Re: [PATCH 01/11] Security: Add hook to get full maclabel xattr name

[Trond Myklebust <trond.myklebust@fys.uio.no>]

On Fri, 2008-02-29 at 09:46 -0800, Casey Schaufler wrote:
> > There is no room for extensions that allow clients+servers to establish
> > arbitrary private protocols.
> 
> I think that I understand that you believe that, what I
> don't understand is why you believe that. Is it an artifact
> of the locking protocol that only worked about half the
> time, and then in a half donkied way?
> 
> I'm not trying to be an obstructionist idiot here, even if
> that's how it may appear. I have my pet solution, I really
> don't see the problem with it, and it looks to me like the
> arguements against it are either so obvious I'm missing them
> (does happen) or based on dogmas I don't subscribe to.
> 
> Thank you for helping me (and maybe some others) understand
> the issues we're up against so that I (we) can address issues
> better in the future.

Two of the main reasons for NFS's success as a protocol are the facts
that it is (more or less) standardized, while remaining (again more or
less) back-end agnostic. I can take pretty much any client from any one
vendor and any server from any other vendor, and make them work
together.

The reason why this works is mainly because the protocol has built upon
a consensus assumption of POSIX filesystem semantics on the servers
(hence, BTW, the pain when the IETF requested that we add
Microsoft-compatible semantics to NFSv4 as a precondition for making it
a standard).

If you look back at the NFS extensions that failed, and fell by the
road, then they tend to be the semi-private non-posix extensions
(typically ACL semantics, xattrs/named attributes, "secure NFS",...)
which break the underlying assumption that I can mix and match clients
and servers.

<rhetorical>Does that mean that we shouldn't provide extensions
protocols for doing these things?</rhetorical> Of course not... The
point about such extensions is that they need to be agreed upon by the
NFS community/stakeholders, in much the same way that any changes to the
kernel need to be agreed upon by the Linux community/stakeholders.

Adding a mechanism that allows subsets of clients/servers to set up
private protocols circumvents that consensus process, and are therefore
a bad thing, and should be avoided. That would be engaging in the exact
same "embrace, extend and extinguish" tactics for which we keep
criticizing certain other monopolists.

This should be a no-brainer...

Trond