Re: linux capabilities and ACLs

Albert D. Cahalan (acahalan@cs.uml.edu)
Fri, 5 Feb 1999 12:06:58 -0500 (EST)


David Weinehall writes:
> On Thu, 4 Feb 1999, Albert D. Cahalan wrote:
>> ralf@uni-koblenz.de
>>
>>> ACLs were specified in POSIX 1003.1e and 1003.2c.
>>> However these drafts have been dropped.
>>
>> Good. POSIX ACLs are awful. Somebody stop the ext2 developers before
>> it is too late. With a tiny bit of thought, it should be obvious
>> that the inheritance system is broken. ACL systems that are much better
>> include those of NT, Netware, Digital Unix...
>>
>> Considering the power (yes!) and popularity of NT ACLs, they would
>> be a better choice than Netware or Digital Unix ACLs.
>
> The most powerful file-system of those mentioned is that of Netware,
> no doubt. Not even NT5 will come close.

I think you just don't like Microsoft. It is very bad to let your
hatred of Microsoft cloud your judgement.

NT has an ACL model that can emulate the Netware and POSIX ones.
It is good even before you consider smbfs, Samba, NTFS, and Wine.

Roughly: the read-write-execute permissions are broken down into
six basix permissions and some object-specific (file, dir, etc.)
permissions. Access may be explicitly granted or denied. As far
as I remember (don't make me boot NT), denial is applied last.
You can mark files for auditing success or failure of various
permission bits. Inheritance can apply to files, directories,
both, or neither. Inheritance can be one-time-only.

Here is a real need that NT can satisfy:

Wietse Venema (mail system author) wants:
% ACLs that allow me to specify: this maildrop directory has file
% create permission for every user; this maildrop file has read and
% delete permission for the mail system.

Stephan Zegherd <inverter@nbs.it> seems to be doing ACL support for NTFS.
Anyone doing ext2 should consider working with the NTFS people.

>> BTW: the admin tools on NT do not expose the awesome power of the
>> underlying architecture. There is more than meets the eye.
>
> How come then that almost every professional system that uses NT (ok, it
> might not be professional to use NT, but anyway...) has Netware installed
> on top of it?! Security and the Filesystem/Management is the answer.

Security means more than ACL support. Microsoft screwed up some of
the authentication. Also, Netware is a business tradition.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/