Subject: [Netconf] nacm extensions in draft-ietf-netconf-access-control-02.txt

From: Bert Wijnen <[email-masked]>
Date: Thu, 10 Mar 2011 15:35:01 +0100

Here is one of them:

      extension secure {
        description
          "Used to indicate that the data model node
           represents a sensitive security system parameter.

           If present, the NETCONF server will only allow
           the designated 'superuser' to have write or execute
           default nacm-rights-type for the node.  An explicit access
           control rule is required for all other users.

           The 'secure' extension may appear within a data, rpc,
           or notification node definition.  It is ignored
           otherwise.";
      }

The 2nd para is conflicting with what I see in sect 3.3.5,
where the first bullet says:

    1.   If the <enable-nacm> parameter is set to 'false', then the data
         node access request is permitted.

And I believe that I read someplace else in the document that also
at the very first start, there may be no NACM config defined yet.

Bert