lkml.org 
[lkml]   [1999]   [Feb]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: linux capabilities and ACLs
Albert D. Cahalan writes:
> Chris Ricker writes:
> > On Fri, 5 Feb 1999, Albert D. Cahalan wrote:
> >
> >> Roughly: the read-write-execute permissions are broken down into
> >> six basix permissions and some object-specific (file, dir, etc.)
> >> permissions. Access may be explicitly granted or denied. As far
> >> as I remember (don't make me boot NT), denial is applied last.
> >> You can mark files for auditing success or failure of various
> >> permission bits. Inheritance can apply to files, directories,
> >> both, or neither. Inheritance can be one-time-only.
> >
> > If I remember correctly, I think denail is applied first, not last.
>
> As I think about this, I realize it is a useless distinction.
>
> int deny_last(ACL *a){
> int access = ACCESS_DEFAULT;
> if(access_grant(a)) access = 1;
> if(access_deny(a)) access = 0;
> return access;
> }
>
> int deny_first(ACL *a){
> if(access_deny(a)) return 0;
> if(access_grant(a)) return 1;
> return ACCESS_DEFAULT;
> }

Erm, unless the model for deny last is:
int deny_last(ACL *a){
if(access_grant(a)) return 1;
if(access_deny(a)) return 0;
return ACCESS_DEFAULT;
}

I don't see any particular reason why one approach (to deny last) is
better than the other.

Regards,

Richard....

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:50    [W:0.027 / U:2.592 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site