Re: gssapi and nfs4

["Brian J. Murrell" <brian-SquOHqY54CVWr29BmMi2cA@public.gmane.org>]

[-- Attachment #1: Type: text/plain, Size: 1261 bytes --]

On Wed, 2008-11-05 at 14:40 -0500, William A. (Andy) Adamson wrote:
> 
> A better way to limit access is to use ACL's on the directory,

Yes, indeed.  I have been holding off as long as I can on using ACLs
given the lack of integration into the GUI (i.e. gnome) environment thus
far.  For example, so far as I know, nautilus does not have any ACL
inspection/modification in it yet.  Maybe that's not such a big deal.
Just another layer I guess.

> which
> actually make a difference when running kerberos. :)

Yeah.

FWIU, ACLs would solve the other of the 2 problems that I went to nfs4
with gssapi for anyway and that's being able to more easily allow others
access to files.  Unix groups work fine for this as long as you can
control the umask/permission bits a particular application sets on the
files it creates.

While I can create inheritance rules for ownerships in the SYS security
model I can't create (inheritable) umask/permissions rules and have to
rely on either the users' global umask or the application giving, say,
group write permissions to a file.  Setting the users' global umask for
that is of course unacceptable and that only leaves attacking the
problem on an application-by-application basis.  Yuck.

b.


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 197 bytes --]