Messages in this thread | | | Date | Sat, 6 Feb 1999 12:08:45 +1100 | From | Richard Gooch <> | Subject | Re: linux capabilities and ACLs |
| |
Albert D. Cahalan writes: > Chris Ricker writes: > > On Fri, 5 Feb 1999, Albert D. Cahalan wrote: > > > >> Roughly: the read-write-execute permissions are broken down into > >> six basix permissions and some object-specific (file, dir, etc.) > >> permissions. Access may be explicitly granted or denied. As far > >> as I remember (don't make me boot NT), denial is applied last. > >> You can mark files for auditing success or failure of various > >> permission bits. Inheritance can apply to files, directories, > >> both, or neither. Inheritance can be one-time-only. > > > > If I remember correctly, I think denail is applied first, not last. > > As I think about this, I realize it is a useless distinction. > > int deny_last(ACL *a){ > int access = ACCESS_DEFAULT; > if(access_grant(a)) access = 1; > if(access_deny(a)) access = 0; > return access; > } > > int deny_first(ACL *a){ > if(access_deny(a)) return 0; > if(access_grant(a)) return 1; > return ACCESS_DEFAULT; > }
Erm, unless the model for deny last is: int deny_last(ACL *a){ if(access_grant(a)) return 1; if(access_deny(a)) return 0; return ACCESS_DEFAULT; }
I don't see any particular reason why one approach (to deny last) is better than the other.
Regards,
Richard....
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |