Re: Thinking outside the box on file systems

[H. Peter Anvin]

Marc Perkel wrote:
> Yep - way outside the box - and thus the title of the
> thread.
> 
> The idea is that people have permissions - not files.
> By people I mean users, groups, managers, applications
> etc. One might even specify that there are no
> permission restrictions at all. Part of the process
> would be that the kernel load what code it will use
> for the permission system. It might even be a little
> perl script you write.

This isn't anything new.  It is, in fact, described in many places.

Permissions can, most generally, be described as a matrix of objects and
security domains.  This matrix is large and, generally, highly regular.
 If we slice the matrix up and associate each column with an object, we
call it an "access control list".  If we slice the matrix up and
associate each row with a security domain, we call it a "capability."

These can be, and often are, daisy-chained, so that an access control
list can contain "all possessors of capability X", for example.

Groups in Unix are, in fact, a form of capabilities.

	-hpa

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/