Messages in this thread | | | Date | Thu, 16 Aug 2007 16:12:02 -0700 | From | "H. Peter Anvin" <> | Subject | Re: Thinking outside the box on file systems |
| |
Marc Perkel wrote: > Yep - way outside the box - and thus the title of the > thread. > > The idea is that people have permissions - not files. > By people I mean users, groups, managers, applications > etc. One might even specify that there are no > permission restrictions at all. Part of the process > would be that the kernel load what code it will use > for the permission system. It might even be a little > perl script you write.
This isn't anything new. It is, in fact, described in many places.
Permissions can, most generally, be described as a matrix of objects and security domains. This matrix is large and, generally, highly regular. If we slice the matrix up and associate each column with an object, we call it an "access control list". If we slice the matrix up and associate each row with a security domain, we call it a "capability."
These can be, and often are, daisy-chained, so that an access control list can contain "all possessors of capability X", for example.
Groups in Unix are, in fact, a form of capabilities.
-hpa
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |