, 22 Apr 2009 08:59:19 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KIH00A00TLO8D00@fe-emea-09.sun.com>; Wed, 22 Apr 2009 09:59:19 +0100 (BST) Received: from [192.168.1.103] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KIH0017YVMMHGD0@fe-emea-09.sun.com>; Wed, 22 Apr 2009 09:59:10 +0100 (BST) Date: Wed, 22 Apr 2009 09:59:09 +0100 From: Darren J Moffat Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> Sender: Darren.Moffat@sun.com To: Tim Haley Cc: PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <49EEDC5D.2040009@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> User-Agent: Thunderbird 2.0.0.18 (X11/20090211) Status: RO Content-Length: 554 I'm happy with the case as specified. Initially I missed how this would actually be requested but on second reading I saw that the caller passes the V_RDDIR_ACCFILTER flag. Is this case intended to modify the CIFS server to pass this flag or is there another case for that ? I think there is a possibly interesting (to some people anyway) RFE in here for local ZFS filesystems. A per dataset property that enables this behaviour. Not this case though. Regardless of the answers to the above I'm happy with it as specified. -- Darren J Moffat From amw@sun.com Wed Apr 22 02:38:19 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3M9cJ1V015612 for ; Wed, 22 Apr 2009 02:38:19 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n3M9cE3a026614; Wed, 22 Apr 2009 10:38:18 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIH00F0LXFRF600@brm-avmta-1.central.sun.com>; Wed, 22 Apr 2009 03:38:15 -0600 (MDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIH005XJXFR8B70@brm-avmta-1.central.sun.com>; Wed, 22 Apr 2009 03:38:15 -0600 (MDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n3M9cFlv028582; Wed, 22 Apr 2009 09:38:15 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KIH00H00X53P000@mail-amer.sun.com>; Wed, 22 Apr 2009 03:38:15 -0600 (MDT) Received: from TOSHIBA ([unknown] [129.150.16.49]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KIH00IXXXFQ8D00@mail-amer.sun.com>; Wed, 22 Apr 2009 03:38:15 -0600 (MDT) Date: Wed, 22 Apr 2009 02:38:09 -0700 From: "Alan.M.Wright" Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] Sender: Alan.M.Wright@sun.com To: Darren J Moffat , Tim Haley Cc: PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 X-Mailer: Microsoft Outlook Express 6.00.2900.5512 Content-type: text/plain; reply-type=response; charset=iso-8859-1; format=flowed Content-transfer-encoding: 7BIT X-Priority: 3 X-MSMail-priority: Normal X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> Status: RO Content-Length: 1201 Darren J Moffat wrote: > I'm happy with the case as specified. Initially I missed how this would > actually be requested but on second reading I saw that the caller passes > the V_RDDIR_ACCFILTER flag. > > Is this case intended to modify the CIFS server to pass this flag or is > there another case for that ? That will be a different case, which will follow after approval of this case. I felt it would simplify the dependencies and test matrix for each case to keep them separate. > I think there is a possibly interesting (to some people anyway) RFE in > here for local ZFS filesystems. A per dataset property that enables > this behaviour. Not this case though. Enabling this property on local file systems may have undesirable side effects. For example, backup/archiving applications may inadvertently miss files (because the directory content visible to applications is not dependent solely on having directory read permission with ABE enabled). I don't think Windows allows ABE to be enabled on local file systems, it is only available on shares. Alan > Regardless of the answers to the above I'm happy with it as specified. > > -- > Darren J Moffat > From Nicolas.Williams@sun.com Wed Apr 22 08:06:28 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3MF6RqY012621 for ; Wed, 22 Apr 2009 08:06:27 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n3MF6N3J011981; Wed, 22 Apr 2009 16:06:24 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KII0072JCMN2S00@nwk-avmta-2.sfbay.sun.com>; Wed, 22 Apr 2009 08:06:23 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KII0067QCMMXT00@nwk-avmta-2.sfbay.sun.com>; Wed, 22 Apr 2009 08:06:22 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n3MF4LHw016072; Wed, 22 Apr 2009 10:04:21 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n3MF4LBF016071; Wed, 22 Apr 2009 10:04:21 -0500 (CDT) Date: Wed, 22 Apr 2009 10:04:21 -0500 From: Nicolas Williams Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> To: "Alan.M.Wright" Cc: Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <20090422150421.GC1500@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1297 On Wed, Apr 22, 2009 at 02:38:09AM -0700, Alan.M.Wright wrote: > Darren J Moffat wrote: > >I'm happy with the case as specified. Initially I missed how this would > >actually be requested but on second reading I saw that the caller passes > >the V_RDDIR_ACCFILTER flag. > > > >Is this case intended to modify the CIFS server to pass this flag or is > >there another case for that ? > > That will be a different case, which will follow after approval of this > case. I felt it would simplify the dependencies and test matrix for each > case to keep them separate. > > >I think there is a possibly interesting (to some people anyway) RFE in > >here for local ZFS filesystems. A per dataset property that enables > >this behaviour. Not this case though. > > Enabling this property on local file systems may have undesirable side > effects. For example, backup/archiving applications may inadvertently > miss files (because the directory content visible to applications is not > dependent solely on having directory read permission with ABE > enabled). I don't think Windows allows ABE to be enabled on local > file systems, it is only available on shares. Any reason not to add a corresponding option to the NFS server when the CIFS case comes along? Nico -- From Nicolas.Williams@sun.com Thu Apr 23 09:15:01 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3NGF0wq024534 for ; Thu, 23 Apr 2009 09:15:00 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n3NGEqsI015672; Thu, 23 Apr 2009 17:14:58 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIK0031JAGWRR00@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 09:14:56 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIK003XOAGUI200@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 09:14:54 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n3NGCskj016997; Thu, 23 Apr 2009 11:12:54 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n3NGCsWr016996; Thu, 23 Apr 2009 11:12:54 -0500 (CDT) Date: Thu, 23 Apr 2009 11:12:54 -0500 From: Nicolas Williams Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <20090422150421.GC1500@Sun.COM> To: "Alan.M.Wright" Cc: Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <20090423161254.GL1500@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1606 On Wed, Apr 22, 2009 at 10:04:21AM -0500, Nicolas Williams wrote: > Any reason not to add a corresponding option to the NFS server when the > CIFS case comes along? More to the point: if only the CIFS service has this feature then it follows that enabling ABE on a share ought to disable NFS service for that share as otherwise users could use NFS to defeat ABE. At the very least this should be documented. In general I would think that we ought to aim for feature parity between the CIFS service and the NFS service for any features that could be applicable to both. With some obvious exceptions, of course. Examples: - it should be OK for Solaris to support NFSv4 delegations but not CIFS oplocks -- such a difference mostly affects only performance; - it should not be OK for Solaris to have different I18N characteristics for NFSv4 and CIFS if that meant that NFSv4 and CIFS clients could not easily share files with non-ASCII names through a Solaris NAS. When it comes to security features of the _protocols_ (e.g., support for Kerberos V) I'm not so sure that such a rule should apply -- you can always turn one or the other protocol. But when it comes to security features of the _filesystem_ methinks that those should apply in both, NFSv4 and CIFS as much as possible (e.g., there could be minor differences w.r.t. ACLs). ABE is not a protocol feature as much as a filesystem feature... If I understand this case correctly the changes to the CIFS server to support ABE will be minor, and so should be the changes to the NFS server. Did I understand correctly? Nico -- From amw@sun.com Thu Apr 23 15:35:58 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3NMZv7s028119 for ; Thu, 23 Apr 2009 15:35:58 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n3NMZnF3000251; Fri, 24 Apr 2009 06:35:56 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIK00205S3U5W00@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 15:35:54 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIK0006US3UM910@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 15:35:54 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n3NMZsWW009815; Thu, 23 Apr 2009 22:35:54 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KIK00K00RVGM800@mail-amer.sun.com>; Thu, 23 Apr 2009 16:35:54 -0600 (MDT) Received: from [10.1.106.211] ([unknown] [10.1.106.211]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KIK00K6IS3NQT00@mail-amer.sun.com>; Thu, 23 Apr 2009 16:35:48 -0600 (MDT) Date: Thu, 23 Apr 2009 15:35:32 -0700 From: Alan M Wright Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <20090423161254.GL1500@Sun.COM> Sender: Alan.M.Wright@sun.com To: Nicolas Williams Cc: Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <49F0ED34.1040303@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> <20090423161254.GL1500@Sun.COM> User-Agent: Thunderbird 2.0.0.14 (X11/20080630) Status: RO Content-Length: 2604 On 04/23/09 09:12, Nicolas Williams wrote: > On Wed, Apr 22, 2009 at 10:04:21AM -0500, Nicolas Williams wrote: >> Any reason not to add a corresponding option to the NFS server when the >> CIFS case comes along? > > More to the point: if only the CIFS service has this feature then it > follows that enabling ABE on a share ought to disable NFS service for > that share as otherwise users could use NFS to defeat ABE. At the very > least this should be documented. As a per share property, I don't think we need to document this specifically. Shares with ABE enabled will perform filtering, shares that do not have ABE enabled will not perform filtering. For example, if you share the same directory twice over SMB but only enable ABE on one of those shares, the same user would have a different view based on the specific share being accessed. > In general I would think that we ought to aim for feature parity between > the CIFS service and the NFS service for any features that could be > applicable to both. With some obvious exceptions, of course. > > Examples: > > - it should be OK for Solaris to support NFSv4 delegations but not CIFS > oplocks -- such a difference mostly affects only performance; > > - it should not be OK for Solaris to have different I18N > characteristics for NFSv4 and CIFS if that meant that NFSv4 and CIFS > clients could not easily share files with non-ASCII names through a > Solaris NAS. > > When it comes to security features of the _protocols_ (e.g., support for > Kerberos V) I'm not so sure that such a rule should apply -- you can > always turn one or the other protocol. But when it comes to security > features of the _filesystem_ methinks that those should apply in both, > NFSv4 and CIFS as much as possible (e.g., there could be minor > differences w.r.t. ACLs). ABE is not a protocol feature as much as a > filesystem feature... Yes > If I understand this case correctly the changes to the CIFS server to > support ABE will be minor, and so should be the changes to the NFS > server. Did I understand correctly? I would imagine that adding ABE support to NFS would be straight- forward because everything would be local, i.e. add the ability to set the ABE share property and have the NFS service interrogate that property for readdir requests. The CIFS service requires additional MSRPC work because the ABE property can be managed remotely (via the MMC on Windows clients) as well as locally via sharemgr, sharaesmb etc. I'll talk to the NFS team about introducing NFS ABE support at the same time as CIFS support. Alan From Nicolas.Williams@sun.com Thu Apr 23 15:41:29 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3NMfS44028144 for ; Thu, 23 Apr 2009 15:41:29 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n3NMfLrD022945; Thu, 23 Apr 2009 23:41:26 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIK0021BSD1J700@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 15:41:25 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIK000LSSD0LQ10@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 15:41:24 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n3NMdN01017403; Thu, 23 Apr 2009 17:39:23 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n3NMdNYB017402; Thu, 23 Apr 2009 17:39:23 -0500 (CDT) Date: Thu, 23 Apr 2009 17:39:23 -0500 From: Nicolas Williams Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <49F0ED34.1040303@sun.com> To: Alan M Wright Cc: Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <20090423223923.GF1500@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> <20090423161254.GL1500@Sun.COM> <49F0ED34.1040303@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1914 On Thu, Apr 23, 2009 at 03:35:32PM -0700, Alan M Wright wrote: > On 04/23/09 09:12, Nicolas Williams wrote: > >More to the point: if only the CIFS service has this feature then it > >follows that enabling ABE on a share ought to disable NFS service for > >that share as otherwise users could use NFS to defeat ABE. At the very > >least this should be documented. > > As a per share property, I don't think we need to document this > specifically. Shares with ABE enabled will perform filtering, > shares that do not have ABE enabled will not perform filtering. > > For example, if you share the same directory twice over SMB but > only enable ABE on one of those shares, the same user would have > a different view based on the specific share being accessed. What I meant was that if we don't have this feature in NFS then we should document that sharing with CIFS w/ ABE and NFS allows users to circumvent ABE by using NFS, that if you want ABE then you don't want NFS. > >If I understand this case correctly the changes to the CIFS server to > >support ABE will be minor, and so should be the changes to the NFS > >server. Did I understand correctly? > > I would imagine that adding ABE support to NFS would be straight- > forward because everything would be local, i.e. add the ability > to set the ABE share property and have the NFS service interrogate > that property for readdir requests. > > The CIFS service requires additional MSRPC work because the ABE > property can be managed remotely (via the MMC on Windows clients) > as well as locally via sharemgr, sharaesmb etc. > > I'll talk to the NFS team about introducing NFS ABE support at the > same time as CIFS support. Thanks. The next question is whether it makes sense for ABE to be a share-level option or a dataset property or directory xattr. I think the latter is more appropriate if CIFS and NFS will both support ABE... Nico -- From Nicolas.Williams@sun.com Thu Apr 23 15:47:04 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3NMl4nJ028181 for ; Thu, 23 Apr 2009 15:47:04 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n3NMl1eV006275; Thu, 23 Apr 2009 15:47:02 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIK0030VSMEFO00@nwk-avmta-1.sfbay.Sun.COM>; Thu, 23 Apr 2009 15:47:02 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIK00HAKSMDBCF0@nwk-avmta-1.sfbay.Sun.COM>; Thu, 23 Apr 2009 15:47:01 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n3NMj0MN017497; Thu, 23 Apr 2009 17:45:00 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n3NMj0cO017496; Thu, 23 Apr 2009 17:45:00 -0500 (CDT) Date: Thu, 23 Apr 2009 17:45:00 -0500 From: Nicolas Williams Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <49F0ED34.1040303@sun.com> To: Alan M Wright Cc: Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <20090423224459.GG1500@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> <20090423161254.GL1500@Sun.COM> <49F0ED34.1040303@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 413 On Thu, Apr 23, 2009 at 03:35:32PM -0700, Alan M Wright wrote: > On 04/23/09 09:12, Nicolas Williams wrote: > >In general I would think that we ought to aim for feature parity between > >the CIFS service and the NFS service for any features that could be > >applicable to both. With some obvious exceptions, of course. > > > >Examples: > > > >[...] > > Yes Should this be a precedent, or even a best practice? From Jordan.Brown@Sun.COM Thu Apr 23 16:07:31 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3NN7VZM000053 for ; Thu, 23 Apr 2009 16:07:31 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n3NN7VJf006637; Thu, 23 Apr 2009 16:07:31 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIK0040DTKJ3Q00@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 16:07:31 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIK0001NTKIM830@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 16:07:30 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n3NN7UWK018771; Thu, 23 Apr 2009 16:07:30 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KIK00E00T8TYN00@fe-sfbay-09.sun.com>; Thu, 23 Apr 2009 16:07:30 -0700 (PDT) Received: from [129.145.155.183] ([unknown] [129.145.155.183]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KIK00I3LTK9RH90@fe-sfbay-09.sun.com>; Thu, 23 Apr 2009 16:07:22 -0700 (PDT) Date: Thu, 23 Apr 2009 16:07:21 -0700 From: Jordan Brown Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <20090423223923.GF1500@Sun.COM> Sender: Jordan.Brown@Sun.COM To: Nicolas Williams Cc: Alan M Wright , Darren J Moffat , Tim Haley , PSARC-ext@Sun.COM, cifs-eng@Sun.COM, zfs-eng@Sun.COM Message-id: <49F0F4A9.1070505@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=UTF-8 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> <20090423161254.GL1500@Sun.COM> <49F0ED34.1040303@sun.com> <20090423223923.GF1500@Sun.COM> User-Agent: Thunderbird 2.0.0.14 (X11/20080505) Status: RO Content-Length: 330 Nicolas Williams wrote: > The next question is whether it makes sense for ABE to be a share-level > option or a dataset property or directory xattr. I think the latter is > more appropriate if CIFS and NFS will both support ABE... Or perhaps both, in the same way that there are ACLs both in the file system and on the share. From amw@sun.com Thu Apr 23 16:07:38 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3NN7bal000952 for ; Thu, 23 Apr 2009 16:07:38 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n3NN7ZHI018041; Fri, 24 Apr 2009 07:07:36 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIK00E05TKOKL00@brm-avmta-1.central.sun.com>; Thu, 23 Apr 2009 17:07:36 -0600 (MDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIK00DW1TKG6Y00@brm-avmta-1.central.sun.com>; Thu, 23 Apr 2009 17:07:28 -0600 (MDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n3NN7SlH021948; Thu, 23 Apr 2009 23:07:28 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KIK00600TB7W300@mail-amer.sun.com>; Thu, 23 Apr 2009 17:07:28 -0600 (MDT) Received: from [10.1.106.211] ([unknown] [10.1.106.211]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KIK00K39TK5QT10@mail-amer.sun.com>; Thu, 23 Apr 2009 17:07:18 -0600 (MDT) Date: Thu, 23 Apr 2009 16:07:02 -0700 From: Alan M Wright Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <20090423223923.GF1500@Sun.COM> Sender: Alan.M.Wright@sun.com To: Nicolas Williams Cc: Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <49F0F496.5040501@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> <20090423161254.GL1500@Sun.COM> <49F0ED34.1040303@sun.com> <20090423223923.GF1500@Sun.COM> User-Agent: Thunderbird 2.0.0.14 (X11/20080630) Status: RO Content-Length: 2368 On 04/23/09 15:39, Nicolas Williams wrote: > On Thu, Apr 23, 2009 at 03:35:32PM -0700, Alan M Wright wrote: >> On 04/23/09 09:12, Nicolas Williams wrote: >>> More to the point: if only the CIFS service has this feature then it >>> follows that enabling ABE on a share ought to disable NFS service for >>> that share as otherwise users could use NFS to defeat ABE. At the very >>> least this should be documented. >> As a per share property, I don't think we need to document this >> specifically. Shares with ABE enabled will perform filtering, >> shares that do not have ABE enabled will not perform filtering. >> >> For example, if you share the same directory twice over SMB but >> only enable ABE on one of those shares, the same user would have >> a different view based on the specific share being accessed. > > What I meant was that if we don't have this feature in NFS then we > should document that sharing with CIFS w/ ABE and NFS allows users to > circumvent ABE by using NFS, that if you want ABE then you don't want > NFS. I understand but I don't think it's an exception because it applies regardless of protocol. Any share over any protocol that does not enforce ABE will allow you to "bypass" ABE on other (ABE enabled) shares of the same directory hierarchy. Perhaps we can postpone this point until I resolve the NFS support question. >>> If I understand this case correctly the changes to the CIFS server to >>> support ABE will be minor, and so should be the changes to the NFS >>> server. Did I understand correctly? >> I would imagine that adding ABE support to NFS would be straight- >> forward because everything would be local, i.e. add the ability >> to set the ABE share property and have the NFS service interrogate >> that property for readdir requests. >> >> The CIFS service requires additional MSRPC work because the ABE >> property can be managed remotely (via the MMC on Windows clients) >> as well as locally via sharemgr, sharaesmb etc. >> >> I'll talk to the NFS team about introducing NFS ABE support at the >> same time as CIFS support. > > Thanks. > > The next question is whether it makes sense for ABE to be a share-level > option or a dataset property or directory xattr. I think the latter is > more appropriate if CIFS and NFS will both support ABE... We covered that in earlier discussion of this case. Alan From Nicolas.Williams@sun.com Thu Apr 23 16:22:39 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3NNMbQ6025132 for ; Thu, 23 Apr 2009 16:22:38 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n3NNMSYH026311; Fri, 24 Apr 2009 07:22:33 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIK00507U9J1J00@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 16:22:31 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIK00059U9JM030@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 16:22:31 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n3NNKUSA017532; Thu, 23 Apr 2009 18:20:30 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n3NNKUfD017531; Thu, 23 Apr 2009 18:20:30 -0500 (CDT) Date: Thu, 23 Apr 2009 18:20:30 -0500 From: Nicolas Williams Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <49F0F496.5040501@sun.com> To: Alan M Wright Cc: Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <20090423232029.GI1500@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> <20090423161254.GL1500@Sun.COM> <49F0ED34.1040303@sun.com> <20090423223923.GF1500@Sun.COM> <49F0F496.5040501@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 2143 On Thu, Apr 23, 2009 at 04:07:02PM -0700, Alan M Wright wrote: > On 04/23/09 15:39, Nicolas Williams wrote: > >What I meant was that if we don't have this feature in NFS then we > >should document that sharing with CIFS w/ ABE and NFS allows users to > >circumvent ABE by using NFS, that if you want ABE then you don't want > >NFS. > > I understand but I don't think it's an exception because it applies > regardless of protocol. Any share over any protocol that does not > enforce ABE will allow you to "bypass" ABE on other (ABE enabled) > shares of the same directory hierarchy. Perhaps we can postpone > this point until I resolve the NFS support question. Oh, well, if we want this to work for other protocols too (e.g., FTP) then we definitely need this to be a dataset property or directory xattr. How many services should we have to modify? > >The next question is whether it makes sense for ABE to be a share-level > >option or a dataset property or directory xattr. I think the latter is > >more appropriate if CIFS and NFS will both support ABE... > > We covered that in earlier discussion of this case. Yes, but I'm unconvinced. You wrote: | Enabling this property on local file systems may have undesirable side | effects. For example, backup/archiving applications may inadvertently | miss files (because the directory content visible to applications is not | dependent solely on having directory read permission with ABE | enabled). I don't think Windows allows ABE to be enabled on local | file systems, it is only available on shares. I would think that's a matter of making sure that backups run with sufficient privilege. (And/or making sure that NDMP circumvents ABE.) Just because Windows doesn't allow ABE on local filesystems doesn't mean that there's a good reason to disallow it. One might even argue that we definitely need something like ABE in a labeled environment. The more I think about ABE the more I think it needs to be at least a dataset prop and/or directory xattr. A share option that forces ABE on/off regardless of whether it's set in the dataset/direcoty would be nice too. Nico -- From Jordan.Brown@sun.com Thu Apr 23 16:23:16 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3NNNFAl025168 for ; Thu, 23 Apr 2009 16:23:15 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n3NNNFrC012417; Thu, 23 Apr 2009 16:23:15 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIK0080DUAPBV00@nwk-avmta-1.sfbay.Sun.COM>; Thu, 23 Apr 2009 16:23:13 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIK00388UANGV20@nwk-avmta-1.sfbay.Sun.COM>; Thu, 23 Apr 2009 16:23:11 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n3NNNBe8005659; Thu, 23 Apr 2009 16:23:11 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KIK00H00U7TMU00@fe-sfbay-10.sun.com>; Thu, 23 Apr 2009 16:23:11 -0700 (PDT) Received: from [129.145.155.183] ([unknown] [129.145.155.183]) by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KIK00MZWUAMUOD0@fe-sfbay-10.sun.com>; Thu, 23 Apr 2009 16:23:11 -0700 (PDT) Date: Thu, 23 Apr 2009 16:23:10 -0700 From: Jordan Brown Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <49F0F496.5040501@sun.com> Sender: Jordan.Brown@sun.com To: Alan M Wright Cc: Nicolas Williams , Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <49F0F85E.8090809@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=UTF-8 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> <20090423161254.GL1500@Sun.COM> <49F0ED34.1040303@sun.com> <20090423223923.GF1500@Sun.COM> <49F0F496.5040501@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080505) Status: RO Content-Length: 730 Alan M Wright wrote: >> The next question is whether it makes sense for ABE to be a share-level >> option or a dataset property or directory xattr. I think the latter is >> more appropriate if CIFS and NFS will both support ABE... > > We covered that in earlier discussion of this case. You know, I think the real answer to that question needs to be based on whether we think that ABE is an all-around useful feature, or just something we need for feature parity with other Windows file servers. If it's an all-around useful feature, then we should put it into the file system (to support local users) and maybe also put it into the sharing servers. If it's just for feature parity, then by all means confine it to CIFS. From Nicolas.Williams@sun.com Thu Apr 23 16:26:38 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3NNQb7K025246 for ; Thu, 23 Apr 2009 16:26:38 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n3NNQWhD028078; Fri, 24 Apr 2009 07:26:33 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIK00505UG9CT00@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 16:26:33 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIK000S2UG8LV30@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 16:26:33 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n3NNOViB017543; Thu, 23 Apr 2009 18:24:31 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n3NNOVZ5017542; Thu, 23 Apr 2009 18:24:31 -0500 (CDT) Date: Thu, 23 Apr 2009 18:24:31 -0500 From: Nicolas Williams Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <49F0F85E.8090809@sun.com> To: Jordan Brown Cc: Alan M Wright , Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <20090423232431.GJ1500@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> <20090423161254.GL1500@Sun.COM> <49F0ED34.1040303@sun.com> <20090423223923.GF1500@Sun.COM> <49F0F496.5040501@sun.com> <49F0F85E.8090809@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 779 On Thu, Apr 23, 2009 at 04:23:10PM -0700, Jordan Brown wrote: > You know, I think the real answer to that question needs to be based on > whether we think that ABE is an all-around useful feature, or just > something we need for feature parity with other Windows file servers. > > If it's an all-around useful feature, then we should put it into the file > system (to support local users) and maybe also put it into the sharing > servers. > > If it's just for feature parity, then by all means confine it to CIFS. IMO it shouldn't just be a matter of feature parity with Windows. Think Solaris TX, for example. But also, why not make the feature available in more contexts if it makes sense (either because it makes sense by itself or to avoid circumvention). Nico -- From amw@sun.com Thu Apr 23 16:33:38 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3NNXbdB025304 for ; Thu, 23 Apr 2009 16:33:37 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n3NNXaXR015673; Thu, 23 Apr 2009 16:33:37 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIK0090PUS1PQ00@nwk-avmta-1.sfbay.Sun.COM>; Thu, 23 Apr 2009 16:33:37 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIK003MTUS0GT20@nwk-avmta-1.sfbay.Sun.COM>; Thu, 23 Apr 2009 16:33:36 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n3NNXahn000477; Thu, 23 Apr 2009 23:33:36 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KIK00800UFWKG00@mail-amer.sun.com>; Thu, 23 Apr 2009 17:33:36 -0600 (MDT) Received: from [10.1.106.211] ([unknown] [10.1.106.211]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KIK00KS1URZQT10@mail-amer.sun.com>; Thu, 23 Apr 2009 17:33:36 -0600 (MDT) Date: Thu, 23 Apr 2009 16:33:20 -0700 From: Alan M Wright Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <20090423232029.GI1500@Sun.COM> Sender: Alan.M.Wright@sun.com To: Nicolas Williams Cc: Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <49F0FAC0.2060400@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> <20090423161254.GL1500@Sun.COM> <49F0ED34.1040303@sun.com> <20090423223923.GF1500@Sun.COM> <49F0F496.5040501@sun.com> <20090423232029.GI1500@Sun.COM> User-Agent: Thunderbird 2.0.0.14 (X11/20080630) Status: RO Content-Length: 2388 On 04/23/09 16:20, Nicolas Williams wrote: > On Thu, Apr 23, 2009 at 04:07:02PM -0700, Alan M Wright wrote: >> On 04/23/09 15:39, Nicolas Williams wrote: >>> What I meant was that if we don't have this feature in NFS then we >>> should document that sharing with CIFS w/ ABE and NFS allows users to >>> circumvent ABE by using NFS, that if you want ABE then you don't want >>> NFS. >> I understand but I don't think it's an exception because it applies >> regardless of protocol. Any share over any protocol that does not >> enforce ABE will allow you to "bypass" ABE on other (ABE enabled) >> shares of the same directory hierarchy. Perhaps we can postpone >> this point until I resolve the NFS support question. > > Oh, well, if we want this to work for other protocols too (e.g., FTP) > then we definitely need this to be a dataset property or directory > xattr. How many services should we have to modify? > >>> The next question is whether it makes sense for ABE to be a share-level >>> option or a dataset property or directory xattr. I think the latter is >>> more appropriate if CIFS and NFS will both support ABE... >> We covered that in earlier discussion of this case. > > Yes, but I'm unconvinced. You wrote: > > | Enabling this property on local file systems may have undesirable side > | effects. For example, backup/archiving applications may inadvertently > | miss files (because the directory content visible to applications is not > | dependent solely on having directory read permission with ABE > | enabled). I don't think Windows allows ABE to be enabled on local > | file systems, it is only available on shares. > > I would think that's a matter of making sure that backups run with > sufficient privilege. (And/or making sure that NDMP circumvents ABE.) > > Just because Windows doesn't allow ABE on local filesystems doesn't mean > that there's a good reason to disallow it. I'm not opposed to it, I just pointed out potential considerations. If you feel there's a valid use case, feel free to pursue it. Alan > One might even argue that we definitely need something like ABE in a > labeled environment. > > The more I think about ABE the more I think it needs to be at least a > dataset prop and/or directory xattr. A share option that forces ABE > on/off regardless of whether it's set in the dataset/direcoty would be > nice too. > > Nico From Afshin.Ardakani@sun.com Thu Apr 23 16:37:25 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3NNbO1Y025341 for ; Thu, 23 Apr 2009 16:37:25 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n3NNbIPK004001; Fri, 24 Apr 2009 07:37:23 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIK00601UYA1O00@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 16:37:22 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIK000B2UYAM840@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 16:37:22 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n3NNbMJm021505; Thu, 23 Apr 2009 16:37:22 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KIK00A00UXXOK00@fe-sfbay-10.sun.com>; Thu, 23 Apr 2009 16:37:22 -0700 (PDT) Received: from [10.1.106.212] ([unknown] [10.1.106.212]) by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KIK005ZIUY80Y10@fe-sfbay-10.sun.com>; Thu, 23 Apr 2009 16:37:21 -0700 (PDT) Date: Thu, 23 Apr 2009 16:37:13 -0700 From: Afshin Salek Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <20090423232431.GJ1500@Sun.COM> Sender: Afshin.Ardakani@sun.com To: Nicolas Williams Cc: Jordan Brown , Alan M Wright , Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <49F0FBA9.8030308@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> <20090423161254.GL1500@Sun.COM> <49F0ED34.1040303@sun.com> <20090423223923.GF1500@Sun.COM> <49F0F496.5040501@sun.com> <49F0F85E.8090809@sun.com> <20090423232431.GJ1500@Sun.COM> User-Agent: Thunderbird 2.0.0.9 (X11/20080213) Status: RO Content-Length: 1147 Note that, even if this is a file system setting there's still no guarantee that the same user gets the same view over different protocols or locally. At least it wouldn't be the case for CIFS against the rest of methods because when connecting over CIFS a user would also have his/her Windows groups in the cred. Afshin Nicolas Williams wrote: > On Thu, Apr 23, 2009 at 04:23:10PM -0700, Jordan Brown wrote: >> You know, I think the real answer to that question needs to be based on >> whether we think that ABE is an all-around useful feature, or just >> something we need for feature parity with other Windows file servers. >> >> If it's an all-around useful feature, then we should put it into the file >> system (to support local users) and maybe also put it into the sharing >> servers. >> >> If it's just for feature parity, then by all means confine it to CIFS. > > IMO it shouldn't just be a matter of feature parity with Windows. > > Think Solaris TX, for example. But also, why not make the feature > available in more contexts if it makes sense (either because it makes > sense by itself or to avoid circumvention). > > Nico From amw@sun.com Thu Apr 23 16:45:29 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3NNjSnY025374 for ; Thu, 23 Apr 2009 16:45:28 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n3NNjGHH008553; Fri, 24 Apr 2009 07:45:27 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIK00I03VBOP900@brm-avmta-1.central.sun.com>; Thu, 23 Apr 2009 17:45:24 -0600 (MDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIK00DOWVBN6S20@brm-avmta-1.central.sun.com>; Thu, 23 Apr 2009 17:45:23 -0600 (MDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n3NNjNGJ003765; Thu, 23 Apr 2009 23:45:23 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KIK00400V2LDL00@mail-amer.sun.com>; Thu, 23 Apr 2009 17:45:23 -0600 (MDT) Received: from [10.1.106.211] ([unknown] [10.1.106.211]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KIK00G42VBKWI30@mail-amer.sun.com>; Thu, 23 Apr 2009 17:45:22 -0600 (MDT) Date: Thu, 23 Apr 2009 16:45:05 -0700 From: Alan M Wright Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <49F0FBA9.8030308@sun.com> Sender: Alan.M.Wright@sun.com To: Afshin Salek Cc: Nicolas Williams , Jordan Brown , Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <49F0FD81.20200@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> <20090423161254.GL1500@Sun.COM> <49F0ED34.1040303@sun.com> <20090423223923.GF1500@Sun.COM> <49F0F496.5040501@sun.com> <49F0F85E.8090809@sun.com> <20090423232431.GJ1500@Sun.COM> <49F0FBA9.8030308@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080630) Status: RO Content-Length: 1458 That's a good point - ABE is not a security feature per se. While "out of sight, out of mind" may be desirable it doesn't supplant the need to set the appropriate ACLs and security measures to enforce the desired security policy. Alan On 04/23/09 16:37, Afshin Salek wrote: > Note that, even if this is a file system setting there's still no > guarantee that the same user gets the same view over different > protocols or locally. At least it wouldn't be the case for CIFS > against the rest of methods because when connecting over CIFS a > user would also have his/her Windows groups in the cred. > > Afshin > > Nicolas Williams wrote: >> On Thu, Apr 23, 2009 at 04:23:10PM -0700, Jordan Brown wrote: >>> You know, I think the real answer to that question needs to be based >>> on whether we think that ABE is an all-around useful feature, or just >>> something we need for feature parity with other Windows file servers. >>> >>> If it's an all-around useful feature, then we should put it into the >>> file system (to support local users) and maybe also put it into the >>> sharing servers. >>> >>> If it's just for feature parity, then by all means confine it to CIFS. >> >> IMO it shouldn't just be a matter of feature parity with Windows. >> >> Think Solaris TX, for example. But also, why not make the feature >> available in more contexts if it makes sense (either because it makes >> sense by itself or to avoid circumvention). >> >> Nico From amw@sun.com Thu Apr 23 16:49:39 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3NNndie025392 for ; Thu, 23 Apr 2009 16:49:39 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n3NNnaO7002104; Thu, 23 Apr 2009 16:49:38 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIK00J0FVIO3300@brm-avmta-1.central.sun.com>; Thu, 23 Apr 2009 17:49:36 -0600 (MDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIK00DD1VIN6X30@brm-avmta-1.central.sun.com>; Thu, 23 Apr 2009 17:49:35 -0600 (MDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n3NNnZfr001408; Thu, 23 Apr 2009 23:49:35 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KIK00B00VFOAJ00@mail-amer.sun.com>; Thu, 23 Apr 2009 17:49:35 -0600 (MDT) Received: from [10.1.106.211] ([unknown] [10.1.106.211]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KIK00G77VIDWI30@mail-amer.sun.com>; Thu, 23 Apr 2009 17:49:27 -0600 (MDT) Date: Thu, 23 Apr 2009 16:49:10 -0700 From: Alan M Wright Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <49F0FD81.20200@sun.com> Sender: Alan.M.Wright@sun.com To: Afshin Salek Cc: Nicolas Williams , Jordan Brown , Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <49F0FE76.70508@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> <20090423161254.GL1500@Sun.COM> <49F0ED34.1040303@sun.com> <20090423223923.GF1500@Sun.COM> <49F0F496.5040501@sun.com> <49F0F85E.8090809@sun.com> <20090423232431.GJ1500@Sun.COM> <49F0FBA9.8030308@sun.com> <49F0FD81.20200@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080630) Status: RO Content-Length: 1823 On 04/23/09 16:45, Alan M Wright wrote: > That's a good point - ABE is not a security feature per se. > > While "out of sight, out of mind" may be desirable it doesn't supplant > the need to set the appropriate ACLs and security measures to enforce > the desired security policy. Also, even if you can "bypass" ABE via an alternate share, any file that was being filtered out by ABE must be inaccessible by definition, i.e. you may be able to see additional files via the non-ABE share but the ACLs will not grant you any access to those files. Alan > Alan > > On 04/23/09 16:37, Afshin Salek wrote: >> Note that, even if this is a file system setting there's still no >> guarantee that the same user gets the same view over different >> protocols or locally. At least it wouldn't be the case for CIFS >> against the rest of methods because when connecting over CIFS a >> user would also have his/her Windows groups in the cred. >> >> Afshin >> >> Nicolas Williams wrote: >>> On Thu, Apr 23, 2009 at 04:23:10PM -0700, Jordan Brown wrote: >>>> You know, I think the real answer to that question needs to be based >>>> on whether we think that ABE is an all-around useful feature, or >>>> just something we need for feature parity with other Windows file >>>> servers. >>>> >>>> If it's an all-around useful feature, then we should put it into the >>>> file system (to support local users) and maybe also put it into the >>>> sharing servers. >>>> >>>> If it's just for feature parity, then by all means confine it to CIFS. >>> >>> IMO it shouldn't just be a matter of feature parity with Windows. >>> >>> Think Solaris TX, for example. But also, why not make the feature >>> available in more contexts if it makes sense (either because it makes >>> sense by itself or to avoid circumvention). >>> >>> Nico > > From Jordan.Brown@sun.com Thu Apr 23 19:14:37 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3O2EbdD027336 for ; Thu, 23 Apr 2009 19:14:37 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n3O2Eajv028855; Thu, 23 Apr 2009 19:14:37 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIL00G0528DP500@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 19:14:37 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIL0003028CLRC0@nwk-avmta-2.sfbay.sun.com>; Thu, 23 Apr 2009 19:14:36 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n3O2EaOS014890; Thu, 23 Apr 2009 19:14:36 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KIL007001ZX9E00@fe-sfbay-10.sun.com>; Thu, 23 Apr 2009 19:14:36 -0700 (PDT) Received: from [129.145.155.183] ([unknown] [129.145.155.183]) by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KIL00A3328CTB80@fe-sfbay-10.sun.com>; Thu, 23 Apr 2009 19:14:36 -0700 (PDT) Date: Thu, 23 Apr 2009 19:14:36 -0700 From: Jordan Brown Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <20090423232431.GJ1500@Sun.COM> Sender: Jordan.Brown@sun.com To: Nicolas Williams Cc: Alan M Wright , Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <49F1208C.5040608@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=UTF-8 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200904201422.n3KEMuN0026625@spidey.Central.Sun.COM> <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> <20090423161254.GL1500@Sun.COM> <49F0ED34.1040303@sun.com> <20090423223923.GF1500@Sun.COM> <49F0F496.5040501@sun.com> <49F0F85E.8090809@sun.com> <20090423232431.GJ1500@Sun.COM> User-Agent: Thunderbird 2.0.0.14 (X11/20080505) Status: RO Content-Length: 507 Nicolas Williams wrote: > IMO it shouldn't just be a matter of feature parity with Windows. > > Think Solaris TX, for example. But also, why not make the feature > available in more contexts if it makes sense (either because it makes > sense by itself or to avoid circumvention). Because it costs effort to do. If the only demand for this feature is from pure Windows shops, if we don't think it's a good general-purpose feature, we shouldn't spend the effort to support it anywhere other than CIFS. From Nicolas.Williams@sun.com Fri Apr 24 08:28:01 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3OFRx3O024368 for ; Fri, 24 Apr 2009 08:28:00 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n3OFRTQ1016187; Fri, 24 Apr 2009 23:27:55 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KIM00I0L2YHGD00@nwk-avmta-2.sfbay.sun.com>; Fri, 24 Apr 2009 08:27:53 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KIM00I4W2YGCV00@nwk-avmta-2.sfbay.sun.com>; Fri, 24 Apr 2009 08:27:52 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n3OFPpVs017762; Fri, 24 Apr 2009 10:25:51 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n3OFPpGO017761; Fri, 24 Apr 2009 10:25:51 -0500 (CDT) Date: Fri, 24 Apr 2009 10:25:51 -0500 From: Nicolas Williams Subject: Re: ZFS support for Access Based Enumeration [PSARC/2009/246 FastTrack timeout 04/27/2009] In-reply-to: <49F1208C.5040608@sun.com> To: Jordan Brown Cc: Alan M Wright , Darren J Moffat , Tim Haley , PSARC-ext@sun.com, cifs-eng@sun.com, zfs-eng@sun.com Message-id: <20090424152551.GM1500@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <49EEDC5D.2040009@Sun.COM> <7EC116220A7B4D9E909248806415DBB7@TOSHIBA> <20090422150421.GC1500@Sun.COM> <20090423161254.GL1500@Sun.COM> <49F0ED34.1040303@sun.com> <20090423223923.GF1500@Sun.COM> <49F0F496.5040501@sun.com> <49F0F85E.8090809@sun.com> <20090423232431.GJ1500@Sun.COM> <49F1208C.5040608@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 901 On Thu, Apr 23, 2009 at 07:14:36PM -0700, Jordan Brown wrote: > Nicolas Williams wrote: > >IMO it shouldn't just be a matter of feature parity with Windows. > > Because it costs effort to do. A dataset property would cost the CIFS team nothing. It would cost the ZFS team a little extra code, but since they're doing the lion's share of the work in this case, so the extra code is marginal for them and a savings for you. > If the only demand for this feature is from pure Windows shops, if we don't > think it's a good general-purpose feature, we shouldn't spend the effort to > support it anywhere other than CIFS. That is the important question. I'm not sure what the answer is. I can see label-aware ABE being valuable down the line, and I don't think the share option paints us into a corner w.r.t. adding a dataset property or directory xattr for ABE later. So I'll drop this for now.