From mboxrd@z Thu Jan  1 00:00:00 1970
From: Trond Myklebust <trond.myklebust@fys.uio.no>
Subject: Re: [PATCH] PAG support, try #2
Date: 18 May 2003 16:51:27 +0200
Sender: openafs-devel-admin@openafs.org
Message-ID: <shs8yt4l34g.fsf@charged.uio.no>
References: <Pine.LNX.4.44.0305140924040.3107-100000@home.transmeta.com>
	<19800.1052933820@warthog.warthog>
	<20030515131825.G672@nightmaster.csn.tu-chemnitz.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: David Howells <dhowells@warthog.cambridge.redhat.com>,
	Linus Torvalds <torvalds@transmeta.com>,
	David Howells <dhowells@redhat.com>, linux-kernel@vger.kernel.org,
	linux-fsdevel@vger.kernel.org, openafs-devel@openafs.org
Return-path: <openafs-devel-admin@openafs.org>
To: Ingo Oeser <ingo.oeser@informatik.tu-chemnitz.de>
In-Reply-To: <20030515131825.G672@nightmaster.csn.tu-chemnitz.de>
Errors-To: openafs-devel-admin@openafs.org
List-Help: <mailto:openafs-devel-request@openafs.org?subject=help>
List-Post: <mailto:openafs-devel@openafs.org>
List-Subscribe: <https://lists.openafs.org/mailman/listinfo/openafs-devel>,
	<mailto:openafs-devel-request@openafs.org?subject=subscribe>
List-Unsubscribe: <https://lists.openafs.org/mailman/listinfo/openafs-devel>,
	<mailto:openafs-devel-request@openafs.org?subject=unsubscribe>
List-Archive: <https://lists.openafs.org/pipermail/openafs-devel/>
List-Id: linux-fsdevel.vger.kernel.org

>>>>> " " == Ingo Oeser <ingo.oeser@informatik.tu-chemnitz.de> writes:

     > On Wed, May 14, 2003 at 06:37:00PM +0100, David Howells wrote:
    >> And then you have to have some method of prioritisation. You
    >> may find that user dhowells has a token for
    >> (fs=AFS,cell=redhat.com) and group engineering has a token for
    >> (fs=AFS,cell=redhat.com). Which do you use?

     > Union of both. And remember to subtract negative ACLs from
     > positive ACLs. Prioritize users over groups in case of explicit
     > mention.

     > This is standard permission checking.

     > Hmm, sounds too simple, so it must be wrong ;-)

Quite. Now that you've done the math, please explain how this should
be implemented efficiently. These are *networked* filesystems...

Cheers,
  Trond