Re: 'noacl' NFS parameter seems ineffective (Fedora Core 7)

[Peter Staubach <staubach@redhat.com>]

Trond Myklebust wrote:
> On Thu, 2007-07-05 at 17:19 -0400, Peter Staubach wrote:
>   
>> Actually, all that the "noacl" mount option means is to not attempt
>> to get or set or ACLs on the server.  It does not affect the security
>> checking that the client does to verify access.
>>
>> The permission bits are not enough to determine access permissions.
>> Root mapping on the server is an easy example of this.  Therefore,
>> the client always goes over the wire to query the server for the
>> permissions that it will allow.
>>     
>
> Right. The confusion here stems from the fact that SuSE attempted to
> make "noacl" mean both "I will not get/set any posix acls" and "there
> are no acls on the server" in their kernels.
>
> The common practice of root mapping blows that argument right out of the
> water, and so I never applied the parts of their ACL patches that switch
> off ACCESS calls.

Yes, I think that RHEL-4 had that bug too, at least for a while.  (I hope
only for a while... :-) )

It was misguided on someone's part to think that no ACLs meant that
checking the mode bits for permissions was sufficient.

    Thanx...

       ps


-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs