What is the expected behavior for the default-deny-all extension?

[serega911]

Hi!

In the ietf-netconf-acm.yang, nacm container is marked as nacm:default-deny-all:

  container nacm {
    nacm:default-deny-all;

    description
      "Parameters for NETCONF access control model.";

From my testing I see that it does not add any restriction to the operations I am allowed to perform for this module: I still can read and write values to it via the NETCONF session. Is it a bug? I would expect NETCONF server to reject the configuration.

Could you please clarify whether nacm:default-deny-all has real impact on the operation or it is just informative.

-Sergii

[michalvasko]

Yes, it is supposed to block access for all the users without an explicit permit NACM rule. The observed behavior can be explained if you are using the recovery user (root by default) which has access to everything or you have disabled NACM.

[serega911]

Thank you!