But there is 1 thing that both of you forgot to account for,
how much load it would take in order for the deny ACL's to be
loaded and to be read, several times over in a given hour. Any
comments on that front? -- Jonathan

--
Jonathan M. Slivko                  js43064npace.edu
Head Systems Administrator          4EverMail Hosting Services
--
---------- Original Message ----------------------------------
From: Robert Watson <rwatsonfreebsd.org>
Date: Sun, 19 Aug 2001 21:29:59 -0400 (EDT)
>
>On Sun, 19 Aug 2001, Ken Cross wrote:
>
>> The current Posix.1e ACL implementation in -current works great 
as far
>> as it goes.  I'm sure this has been kicked around before 
(although I
>> couldn't find anything in the archives), but it seems like 
adding "deny"
>> ACL's would be a useful and fairly straightforward extension. 
>> 
>> For those not familiar with it, deny ACL's are ACL's that 
explicitly
>> deny access, e.g., group Accountants are allowed access, but 
user George
>> is denied access even though he is a member of Accountants. 
>>
>> They are used extensively in the Windows NT/2K world and I need 
to
>> support them on a BSD platform.  The implementation is pretty
>> straightforward -- always check deny ACL's first and then 
access ACL's. 
>> They'd just be a new acl_type_t value (ACL_TYPE_DENY?). 
>> 
>> I'd be happy to help with the implementation (especially since 
I'll be
>> doing it regardless).  Any interest or things I should know 
about? 
>
>There are some interesting questions about how you would combine 
the
>POSIX.1e ACL evaluation with subtractive rights of the sort 
you're
>talking
>about.  POSIX.1e does evaluation by a combination of first/best 
match.
>It evaluates based on a "first match" of the general class of 
rights, and
>then "best match" within that class.  Here's the current 
algorithm based
>on what's defined in POSIX.1e:
>
>Select a "matching" class using the following:
>
>(1) if effective uid == the file owner, then the file owner 
permissions
>are used
>
>(2) if the effective uid == one of the additional users, then the
>additional user permissions in question are used
>
>(3) "best match" from effective gid and additional groups using 
the base
>group permissions and additional groups.  "best" in this case is 
defined
>as the first gid match that grants all the rights requested.  I 
don't
>believe that, in the event there are multiple matches, there is a 
defined
>ordering for the match, but in the FreeBSD implementation, it 
matches the
>effective uid before additional groups. 
>
>(4) other
>
>So, if you want "subtractive rights" that mix with positive 
rights, we'll
>actually need to fundamentally modify how the algorithm executes. 
 Right
>now, it is possible to express some sorts of "negative" rights by 
taking
>advantage of knowledge of the fixed matching components of the 
algorith;
>the "best" matching in the group section does foil some useful 
attempts.
>
>You might want to bring this up on the POSIX.1e mailing list, 
btw, and see
>what thoughts the developers of other platforms have on the 
topic, or
>whether this has been approached on other POSIX.1e-esque 
platforms.  I'm
>glad that the existing ACL implementation is coming in useful for 
you.
>
>Robert N M Watson             FreeBSD Core Team, TrustedBSD 
Project
>robertfledge.watson.org      NAI Labs, Safeport Network Services
>
>
>To Unsubscribe: send mail to majordomoFreeBSD.org
>with "unsubscribe freebsd-security" in the body of the message
>
 
__________________________________________________________________
____
Sent via the Pace University Mail system at stmail.pace.edu
 
                   
To Unsubscribe: send mail to majordomoFreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]