From: "Matt W. Benjamin" <matt@linuxbox.com>
To: Dros Adamson <Weston.Adamson@netapp.com>
Cc: linux-nfs <linux-nfs@vger.kernel.org>,
Trond Myklebust <Trond.Myklebust@netapp.com>
Subject: Re: [PATCH] NFSv4: use mach cred for SECINFO_NO_NAME w/ integrity
Date: Thu, 5 Sep 2013 08:50:17 -0400 (EDT) [thread overview]
Message-ID: <931669980.21.1378385417507.JavaMail.root@thunderbeast.private.linuxbox.com> (raw)
In-Reply-To: <FA5ED61A-3218-4E18-816D-FDAA948BED48@netapp.com>
Hi,
----- "Dros Adamson" <Weston.Adamson@netapp.com> wrote:
> On Sep 4, 2013, at 12:29 PM, Matt W. Benjamin <matt@linuxbox.com>
> wrote:
>
> > Hi
> >
> > It honestly feels quite odd to me for sec=sys to actually connote
> krb5i.
>
> I should point out that my patches don't introduce the use of krb5i
> here, they just fix it.
Ack.
>
> I personally don't think it's weird for the client to use a *more*
> secure flavor for certain (infrequent) operations when it makes sense.
> What worries me that currently sec=krb5p can cross a SECINFO boundary
> and suddenly be using sec=sys!
I think the behavior is obviously reasonable, but giving that policy a
different name would allow sec=sys to continue mean what it says.
>
> I'm testing patches that fix that now and also allow multiple sec=
> options (in the same form as nfsd exports, i.e. sec=krb5:krb5i, but
> I'm trying to fix all the recent regressions surrounding auth flavors
> / SECINFO first...
That sounds great.
>
> -dros
>
> >
Thanks,
Matt
--
Matt Benjamin
The Linux Box
206 South Fifth Ave. Suite 150
Ann Arbor, MI 48104
http://linuxbox.com
tel. 734-761-4689
fax. 734-769-8938
cel. 734-216-5309
next prev parent reply other threads:[~2013-09-05 12:50 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <983545972.85.1378311975965.JavaMail.root@thunderbeast.private.linuxbox.com>
2013-09-04 16:29 ` [PATCH] NFSv4: use mach cred for SECINFO_NO_NAME w/ integrity Matt W. Benjamin
2013-09-04 16:53 ` Adamson, Dros
2013-09-05 12:50 ` Matt W. Benjamin [this message]
2013-09-05 15:26 ` Adamson, Dros
2013-09-04 16:13 Weston Andros Adamson
2013-09-04 16:24 ` Myklebust, Trond
2013-09-04 16:48 ` Adamson, Dros
2013-09-05 0:45 ` Myklebust, Trond
2013-09-05 14:07 ` Dr James Bruce Fields
2013-09-05 15:17 ` Adamson, Dros
2013-09-05 15:31 ` Dr James Bruce Fields
2013-09-05 17:05 ` Adamson, Dros
2013-09-05 17:22 ` Dr James Bruce Fields
2013-09-05 17:25 ` Myklebust, Trond
2013-09-05 18:31 ` Adamson, Dros
2013-09-05 20:40 ` J. Bruce Fields
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=931669980.21.1378385417507.JavaMail.root@thunderbeast.private.linuxbox.com \
--to=matt@linuxbox.com \
--cc=Trond.Myklebust@netapp.com \
--cc=Weston.Adamson@netapp.com \
--cc=linux-nfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).