Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1231705

Re: [RFC v7 26/41] richacl: Apply the file masks to a richacl

Show all headers | View raw

2015-09-23 21:18 GMT+02:00 J. Bruce Fields <bfields@fieldses.org>:
> On Tue, Sep 22, 2015 at 03:11:08PM -0400, bfields wrote:
>> user aces like owner aces what you intended to do,
>> and if so, why?
>
> That does look wrong to me; in an example like:
>
>         file owner bfields
>         mask 0700, not WRITE_THROUGH
>         bfields:rwx::allow
>
> The permission algorithm grants nothing to anyone, but it looks to me
> like richacl_apply_masks just leaves this as
>
>         bfields:rwx::allow
>
> but it would give the right result (an empty/deny-all ACL) if it weren't
> for this odd case here.

In POSIX ACLs, only the entry that best matches the process determines
the access permissions. For the file owner, this would always be the
"user::" entry, and such an entry always exists.

In richacls, permissions from multiple entries do accumulate; the
permission check algorithm does not pick a "best match". When bfields
owns a file and a "bfields:rwx::allow" entry exists, denying rwx
access to bfields would be very surprising. It makes more sense to put
user entries that match the current owner into the owner class, and
apply the owner mask instead of the group mask. This was working in an
earlier version but apparently broke at some point.

So the result that richacl_apply_masks computes here is correct, and
the permission check algorithm needs a little fix.

Thanks,
Andreas
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: [RFC v7 26/41] richacl: Apply the file masks to a richacl bfields@fieldses.org (J. Bruce Fields) - 2015-09-22 21:20 +0200
  Re: [RFC v7 26/41] richacl: Apply the file masks to a richacl "J. Bruce Fields" <bfields@fieldses.org> - 2015-09-23 21:20 +0200
    Re: [RFC v7 26/41] richacl: Apply the file masks to a richacl Andreas Gruenbacher <agruenba@redhat.com> - 2015-09-23 22:30 +0200
      Re: [RFC v7 26/41] richacl: Apply the file masks to a richacl "J. Bruce Fields" <bfields@fieldses.org> - 2015-09-23 22:40 +0200
        Re: [RFC v7 26/41] richacl: Apply the file masks to a richacl Andreas Gruenbacher <agruenba@redhat.com> - 2015-09-23 22:50 +0200
          Re: [RFC v7 26/41] richacl: Apply the file masks to a richacl "J. Bruce Fields" <bfields@fieldses.org> - 2015-09-23 23:10 +0200
            Re: [RFC v7 26/41] richacl: Apply the file masks to a richacl Andreas Gruenbacher <agruenba@redhat.com> - 2015-09-24 00:20 +0200
              Re: [RFC v7 26/41] richacl: Apply the file masks to a richacl "J. Bruce Fields" <bfields@fieldses.org> - 2015-09-24 17:30 +0200
                Re: [RFC v7 26/41] richacl: Apply the file masks to a richacl Andreas Gruenbacher <agruenba@redhat.com> - 2015-09-24 17:50 +0200

csiph-web