From: Jeremy Allison <jra@samba.org>
To: "J. Bruce Fields" <bfields@fieldses.org>
Cc: Jan Kara <jack@suse.cz>,
Andreas Gruenbacher <agruenba@redhat.com>,
Jeremy Allison <jra@samba.org>,
linux-fsdevel@vger.kernel.org, lsf-pc@lists.linux-foundation.org
Subject: Re: [Lsf-pc] [LSF/MM ATTEND] Richacls
Date: Tue, 13 Jan 2015 13:20:59 -0800 [thread overview]
Message-ID: <20150113212059.GF29564@samba2> (raw)
In-Reply-To: <20150113211612.GD4156@fieldses.org>
On Tue, Jan 13, 2015 at 04:16:13PM -0500, J. Bruce Fields wrote:
>
> Right, but look at the case above carefully again--it's *much* more
> special than the one the container people hit.
>
> You can absolutely still represent weird modes like 026 with a Richacl
> and it will deny permissions in the traditional way.
>
> What you can't do is represent the above POSIX ACL.
>
> This is a case that you can *only* hit with POSIX ACLs (not with mode
> bits). And that's because the POSIX ACL is doing something bizarre and
> useless that I've never seen any other ACL system do (denying read and
> write together when each would be permitted separately).
>
> Using the usual "if a tree fell in a forest and nobody heard it..."
> criterion, I think this change would be unlikely to cause us trouble.
Agreed. I scratched my head and simply couln't think of a
case where this could affect security of the system - only
backwards bug compatibility.
next prev parent reply other threads:[~2015-01-13 21:21 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1626890778.1513173.1421087867777.JavaMail.zimbra@redhat.com>
2015-01-12 21:06 ` [LSF/MM ATTEND] Richacls Andreas Gruenbacher
2015-01-12 21:54 ` Jeremy Allison
2015-01-12 22:30 ` J. Bruce Fields
2015-01-13 10:14 ` [Lsf-pc] " Jan Kara
2015-01-13 15:07 ` Andreas Gruenbacher
2015-01-13 16:48 ` Jeremy Allison
2015-01-13 17:23 ` Andreas Gruenbacher
2015-01-13 17:29 ` Jeremy Allison
2015-01-13 17:40 ` J. Bruce Fields
2015-01-13 18:04 ` Jeremy Allison
2015-01-13 19:53 ` Frank Filz
2015-01-13 20:24 ` 'J. Bruce Fields'
2015-01-13 20:26 ` Jeremy Allison
2015-01-13 20:30 ` Jeremy Allison
2015-01-13 20:35 ` Frank Filz
2015-01-14 7:57 ` Andreas Gruenbacher
2015-01-13 21:04 ` Jan Kara
2015-01-13 21:16 ` J. Bruce Fields
2015-01-13 21:20 ` Jeremy Allison [this message]
2015-01-13 21:27 ` Frank Filz
2015-01-13 21:31 ` Jan Kara
2015-01-14 8:53 ` Andreas Gruenbacher
2015-01-14 12:01 ` Jeff Layton
2015-01-14 16:11 ` J. Bruce Fields
2015-01-14 17:21 ` Frank Filz
2015-01-23 5:31 ` Steve French
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150113212059.GF29564@samba2 \
--to=jra@samba.org \
--cc=agruenba@redhat.com \
--cc=bfields@fieldses.org \
--cc=jack@suse.cz \
--cc=linux-fsdevel@vger.kernel.org \
--cc=lsf-pc@lists.linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.