Implementing Native NFSv4 ACLs in Linux
Channel: Linux.conf.au 2009 -- Hobart, Australia
Date: 08/12/2014

Presenter(s): Greg Banks
URL: http://www.linux.org.au/conf/2009/programme/schedule/view_talk/79%3Fday=friday.html

The NFSv4 standard defines an advanced security model which providesdetailed and flexible Access Control Lists. These allow systemadministrators very fine-grained control of user privileges over files.Unlike the traditional POSIX access model using a 9-bit mask, NFSv4ACLs allow privileges to be granted to more detailed sets of usersthan just the file's owner, the file's group, or everyone else. Forexample, you can express rules like "all the people in Accounts canread this file, the Auditors can read this file, Fred can write it,and nobody else can read or write it".Unlike the draft POSIX standard ACL model, NFSv4 ACLs provide afiner grained set of privileges that can be granted, and also allowthe system administrator to deny privileges as all grant them.This makes it much easier to express some security policies. Forexample, you can express rules like "all the people in Accounts canread this file, except Jane".SE/Linux fans please note: this is Discretionary Access Control,*not* Mandatory Access Control nor Multi Level Security.Linux supports NFSv4 ACLs...kinda. Few filesystems support NFSv4ACLs, so ACLs usually only come into play when files are beingaccessed remotely via NFS or CIFS. For example, the NFS server andSamba can use native filesystem support for POSIX ACLs to implementpoor approximations of NFSv4 ACLs. There are a number of technicaldifficulties with this approach which make it unattractive.On the other hand, NFSv4 ACLs are rather an attractive feature of aNAS file server, especially one where Windows clients using the CIFSprotocol need to co-exist with Linux clients using NFS. The NFSv4ACL model is quite close (but not identical) to the Windows model,so the mapping is relatively straightforward.In 2008 SGI decided to implement end-to-end native NFSv4 ACL supportas part of our NAS file server product. In collaboration with AndreasGruenbacher of SUSE, we conducted a cross-team effort includingcontributions to XFS, ext3, the Linux VFS, Samba, and the NFS serverand client.In this talk I'll describe how the NFSv4 ACL model works, and contrastit to the POSIX model you're probably more familiar with. I'll coverthe theoretical and practical challenges we encountered when choosing whatparts of the standard to implement and how accurately to implement them.I'll talk about the organisational challenges involved, and brieflycover how the code hangs together.People with an interest in kernel development, enterprise file serving,networking, or security will get the most out of this talk.

http://lca2009.linux.org.au - http://www.linux.org.au
CC BY-SA - http://creativecommons.org/licenses/by-sa/4.0/legalcode.txt