[OpenAFS-port-darwin] Realmodes on Tiger

[Chuck Boeheim]

Hi Folks,
Recent candidate releases for Tiger have been vastly improved,
and we very much appreciate the hard work.  It looks like
the Realmodes hack doesn't work yet, though, and that's a
showstopper for us.  The afssettings program says

afssettings: sysctl 3.20.1.0.1 => 1: Operation not supported on socket

when it's run.  My question has two parts: first, what's the
prognosis on getting this to operate in Tiger?

Second, I would like to make a plea to make Realmodes=TRUE the
default setting, for these reasons:

1. It's bad to have basic behavior by AFS vary between client OSs.
    This isn't even matching any behavior of native filesystems that
    might be expected by OS tools.  It's just a hack to make the
    Finder work better, and it would be better to explicitly enable
    the variant behavior than to make it the default.
2. It introduces security problems.  Files copied from AFS to local
    filesystems all too easily become world-writable.  If they are
    copied from AFS to NFS by someone on a Mac client, as many of
    our users do, this can be a huge exposure.
3. Some security-conscious programs will refuse to use config files
    that are group or world writable.  When these files are properly
    protected via ACL and permission bits in the filesystem, and
    there is no problem using them from other clients, it's confusing
    to the users that it doesn't work on Mac OS, and can't be
    worked around. Example programs are PGP (GPG) and SSH.

It seems like moving to the 1.4 AFS series and the 10.4 OS
level is the right time to make this change in behavior.

Chuck Boeheim
boeheim@slac.stanford.edu
Stanford Linear Accelerator Center